CN102542187B - Based on the method that safe sandbox improves computer security performance - Google Patents
Based on the method that safe sandbox improves computer security performance Download PDFInfo
- Publication number
- CN102542187B CN102542187B CN201010602244.9A CN201010602244A CN102542187B CN 102542187 B CN102542187 B CN 102542187B CN 201010602244 A CN201010602244 A CN 201010602244A CN 102542187 B CN102542187 B CN 102542187B
- Authority
- CN
- China
- Prior art keywords
- request
- black box
- secure
- software
- secure black
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention discloses a kind of method improving computer security performance based on safe sandbox, for protecting, custom system is clean, safety, comprise the following steps: software is arranged in secure black box by user, secure black box operates in system core state, monitoring and intercepting and capturing operate in the application software behavior in black box, if software sends I/O request, request is joined in request queue after obtaining this request by secure black box; I/O request analyser within secure black box takes request from queue, is analyzed judging; If this request accesses secure black box internal resource, then request is put in execution queue; If asking to access external system resource with read-only mode, then allow this request and put in execution queue; If external system resource is revised in request, then secure black box is internally generated a resource image for this external resource at secure black box, this I/O request is redirected to request secure black box internal resource, and puts in I/O execution queue. The present invention protects the clean safety of client.
Description
Technical field
The present invention relates to a kind of method improving computer security performance.
Background technology
Safe sandbox is a kind of " environment ", originate insincere, possess vandalism or be intended to not clear program and can be performed wherein, but, operating system can't be had any impact by all changes in sandbox. Current Sandboxing runs in multiple different software. Computer memory is accessed, it is prevented that cause browser or other software crash just run because of single network application program as GOOGLE browser chrome takes the lead in adopting Sandboxing limiting network application program to cross virtual boundary.
" PowerShadow " is also a kind of application of Sandboxing. PowerShadow adopts operating system Intel Virtualization Technology to generate the image of current operation system, has function duplicate with real system. After entering PowerShadow, all operations is all virtual, and therefore all of virus and rogue software all cannot infect real operating system. When system goes wrong, or online produces garbage files, only need to restart computer easily, make the original state of system recovery.
But, safety can be greatly promoted among sandbox although whole system being put into, but the execution efficiency of software can be affected to a certain extent, because all operations not all exists risk. So directly result in the Consumer's Experience affecting software. And solve only by restarting system when system encounters problems.
Equally, being applied to by Sandboxing in each independent software, software developer to be not only concerned about designing and developing of concrete software, to be also concerned about the safety how using Sandboxing to ensure software, add the cost of software development.
Summary of the invention
The technical problem to be solved in the present invention is to provide a kind of method improving computer security performance based on safe sandbox, and it can be protected, and computer system is clean, safety.
In order to solve above technical problem, the invention provides a kind of method improving computer security performance based on safe sandbox, comprise the following steps:
User adds in secure black box, installs application software;
Secure black box operates in system core state, intercepts and captures the software action operating in black box during operation;
To undelegated non-security behavior, it is stoped to perform or by whether user's ruling allows this to operate; Such as stop the memory read-write of undelegated striding course, access network etc. the information that gives a warning, by user it is finally decided whether allow this behavior. If software sends I/O request, request is joined in request queue after obtaining this request by secure black box;
I/O request analyser within secure black box takes request from queue, is analyzed judging;
If this request accesses secure black box internal resource, then request is put in execution queue;
If asking to access external system resource with read-only mode, then allow this request and put in execution queue;
If request amendment external system resource, then secure black box is internally generated a resource image for this external resource at secure black box, revise this request after success, this I/O request is redirected to request secure black box internal resource, put into wait in I/O execution queue and run.
