Multi-user management method and system based on embedded operating system

Abstract

The invention belongs to the field of information security management, and particularly relates to a multi-user management method and system based on an embedded operating system. Comprising the following steps: S1, creating security, auditing and system administrator users, deleting a source code corresponding to a root user, and replacing the root user with the system administrator user; replacing the root user in the root user group to which the root user belongs with a system administrator user; s2, creating user groups respectively corresponding to the three administrator users; each administrator user belongs to a user group corresponding to the administrator user and also belongs to a user group corresponding to at least one other administrator user; s3, authorizing the authority of the file owner of the corresponding basic package for the security and audit administrator user according to the instruction execution requirement of the basic package; all permissions of the root user group are respectively distributed to the system, the security and audit administrator users and the corresponding user groups through the system administrator user according to the set refpolicy configuration strategy, and the users and the user groups with the corresponding set permissions are obtained.

Description

Technical Field

[0001] This invention belongs to the field of information security management, specifically relating to a multi-user management method and system based on an embedded operating system. Background Technology

[0002] Privileges are the necessary permissions for an operating system to perform certain secure operations, such as maintaining user accounts, installing software, and shutting down the system. If these privileged functions are abused, system security will be severely threatened. Typically, privilege management only grants permissions to system administrators, allowing only them to perform these operations. However, if a system administrator's permissions are stolen, or if their judgment based on experience is incorrect, the confidentiality and integrity of the system are highly likely to be compromised. Therefore, current mainstream operating systems take measures to restrict administrator super-privileges. For example, Chinese invention patent application CN102034052A discloses an operating system architecture and implementation method based on a three-tiered system of privileges. This scheme, specifically based on the Windows operating system, eliminates the system administrator with super-privileges and divides all their privileges into three mutually restrictive and supportive parts, assigning these three parts of permissions to three administrator roles, thus achieving a three-tiered system of privileges.

[0003] However, embedded operating system users are divided into two categories: root users (i.e., system administrators, with the highest privileges, who can perform all operations, including modifying system configurations and accessing sensitive data) and ordinary users (who can only perform limited operations, and whose permission scope is defined by the system administrator or security policies). Embedded operating systems all rely on root users to access and modify system-level files and directories, such as / etc, / usr, and / bin; at the same time, root users are the cornerstone of system security and maintenance, as many system-level tasks, such as installing software packages, updating the system, and configuring the network, require root privileges to execute.

[0004] In fact, Windows provides a comprehensive user rights management mechanism and a wealth of management tools (such as Local Security Policy and Group Policy Editor) to fully support the management of user rights and roles. However, compared with Windows operating systems, embedded operating systems rely too heavily on the root user. If one intends to configure permissions and achieve separation of powers in such an operating system, it is necessary to remove the system administrator (i.e., the root user) who has superuser privileges and divide all its privileges into three parts, assigning these three parts of permissions to the system administrator user, security administrator user, and audit administrator user respectively. However, embedded operating systems do not actually have corresponding configuration and management tools, thus failing to provide a basis for implementing the separation of powers for system administrator users, security administrator users, and audit administrator users in embedded operating systems. Summary of the Invention

[0005] The purpose of this invention is to provide a multi-user management method and system based on an embedded operating system, which solves the problem that the existing embedded operating system relies too heavily on the root user. If the intention is to configure permissions in the embedded operating system to achieve the separation of three rights, the lack of corresponding configuration and flexible management tools makes it impossible to provide a basis for implementing the separation of three rights for system administrator, security administrator and audit administrator users in the embedded operating system.

[0006] To achieve the above objectives, the present invention provides a multi-user management method based on an embedded operating system, the method comprising: S1: Create security, audit, and system administrator users; delete the source code corresponding to the root user in the operating system and replace the root user with the system administrator user; replace the root user in the root user group to which the root user belongs with the system administrator user; S2: Create user groups for security, audit, and system administrator users respectively; each administrator user belongs to its own user group and also belongs to at least one other administrator user's user group. S3: Based on the instruction execution requirements of the basic package, grant permissions to the file owners of the corresponding basic package to the security and audit administrator users respectively; The system administrator user assigns all permissions of the root user group to the system, security, and audit administrator users and their corresponding user groups according to the configured refpolicy, resulting in users and user groups with the corresponding permissions.