The beneficial effects of the present invention is: secure black box can protect the clean safety of client. The use of secure black box can protect the clean of custom system in user level, the impact of the garbage files produced when not being subject to software to install or run, and also protects system from the infringement of virus or Malware, it is ensured that the safety of system simultaneously. Can directly delete when being no longer necessary to this secure black box, solve to unload completely the worry of some common people's software of current-carrying. Compared with PowerShadow, it is not necessary to encounter problems every time and need to restart system, only need to delete black box can solve problem, it is ensured that the clean and safety of system, user-friendly again. From technological layer, secure black box can make again software developer without being concerned about the safe practice utilizations in software such as sandbox, thus being devoted to the exploitation of software actual functional capability. User can arbitrarily install and delete software in secure black box and secure black box. The additions and deletions of secure black box do not affect the use of external system, and will not stay " vestige " in external system.
Accompanying drawing explanation
Below in conjunction with the drawings and specific embodiments, the present invention is described in further detail.
Fig. 1 is the schematic diagram of method described in the embodiment of the present invention.
Detailed description of the invention
The present invention adopts the method closing software runtime environment, monitoring software running status. Especially by the behavior intercepting running software, including striding course internal storage access, bottom I/O request operation, access network etc., when intercepting and capturing software action, if software request striding course accesses internal memory or accesses network, then transfer to whether user's ruling runs software. If software sends I/O request, request is joined in request queue after obtaining this request by secure black box; If the I/O request intercepted is analyzed being redirected to inside secure black box by secure black box, reach to close the purpose of software runtime environment. When request accesses external system devices file, and when this request permissions is inadequate, secure black box is attempted being internally generated a device Image file for the external equipment file of these needs at secure black box, and adjusts this I/O request operation so that it is access newly-generated internal unit file.Behavior state when monitoring software runs simultaneously, to undelegated non-security behavior, stops it to perform or by whether useful ruling allows this to operate. Such as stop the memory read-write of undelegated striding course, access network etc. the information that gives a warning, by user it is finally decided whether allow this behavior.
The method adopting the present invention, running software is made to be closed in inside secure black box, the file etc. generated during software installation and operation or download is locked in inside secure black box, and therefore potential safety hazard is also isolated in secure black box, prevents some unsafe act in running software period simultaneously. Not only ensure that software will not pollute external system, keep the clean of external system, also protect the safety of user and system simultaneously, stop viral infection external system file. To read and write resource file, the software run in security system allows read-write resource file within security system, and for the resource of external system, security system only allows software to be read out, and does not allow to revise these resources. When software needs amendment external resource files really, security system is that the external resource needing amendment is internally generated a reflection resource in security system, adjusts this I/O operation simultaneously, allows it access the reflection resource file that amendment is newly-generated. Ensure that the software run in security system will not revise destruction external system file with this, keep system clean. Therefore, the secure black box of the present invention is used to be effectively protected the clean of client and safety.
As it is shown in figure 1, the flow process that the present invention performs based on the application safety black box of safe sandbox is as follows:
Client installs startup optimization secure black box after secure black box, it is possible to adds for secure black box and deletes software.
There are two kinds of addition manners: one is to add the mounted software of external system, i.e. trustship mode is added, and the operation of external software is completed by secure black box trustship and monitors; Another kind is that mounting means adds, and namely directly a software is installed into secure black box.
Deleting the software arranged in secure black box to there being two kinds of different modes: one is to cancel trustship, another kind is the software that unloading is installed in secure black box. When noting deleting secure black box two ways had different impacts, for the former, without influence on the use in external system of this software after deletion; And the latter can be deleted in the lump with security system.
After configuring secure black box, run software. The operation of secure black box monitoring software, intercepts and captures some behaviors operation of software, such as I/O operation and some predefined dangerous operations, for instance striding course memory read-write and access network etc. Queue is performed for I/O operation, one the I/O request queue of secure black box internal maintenance and I/O. Sending I/O request during running software, request is joined in request queue after obtaining this request by secure black box. I/O request analyser within secure black box takes request from queue, is analyzed judging. If this request accesses secure black box internal resource, then request is put in execution queue; If asking to access external system resource with read-only mode, then allow this request and put in execution queue; If request amendment external system resource, then secure black box is attempted being internally generated a resource image for this external resource at secure black box, revise this request after success, this I/O request is redirected to request secure black box internal resource, put into wait in I/O execution queue and run.