[0007] Beneficial Effects: This invention provides a novel multi-user management method based on an embedded operating system. This method involves creating security, audit, and system administrator users within the embedded operating system; deleting the source code corresponding to the root user in the operating system and replacing it with the system administrator user; then replacing the root user in the root user group with the system administrator user; creating user groups corresponding to the security, audit, and system administrator users respectively; each administrator user belongs to its own corresponding user group and also belongs to at least one other administrator user's user group, thus ensuring that each administrator user possesses certain permissions from other user groups; and further, based on the instruction execution requirements of the basic package, security, audit, and system administrator users are managed separately. The system administrator and audit administrator users are granted permissions to the file owners of the corresponding basic packages. This ensures that the security and audit administrator users can execute specific instructions of certain basic packages based on the permissions granted to the file owners of the corresponding basic packages. Then, the system administrator user distributes all permissions of the root user group to the system, security, and audit administrator users and their corresponding user groups according to the set refpolicy configuration policy. This results in each user and user group having the corresponding set permissions. This achieves the separation of permissions for system administrator users, security administrator users, and audit administrator users, providing a foundation for the subsequent implementation of the separation of permissions for system administrator users, security administrator users, and audit administrator users in the embedded operating system.

[0008] Furthermore, the GID of the system administrator user group is the same as the GID of the root user group.

[0009] Furthermore, the method for creating user groups corresponding to system, security, and audit administrators includes: generating user groups for creating system, security, and audit administrators by writing script files that modify the system configuration file of the embedded system using shadow function module instructions.

[0010] Furthermore, methods for replacing the root user with a system administrator user and replacing the root user in the root user group with a system administrator user include: modifying the passwd and shadow system configuration files to replace the root user and root user group information with the system administrator sysadm; and modifying the audit and shadow source codes to generate corresponding patch files for replacing the root user information with the system administrator user information.

[0011] Furthermore, the corresponding settings permissions of system administrator users include: user management permissions, file management permissions, and process management permissions; The user management permissions include: the permission to authenticate the identity of each administrator user through their unique identifier and obtain the identity information of each administrator user; and the permission to create ordinary users. The file management permissions include: the permission to construct a mapping relationship between users and executable program files in the system based on the digest value of the obtained executable program file; each executable program file has a mapping relationship with one or more users; The process management permissions include: at the current moment of system startup, the permission to determine whether the subject of the current process is a legitimate subject based on the process identifier information of the current process and obtain the determination result.

[0012] Furthermore, the corresponding permissions that security administrator users have include: access control management permissions, security isolation permissions, security policy permissions, security judgment permissions, and the permission to authorize operations by ordinary users; The access control management permissions include: the permissions bound to the system administrator user, security administrator user, and audit administrator user and their respective set permissions; the mutually exclusive set permissions of the system administrator user, security administrator user, and audit administrator user; and the permissions to control and prohibit the configuration of users who simultaneously have control permissions for a certain operation and operation permissions for that operation. The security isolation permissions include physically isolating the permissions of system administrator users, security administrator users, and audit administrator users to ensure that the permissions of system administrator users, security administrator users, and audit administrators do not conflict. The security policy permissions include permissions based on policies for assessing whether a user's access request is secure; The security determination authority includes the authority to determine whether a user's access request complies with the security policy; The authorization to perform operations on ordinary users includes the authority to authorize operations on ordinary users based on the set security policies and the principle of decentralization.

[0013] Furthermore, the corresponding permissions that the audit administrator user has include: the permission to write information in the audit queue to the audit log file by periodically polling the audit queue according to the set audit user policy; The information written in the audit log file includes: information on the access and operation of system administrator users, security administrator users, audit administrator users, and ordinary users; The structure of the audit log file includes: time, user, process, object, operation result, system management and security judgment, and device information.