Operating for unsafe striding course memory read-write, if this operation is uncommitted, secure black box provides safety instruction, and by user's ruling, whether this operates and continue. For softward interview network, secure black box allows software to read data from outer net, and when occurring software to send sensitive data to outer net, secure black box provides safety instruction.
Described secure black box is with an application software mode startup optimization operating in peripheral operation system core state. The operation of software is directly transferred to peripheral operation system to complete by black box, and black-box system is responsible for monitoring. After secure black box startup optimization, intercept and capture software action operation, including the operation of I/O resource request and unsafe act operation, above-mentioned behavior is further analyzed and processes.
The present invention is by adopting the method closing software runtime environment and monitoring software operation action, it is ensured that " will not pollute " external system when installing software or run software, can directly delete when being no longer necessary to certain software or whole secure black box. Secure black box ensures in uninstalling system that software or whole secure black box are completely and without influence on external system, will not leave any information in external system after unloading. Solution cannot unload rogue software completely, remove the problems such as virus and Malware. And secure black box can protect user and system by virus and the infringement of Malware.
The present invention is not limited to embodiment discussed above. Above the description of detailed description of the invention is intended to describe and the technical scheme that the present invention relates to being described. Apparent conversion or replacement based on present invention enlightenment should also be as being considered within protection scope of the present invention. Above detailed description of the invention is used for disclosing the best implementation of the present invention, so that those of ordinary skill in the art can apply the numerous embodiments of the present invention and multiple alternative to reach the purpose of the present invention.
Claims (3)
1. the method improving computer security performance based on safe sandbox, it is characterised in that: comprise the following steps:
User adds in secure black box, installs application software;
Secure black box operates in system core state, intercepts and captures the software action operating in black box during operation;
To undelegated non-security behavior, it is stoped to perform or by whether user's ruling allows this to operate;
If software sends I/O request, request is joined in request queue after obtaining this request by secure black box;
I/O request analyser within secure black box takes request from queue, is analyzed judging;
If this request accesses secure black box internal resource, then request is put in execution queue;
If asking to access external system resource with read-only mode, then allow this request and put in execution queue;
If request amendment external system resource, then secure black box is internally generated a resource image for this external system resource at secure black box, revise this request after success, this I/O request is redirected to request secure black box internal resource, put into wait in execution queue and run;
Black box obtains the I/O device request of the external system of process, after secure black box analysis request, judge whether the operation of this request has permission, if there is no enough authorities, external system devices is done device interior reflection by secure black box in black box, adjust and ask to ask for internal I/O, the request input after adjusting is continued executing with.
2. the method improving computer security performance based on safe sandbox as claimed in claim 1, it is characterized in that: monitoring software operation action, if software request striding course accesses internal memory or accesses network, then stop this behavior or transfer to whether user's ruling continues this behavior.