[0014] To achieve the above objectives, the present invention also provides a multi-user management system based on an embedded operating system, including a processor, characterized in that the processor is used to execute a computer program to implement the steps of the multi-user management method based on the embedded operating system.

[0015] This embedded operating system-based multi-user management system can achieve the same beneficial effects as the aforementioned embedded operating system-based multi-user management method. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the process of multi-user management in an embedded operating system, as described in an embodiment of the multi-user management method based on an embedded operating system according to the present invention. Figure 2 This is a schematic diagram illustrating the principle of permission allocation for users and user groups in an embodiment of the multi-user management method based on an embedded operating system according to the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0018] Implementation Examples of Multi-User Management Methods Based on Embedded Operating Systems This embodiment presents a multi-user management method based on an embedded operating system. This method abolishes the super administrator of the embedded operating system and divides the configuration, authorization, and auditing of the embedded operating system into three separate roles. Each user has their own account, and the administrator and auditor must be different individuals, thus constructing an embedded operating system architecture based on the separation of powers. By mapping the super user's permissions, all privileges are divided into three mutually restrictive and mutually supportive parts: system management rights, security management rights, and security auditing rights. System management rights correspond to the management subsystem, security management rights to the security management subsystem, and security auditing rights to the auditing subsystem, achieving effective separation of privileges and completely eliminating the administrator role with all privileges in the embedded operating system.

[0019] Specifically, such as Figure 1 As shown, the multi-user management method based on an embedded operating system includes the following three steps: 1) Create security, audit, and system administrator users, delete the source code corresponding to the root user in the operating system, and replace the root user with the system administrator user; replace the root user in the root user group to which the root user belongs with the system administrator user.

[0020] In this embodiment, three administrator users are created in the buildroot embedded operating system: the system administrator user, the security administrator user, and the audit administrator user. The source code corresponding to the root user in the file system is deleted by modifying the source code using shadow. The system administrator user, one of the three administrator users created earlier, is used to replace the root user (by configuring rootfs_overlay in menuconfig, the system can be customized without changing the original root file system).

[0021] 2) Create user groups for security, audit, and system administrator users respectively; each administrator user belongs to its own user group and also belongs to at least one other administrator user's user group.

[0022] In this embodiment, the principle for creating the three administrator user groups (i.e., the system administrator user group, the security administrator user group, and the audit administrator user group) corresponding to the three administrator users is as follows: Figure 2 As shown, the `usermod` command of `shadow` is used to ensure that each administrator user belongs to its own user group, and also belongs to at least one other administrator user's user group; Figure 2 Taking the sysadm user group (i.e., the system administrator user group) as an example, sysadm:x:0: sysadm,secadm,auditadm means that the sysadm user (i.e., the system administrator user) belongs to its corresponding sysadm user group. At the same time, the secadm user (i.e., the security administrator user) and the audiotadm user (i.e., the audit administrator user) also belong to the sysadm user group. Therefore, the secadm user and the audiotadm user also enjoy the privileges of the sysadm user group.

[0023] 3) Based on the instruction execution requirements of the basic package, grant permissions to the file owners of the corresponding basic package to the security and audit administrator users respectively; The system administrator user assigns all permissions of the root user group to the system, security, and audit administrator users and their corresponding user groups according to the configured refpolicy, resulting in users and user groups with the corresponding permissions.

[0024] In this embodiment, the file ownership permissions of the secadm (i.e., security administrator user) and audiotadm (i.e., audit administrator user) users are granted through the .mk configuration file of the base package; because the secadm and audiotadm users need to have the permissions of the file owner to execute certain instructions of the base package.

[0025] like Figure 2 As shown, the sysadm user (i.e., the system administrator user) uses the refpolicy policy package in SELinux to allocate all permissions of the root user group to the system, security, and audit administrator users and their corresponding user groups according to the set refpolicy configuration policy (which specifically specifies the read / write operations and process command operations of the sysadm, secadm, and auditadm users, as well as the permission functions of each user). This results in users and user groups with the corresponding set permissions. This refpolicy configuration policy is actually a multi-level access control model, which includes permission allocation for files, categories, processes, etc. In this embodiment, this policy model has also been adapted accordingly.

[0026] In this embodiment, the GID of the system administrator user group is the same as the GID of the root user group.

[0027] Specifically, by modifying the passwd and group configuration files, each user can have a unique UID (User ID), and each user group can have a unique GID (Group ID), thus enabling multi-user separation for the root user. For example... Figure 2 The sysadm user group (i.e., the system administrator user group) is shown. Since the GID of the root user group is usually set to 0 by default, in this embodiment, when modifying the code to separate multiple users, the GID of the sysadm user group is also set to 0 (i.e., the GID of the system administrator user group is the same as the GID of the root user group) to reduce the complexity of code modification.

[0028] In this embodiment, the method for creating user groups corresponding to system, security, and audit administrators includes: generating user groups for creating system, security, and audit administrators by writing a script file that is used to modify the system configuration file of the embedded system using shadow function module instructions.

[0029] Specifically, a script file is written, which uses the usermod function command in shadow to modify the system configuration file and compile and load it before system startup, generating the system administrator user group, security administrator user group and audit administrator user group respectively, so as to create the three administrator user groups corresponding to the above three administrator users (i.e., system administrator user group, security administrator user group and audit administrator user group).

[0030] In this embodiment, the method of replacing the root user with a system administrator user and replacing the root user in the root user group to which the root user belongs with a system administrator user includes: modifying the passwd and shadow system configuration files to replace the root user and root user group information with the system administrator sysadm; and modifying the audit source code and shadow source code to generate a corresponding patch file for replacing the root user information with the system administrator user information.

[0031] Specifically, by modifying the passwd and shadow configuration files in the root directory of the embedded system, the root user and root user group information are replaced with the system administrator sysadm, and this is loaded and compiled before system startup. At the same time, modifications are made to the shadow and audit source code modules to generate corresponding patch files that replace the root user information with the system administrator user information. By combining the two (modifying the passwd and shadow configuration files in the root directory of the embedded system, and modifying the shadow and audit source code modules), the root user can be replaced with the system administrator user (that is, the root user in the root user group to which the root user belongs is replaced with the created system administrator user).

[0032] In this embodiment, the corresponding setting permissions of the system administrator user include: user management permissions, file management permissions, and process management permissions; User management permissions include: the permission to authenticate the identity of each administrator user through their unique identifier and obtain their identity information; and the permission to create ordinary users. File management permissions include: the permission to construct a mapping relationship between users and executable files in the system based on the digest value of the obtained executable file; each executable file has a mapping relationship with one or more users; Process management permissions include: at the current moment of system startup, the permission to determine whether the subject of the current process is a legitimate subject based on the process identifier information of the current process and to obtain the determination result.

[0033] Specifically, after allocating permissions through the refpolicy configuration policy, the permissions assigned to system administrator users are mainly divided into three parts: user management permissions, file management permissions, and process management permissions.

[0034] User management permissions include: system administrators have the authority to authenticate the identity of each administrator user (i.e., system administrator, security administrator, and audit administrator) using their unique identifier (key), and obtain the identity information of each administrator user after authentication; at the same time, system administrators also have the authority to create ordinary users such as user1 and user2.

[0035] File management permissions include: the permission to establish a mapping relationship between users and executable files based on the digest values ​​of the executable files (all executable files are collected using the common SHA1 algorithm at system initialization); based on this permission, each executable file can be mapped to all users in the system, or it can be mapped to only one user in the system.

[0036] Process management permissions include the permission to determine whether the subject of the current process is a legitimate subject and obtain the determination result when the system starts up, based on the process identifier information of the current process.

[0037] In this embodiment, the corresponding setting permissions of the security administrator user include: access control management permissions, security isolation permissions, security policy permissions, security judgment permissions, and the permission to authorize the operations of ordinary users; Access control management permissions include: the permissions bound to the system administrator user, security administrator user, and audit administrator user and their respective set permissions; mutually exclusive set permissions of the system administrator user, security administrator user, and audit administrator user; and the permission to prevent users from having both control permissions for a certain operation and operation permissions for that operation. Security isolation permissions include physically isolating the permissions of system administrator users, security administrator users, and audit administrator users to ensure that the permissions of system administrator users, security administrator users, and audit administrators do not conflict. Security policy permissions include permissions based on policies that measure whether a user's access request is secure; Security assessment permissions include the authority to determine whether a user's access request complies with security policies; The authorization to perform operations on ordinary users includes the authority to authorize operations on ordinary users based on the set security policies and the principle of decentralization.

[0038] Specifically, after assigning permissions through the refpolicy configuration policy, the permissions assigned to security administrator users are mainly divided into four parts: access control management permissions, security isolation permissions, security policy permissions, and security judgment permissions.

[0039] a) Access control management permissions include: Control the binding of user roles and their permissions (i.e., the binding of system administrator users, security administrator users, and audit administrator users with their respective set permissions); Control the mutual exclusion of permissions for each user role (i.e., control the mutual exclusion of the permissions set for system administrator users, security administrator users, and audit administrator users); Prohibit the configuration of user roles that simultaneously have control and operation (such as maintenance or modification) permissions (i.e., prohibit the configuration of users who simultaneously have control permissions for a certain operation and operation permissions for that operation).

[0040] b) Security isolation permissions are implemented by physically and logically isolating system administrator users, security administrator users, and audit administrator users to ensure that the permissions of system administrator users, security administrator users, and audit administrators do not conflict.

[0041] c) Security policy permissions include permissions based on policies that measure whether a user's access request is secure; the policy is a security policy package, that is, the permissions of the user are limited by the corresponding security policies through the security policy package.

[0042] d) Security judgment permissions include: the permission to judge whether a user's access request complies with the security policy, that is, the permission to judge a user's access request according to the security policy defined in the security policy package.

[0043] e) The permissions to authorize operations for ordinary users include: After an ordinary user is created by a system administrator, the ordinary user's account does not have operation permissions. At this time, the security administrator user authorizes the ordinary user's operations according to the set security policy and the principle of decentralization. That is, the security administrator user has the permission to authorize the ordinary user's operations.

[0044] In this embodiment, the corresponding settings permissions of the audit administrator user include: the permission to write information in the audit queue to the audit log file by periodically polling the audit queue according to the set audit user policy; The information in the audit queue includes: logs recording access and operations of system administrator users, security administrator users, audit administrator users, and ordinary users; In this embodiment, the structure of the audit log file includes: time, user, process, object, operation result, system management and security judgment, and device information.

[0045] Specifically, after allocating permissions through the refpolicy configuration policy, the permissions to write information in the audit queue to the audit log file are granted by periodically polling the audit queue according to the set audit user policy.

[0046] In this embodiment, the information written in the audit log file includes log records for system users, security users, audit users, and ordinary users. Its structure includes: time, user, process, object, operation result, system management and security judgment, and device information. In other embodiments, the structure of the audit log file can also be adapted and customized.

[0047] Since the specific methods for allocating permissions through refpolicy configuration policies are existing technologies, they will not be elaborated here.

[0048] Implementation of a Multi-User Management System Based on an Embedded Operating System This embodiment provides a multi-user management system based on an embedded operating system. The system includes a processor that stores executable program instructions, which are used to implement the multi-user management method based on an embedded operating system as described in the above embodiment.

[0049] Since the specific working method and working principle of the multi-user management system based on the embedded operating system in this embodiment have been described in detail in the above embodiments of the multi-user management method based on the embedded operating system, they will not be repeated here.

[0050] It should be understood that the above-described specific embodiments of the present invention are merely illustrative or explanatory of the principles of the present invention, and do not constitute a limitation thereof.

Claims

1. A multi-user management method based on an embedded operating system, characterized in that, include: S1: Create security, audit, and system administrator users; delete the source code corresponding to the root user in the operating system and replace the root user with the system administrator user; replace the root user in the root user group to which the root user belongs with the system administrator user; S2: Create user groups for security, audit, and system administrator users respectively; each administrator user belongs to its own user group and also belongs to at least one other administrator user's user group. S3: Based on the instruction execution requirements of the basic package, grant permissions to the file owners of the corresponding basic package to the security and audit administrator users respectively; The system administrator user assigns all permissions of the root user group to the system, security, and audit administrator users and their corresponding user groups according to the configured refpolicy, resulting in users and user groups with the corresponding permissions.

2. The multi-user management method based on an embedded operating system according to claim 1, characterized in that, The system administrator user group's GID is set to be the same as the root user group's GID.

3. The multi-user management method based on an embedded operating system according to claim 1, characterized in that, One way to create user groups corresponding to system, security, and audit administrators is by writing script files that modify the system configuration file of the embedded system using shadow function module instructions to generate user groups for creating system, security, and audit administrators.

4. The multi-user management method based on an embedded operating system according to any one of claims 1-3, characterized in that, The methods for replacing the root user with a system administrator user and replacing the root user in the root user group with a system administrator user include: modifying the passwd and shadow system configuration files to replace the root user and root user group information with the system administrator sysadm; and modifying the audit and shadow source codes to generate corresponding patch files for replacing the root user information with the system administrator user information.

5. The multi-user management method based on an embedded operating system according to any one of claims 1-3, characterized in that, The corresponding settings permissions of system administrator users include: user management permissions, file management permissions, and process management permissions; The user management permissions include: the permission to authenticate the identity of each administrator user through their unique identifier and obtain the identity information of each administrator user; and the permission to create ordinary users. The file management permissions include: the permission to construct a mapping relationship between users and executable program files in the system based on the digest value of the obtained executable program file; each executable program file has a mapping relationship with one or more users; The process management permissions include: at the current moment of system startup, the permission to determine whether the subject of the current process is a legitimate subject based on the process identifier information of the current process and obtain the determination result.

6. The multi-user management method based on an embedded operating system according to any one of claims 1-3, characterized in that, The corresponding permissions that security administrator users have include: access control management permissions, security isolation permissions, security policy permissions, security judgment permissions, and the permission to authorize operations of ordinary users; The access control management permissions include: the permissions bound to the system administrator user, security administrator user, and audit administrator user and their respective set permissions; the mutually exclusive set permissions of the system administrator user, security administrator user, and audit administrator user; and the permissions to control and prohibit the configuration of users who simultaneously have control permissions for a certain operation and operation permissions for that operation. The security isolation permissions include physically isolating the permissions of system administrator users, security administrator users, and audit administrator users to ensure that the permissions of system administrator users, security administrator users, and audit administrators do not conflict. The security policy permissions include permissions based on policies for assessing whether a user's access request is secure; The security determination authority includes the authority to determine whether a user's access request complies with the security policy; The authorization to perform operations on ordinary users includes the authority to authorize operations on ordinary users based on the set security policies and the principle of decentralization.

7. The multi-user management method based on an embedded operating system according to any one of claims 1-3, characterized in that, The corresponding permissions that audit administrator users have include: the permission to write information in the audit queue to the audit log file by periodically polling the audit queue according to the set audit user policy; The information written in the audit log file includes: information on the access and operation of system administrator users, security administrator users, audit administrator users, and ordinary users; The structure of the audit log file includes: time, user, process, object, operation result, system management and security judgment, and device information.

8. A multi-user management system based on an embedded operating system, comprising a processor, characterized in that, The processor is used to execute computer programs to implement the steps of the multi-user management method based on an embedded operating system as described in any one of claims 1-7.

Images