3. the method improving computer security performance based on safe sandbox as claimed in claim 2, it is characterised in that secure black box operates in operating system kernel state, accesses operating system nucleus data structure and kernel function;Under windows platform, secure black box runs in the way of driver; Under Linux platform, secure black box is startup optimization in the way of module.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010602244.9A CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010602244.9A CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102542187A CN102542187A (en) | 2012-07-04 |
| CN102542187B true CN102542187B (en) | 2016-06-15 |
Family
ID=46349056
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201010602244.9A Active CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102542187B (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102819711A (en) * | 2012-08-21 | 2012-12-12 | 北京思创银联科技股份有限公司 | Restoring protection method for magnetic disk |
| US9465596B2 (en) * | 2012-09-27 | 2016-10-11 | Google Inc. | Cross system installation of web applications |
| CN104063284B (en) * | 2013-03-18 | 2016-07-06 | 腾讯科技（深圳）有限公司 | The method and apparatus running application program |
| CN104036183B (en) * | 2013-05-17 | 2015-04-08 | 腾讯科技（深圳）有限公司 | Method and system for installing software in sandbox |
| CN103778384B (en) * | 2014-02-24 | 2016-09-28 | 北京明朝万达科技股份有限公司 | The guard method of the virtual terminal security context of a kind of identity-based certification and system |
| CN104182684A (en) * | 2014-08-15 | 2014-12-03 | 浪潮电子信息产业股份有限公司 | Design solution of security process operating environment |
| CN105528542B (en) * | 2014-09-28 | 2018-07-17 | 北京云巢动脉科技有限公司 | A kind of management-control method and system for exempting from installation and operation based on software |
| CN104408367B (en) * | 2014-11-28 | 2019-04-05 | 北京奇虎科技有限公司 | Application program configuration method and device |
| CN104376255B (en) * | 2014-11-28 | 2017-05-24 | 北京奇虎科技有限公司 | Application program running control method and device |
| CN105138905A (en) * | 2015-08-25 | 2015-12-09 | 中国科学院信息工程研究所 | Isolation operation method for Linux application program |
| CN106874731A (en) * | 2017-04-14 | 2017-06-20 | 深信服科技股份有限公司 | A kind of application layer multi-user method and device based on terminal |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101510888A (en) * | 2009-03-19 | 2009-08-19 | 阿里巴巴集团控股有限公司 | Method, device and system for improving data security for SaaS application |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8176334B2 (en) * | 2002-09-30 | 2012-05-08 | Guardian Data Storage, Llc | Document security system that permits external users to gain access to secured files |
| US20100229218A1 (en) * | 2009-03-05 | 2010-09-09 | Microsoft Corporation | Quota management for network services |
-
2010
- 2010-12-23 CN CN201010602244.9A patent/CN102542187B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101510888A (en) * | 2009-03-19 | 2009-08-19 | 阿里巴巴集团控股有限公司 | Method, device and system for improving data security for SaaS application |
Non-Patent Citations (1)
| Title |
|---|
| 《一种基于Xen半虚拟化技术的沙盒模型的设计与实现》;戴新宇;《万方学位论文》;20100125;第14-44页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102542187A (en) | 2012-07-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102542187B (en) | Based on the method that safe sandbox improves computer security performance | |
| US7409719B2 (en) | Computer security management, such as in a virtual machine or hardened operating system | |
| Bauman et al. | A survey on hypervisor-based monitoring: approaches, applications, and evolutions | |
| KR102255767B1 (en) | Systems and methods for virtual machine auditing | |
| RU2645268C2 (en) | Complex classification for detecting malware | |
| Xiong et al. | Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions. | |
| Pearce et al. | Virtualization: Issues, security threats, and solutions | |
| Abbasi et al. | ECFI: Asynchronous control flow integrity for programmable logic controllers | |
| US8341369B2 (en) | Providing protected access to critical memory regions | |
| US20070005919A1 (en) | Computer system protection based on virtualization | |
| Kurmus et al. | Attack surface reduction for commodity OS kernels: trimmed garden plants may attract less bugs | |
| CN102799817A (en) | System and method for malware protection using virtualization | |
| Schrammel et al. | Jenny: Securing Syscalls for {PKU-based} Memory Isolation Systems | |
| CN105138905A (en) | Isolation operation method for Linux application program | |
| CN105512550A (en) | Systems and methods for active operating system kernel protection | |
| Armando et al. | Breaking and fixing the android launching flow | |
| US20150007332A1 (en) | Systems and methods for directing application updates | |
| CN103345604A (en) | Sandbox system based on light-weight virtual machine monitor and method for monitoring OS with sandbox system | |
| Armando et al. | Android permissions unleashed | |
| Jia et al. | Programmable system call security with ebpf | |
| CN103425563A (en) | Online input/output (I/O) electronic evidence obtaining system and method based on virtualization technology | |
| Leon et al. | Hypervisor-based white listing of executables | |
| Hawkins et al. | BlackBox: Lightweight security monitoring for COTS binaries | |
| Shi et al. | Vanguard: A cache-level sensitive file integrity monitoring system in virtual machine environment | |
| Tsifountidis | Virtualization security: Virtual machine monitoring and introspection |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |