JP2005085026A - Access control device and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid interference to access control information and the like from outside by strengthening OS security. <P>SOLUTION: A state transition control unit 4 allows state transition from an auditing mode to a protection mode and from an operative mode to the protection mode with unauthorized access based on unauthorized access definition information detected by an unauthorized access detection part 3, disallows services to be provided outside in the auditing mode, a right of access by a security manager in the operative mode, and all the permissions which can modify a system in the protection mode via an access control unit 5. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an access control apparatus and a program for controlling an access request issued from a user to each resource of a computer system including a network.

Firewalls and IDS (Intrusion Detection System) are known as means for detecting and blocking unauthorized access. These products perform matching with pre-defined pattern information for each network packet, block those that are determined to be unauthorized access, and issue warnings.
The above products are based on a known attack pattern as a premise, and are based on packet monitoring, so there is a limit to detection of illegal code execution that pretends to be a normal request. Ultimately, it is the function of access control by the basic software (OS: Operating System) that can suppress the deviating behavior in the processing process such as unauthorized code execution caused by a request from such a malicious user. is there.
The OS responds to access requests such as reading, writing, deleting, newly creating, appending, executing, renaming, etc. to system resources such as files, directories, processes, networks, devices, and memories from users including administrators. It has a function of determining whether or not it is possible based on predetermined access control information.

An outline of conventional access control using a UNIX (registered trademark) OS as an example will be briefly described with reference to a conceptual diagram of operation shown in FIG.
In FIG. 11, first, it is assumed that the user “jdoe” issues a directory deletion request “foo” via the application (command execution a). This request is entrusted from the user mode to the kernel by the system call “rmdir ()” (system call b). Then, in the processing function “vfs_rmdir ()”, a permission check “may_create ()” is called and access control is executed (access control c).
Here, the kernel determines whether or not an access right is given to a combination of a subject (accessing side), an object (access target), and a method (access type) based on the access control information. . In the UNIX (registered trademark) OS, permission for “read / write / execute” is given to each object for file owners, groups, and other users, and subject UID (User Identifier) and Access permission / non-permission is determined based on a GID (Group Identifier) (permission check d). If “rmdir: delete directory”, write / execute authority is required for the upper directory to be deleted. If access is permitted, “rmdir”: processing) is executed, and if not permitted, an error is returned to the user (processing e according to the determination result).

As described above, access control by the OS can impose control on access rights not only for general users but also for administrators. However, since there is always an administrator who has authority to the access right setting itself, all rights of the system are seized by acquiring this user authority illegally.
In a UNIX (registered trademark) OS, it has been desired to eliminate various vulnerabilities in which a root user falls under this category and the root authority can be obtained illegally.

The above-described prior art has the following problems in protecting access control information. That is, the access control information itself is also an object, and therefore there is always an administrator who can access and change them, so that it is necessary not to be a risk of falsification of the access control information.
If it is a normal UNIX (registered trademark) OS, the access right (owner, group permission) for each object is changed by a command such as “own / chgrp / chmod” if it is the owner of the object. Is possible. Further, if the administrator authority such as root is given, the access right can be changed for all objects. For this reason, when an unauthorized intrusion is performed in such a manner that root authority is taken, the meaning of protecting each object by the access right is reduced.

For such a problem, “forcing access control” based on access right setting determined by the administrator for access control, or “reducing authority” for reducing the root authority and giving the authority for setting access right to another administrator, etc. A high-reliability OS that has been enhanced by security has been put into practical use.
In addition, the objects to be accessed and the objects to be accessed are classified in detail, and specific restrictions are forcibly applied based on the classification to eliminate a single privileged user. An access control method, an access control apparatus, and a recording medium that increase security by minimizing or eliminating them have been filed (see, for example, Patent Document 1).
Japanese Unexamined Patent Publication No. 2002-149494 (paragraphs 0032-0033, FIG. 3)

  However, in the prior art including the above-described Patent Document 1, if the administrator's authority is deprived, the result is that the access right setting itself is changed. It will not be.

The present invention has been made in view of the above circumstances, and updates the security level every time an unauthorized access is detected based on the unauthorized access definition information, and controls the access control information accordingly to control the access authority described above. It is an object of the present invention to provide an access control apparatus and a program thereof that can strengthen the OS security by reducing the size and avoid external interference with access control information and the like.
Also, to provide an access control device and its program capable of flexible security control by performing control to lower the security level when it is determined that the risk of unauthorized access is low based on a predetermined safety judgment Also aimed.

  In order to solve the above-described problems, the present invention provides an access control apparatus for controlling an access request issued from a user to each resource of a computer system including a network, wherein the requested access is defined in advance. An unauthorized access detection unit that determines whether or not the requested access is unauthorized access by comparing with certain predetermined unauthorized access definition information, and triggered by detection of the unauthorized access, from the audit mode to the protection mode and the operation mode A state transition control unit that permits state transition from a protection mode to a protection mode, and at least the externally provided service is not permitted in the audit mode, and the access right by the security administrator is not permitted in the operation mode. In all of the permissions that can make changes to the system, Characterized by comprising an access control unit for a variable, a.

According to the present invention, the state transition control unit permits the state transition from the audit mode to the protection mode and from the operation mode to the protection mode when the unauthorized access is detected based on the unauthorized access definition information. In the audit mode, the service provided to the outside is disallowed, in the operation mode, the access right by the security administrator is disallowed, and in the protection mode, all permissions that can change the system are disallowed. It is possible to provide an access control device that can enhance security and avoid external interference with access control information and the like.
Here, “access control information” refers to usage requests (read / write / delete / new) to system resources (files, directories, processes, networks, devices, memory, etc.) issued by users including administrators. (Create / add / execute / name change, etc.)
In addition, “unauthorized access definition information” is definition information of access that should be prohibited, and may be defined as all access that is not permitted by “access control information”. May be defined.

  In the present invention, the state transition control unit controls transition by detecting unauthorized access by the unauthorized access control unit detection unit, except for transition from the audit mode to the operation mode.

  In the present invention, the unauthorized access definition information includes a set of an access side and an access means for each of the modes, and is stored in a storage device.

In the present invention, the operation mode is defined by dividing it into at least two modes, and transition between the modes is permitted according to the frequency of unauthorized access detection by the unauthorized access detection unit.
According to the present invention, an access control apparatus capable of flexible security control is provided by performing control to lower the security level when it is determined that the risk of unauthorized access is low according to the frequency of unauthorized access detection. be able to.

  In order to solve the above-described problems, the present invention provides a program used in an access control apparatus for controlling an access request issued from a user to each resource of a computer system including a network, wherein the requested access is A first step of comparing whether or not the requested access is unauthorized access by comparing with predetermined unauthorized access definition information defined in advance, and the protection mode from the audit mode triggered by the detection of the unauthorized access. , And a second step of permitting state transition from the operation mode to the protection mode, and disabling at least the service provided to the outside in the audit mode, and disallowing the access right by the security administrator in the operation mode In the protection mode, the permissions that can change the system A third step of disallowed for all the characterized in that for causing the computer to execute the.

  Further, in the present invention, the second step includes a sub-step in which the operation mode is defined by dividing it into at least two, and transition between the modes is permitted according to the frequency of the unauthorized access detection. Features.

According to the present invention, a concept of “security level” such as a protection mode, an operation mode, and an audit mode is given to an operating OS, and access control information and unauthorized access definition information of these security levels are respectively defined and unauthorized access is performed. Each time unauthorized access is detected based on the definition information, the security level is updated, the access control information is controlled accordingly, and the access authority is reduced, thereby enhancing the OS security.
In addition, each of access control information and unauthorized access definition information is read at system startup, and is managed in the OS according to the security level, and a series of control is performed inside the OS, so that it is safe without external interference. Both a state where the access control information can be changed and a state where any interference with the access control information can be eliminated can be achieved at the same time. Furthermore, it is desirable from the viewpoint of fail-safe that control of the security level is always increased (stricter) from the viewpoint of fail-safe, but when it is determined that the risk of unauthorized access is low based on a predetermined safety judgment By performing control to lower the security level, flexible security control becomes possible.

FIG. 1 is a block diagram showing an internal configuration of an access control apparatus according to the present invention. Here, the access control apparatus includes an access control information DB (Database) 1, an unauthorized access definition information DB 2, an unauthorized access detection unit 3, a state transition control unit 4, and an access control unit 5.
Here, "access control information" refers to usage requests (read / write / delete / create new / addition) to system resources (files, directories, processes, networks, devices, memory, etc.) issued by users including administrators. (Execution, name change, etc.) is defined as whether access is permitted, and “unauthorized access definition information” refers to definition information of access to be prohibited, access control information DB1, unauthorized access definition, respectively. It is stored in the information DB2. FIG. 2 shows the data structure.

As shown in FIG. 2, access control information is defined by three sets of subjects, objects, and methods that permit access, and unauthorized access definition information is detected as unauthorized access in unauthorized access. Are defined by three sets of subjects, objects, and methods. Here, “subject” is a label given to a process as a subject of access, and “object” refers to an object on the side of access, such as a file, directory, device, process, etc. The label given to the system resource, “method”, refers to an access type such as read / write / execute.
Here, access control information that allows access to the / home / user directory by the user, access to the / home / user directory by the user, and write, append, and unlink by the user to the / etc / passwd file are permitted. Each of the unauthorized access definition information that treats access to the / sbin / shutdown file by the user as unauthorized access, which handles such accesses as unauthorized access, is illustrated.

Returning to FIG. The unauthorized access detection unit 3 compares the requested access with predetermined predefined unauthorized access definition information (unauthorized access definition information DB2), and determines whether the requested access is unauthorized access. The state transition control unit 4 is notified. The state transition control unit 4 controls the access control unit 5 by permitting a state transition from the audit mode to the protection mode and from the operation mode to the protection mode upon detection of unauthorized access.
The access control unit 5 disallows at least external services provided in the audit mode, disallows access rights by the security administrator in the operation mode, and all permissions that can change the system in the protection mode. The operation of the OS is controlled so as not to be permitted. Here, the operation execution units 51, 52, and 53 are provided for each security level (audit mode, operation mode, and protection mode).
Note that only two operation execution units 52 are provided in the operation mode, but this is an option that permits transition between the modes according to the frequency of unauthorized access detection by the unauthorized access detection unit 3, as will be described later. It is for having. This can give flexibility to the security level. The state transition control unit 4 controls the transition by detecting unauthorized access by the unauthorized access detection unit 3 except for transition from the audit mode to the operation mode. Furthermore, as described above, the unauthorized access definition information includes three sets of subjects, objects, and methods for each of the above modes.

According to the present invention, it is possible to protect access control information itself from external access from the following viewpoints. However, it is assumed that the OS kernel used here is a security kernel capable of dividing the above-mentioned forced access control (forcing access rights) and administrator rights. A kernel state in which the access control information can be manipulated (hereinafter referred to as an audit mode) and a kernel state in which the access control information cannot be manipulated (hereinafter referred to as an operation mode or a protection mode) are clearly distinguished. Further, the protection mode as the security level is defined as a state in which restrictions are further imposed on the permissions in the operation mode.
First, the kernel (unauthorized access detection unit 3) compares the requested access with predetermined unauthorized access definition information and determines whether or not the requested access is an unauthorized access. Unauthorized access detection may be targeted for all unpermitted accesses, or may be targeted only for specific (non-permitted) accesses. The state transition control unit 4 permits state transition from the audit mode to the protection mode and from the operation mode to the protection mode in response to detection of unauthorized access by the kernel. In addition, the state transition from the audit mode to the operation mode based on the command instruction of the administrator is permitted, and other state transitions are not permitted.

In the audit mode, the access control unit 5 does not permit an access right necessary for the operation of a service provided to the outside such as a Web (World Wide Web) server, a DNS (Domain Name Sarver), or a mail server. If it is to be safe, no permission for remote access is allowed. On the other hand, an access right such as writing to the access control information is granted to the security administrator.
On the contrary, the access control unit 5 permits the access right such as writing to the access control information by the security administrator in the operation mode. For the sake of completeness, any authority of the security administrator is not permitted. On the other hand, it is assumed that the access right necessary and sufficient for normal operation is given to the service provided for the outside. The protection mode is defined as a state in which the access right in the operation mode is further restricted, and permission to make changes to the system, such as writing, deletion, new generation, etc., related to the service provided for the outside is not permitted. The purpose is to limit the damage caused by unauthorized access by restricting permissions. The authority of each administrator is also restricted.

  Regarding the authority of the system administrator (root), access such as writing to the access control information is permitted only to the security administrator under the condition that the administrator authority is divided, and the authority is given to the system administrator. Make it not exist. In addition, the transition of the kernel state is not based on an instruction by an external command other than the transition from the audit mode to the operation mode, but based on control inside the kernel based on detection of unauthorized access. This is intended to prevent direct external interference to the kernel state.

FIG. 3 is an operation concept diagram quoted for explaining the basic operation of the access control apparatus described above. Here, the access control apparatus of the present invention is shown mapped on the OS. The operation will be described below with reference to FIG.
The subject (accessing side) and the object (accessed side) have the correspondence shown in the figure. Here, based on the command execution by the user, the processing is entrusted to the kernel by the system call “rmdir ()”. When the behavior is shown. In the present invention, in order to perform different access control in each of the audit mode, the operation mode, and the protection mode, the following expansion is performed on the kernel and the access control information.

That is, the access control information is defined for each of the audit mode, the operation mode, and the protection mode prepared according to the security level, and the contents are stored in the access information DB 1 (access control information a). In the permission check described later, access control is performed using corresponding access control information based on the current security level of the kernel. In addition, the unauthorized access definition information defines an access to be detected as an unauthorized access in each of the audit mode, the operation mode, and the protection mode, and stores it in the unauthorized access definition information DB2. The unauthorized access definition information may be defined as a complementary set of access control information, or only unauthorized access requiring special attention may be defined (unauthorized access definition information b).
Then, it is assumed that the administrator issues a directory deletion request “foo” via the application (shell) (command execution c). This request is entrusted to the kernel by the system call “rmdir ()” (system call d). In the kernel, the corresponding system call processing function is called and access control is started (access control e). Subsequently, a permission check is performed using the access control information in the operation mode (permission check f), and a process according to the determination result is executed (process g according to the determination result).
The unauthorized access detection unit 3 determines whether or not this is the case based on the unauthorized access definition information stored in the unauthorized access definition information DB 2 regarding the access that is not permitted by the permission check in the kernel. Tell the control unit 4. The state transition control unit 4 receives a notification of unauthorized access detection from the unauthorized access detection unit 3, performs state transition from the current mode to the protection mode (transition from the current mode to the protection mode h), and is performed by the access control unit 5. The above access is executed.

4 and 5 are operation conceptual diagrams cited for explaining the operation of a specific embodiment of the present invention. Here, a description will be given assuming that access to the / sbin / shot file by the user is registered in the unauthorized access definition information DB 2 as unauthorized access.
When the kernel is started, it starts up in operational mode by default. (Security state is initialized in operational mode). In the operation mode, as described above, all accesses to / sbin / shot by the user are defined as unauthorized access. First, the general user user executes the permitted access “rmdir foo” via the shell (FIG. 4, command execution a). As a result, the system call “rmdir ()” is issued to the kernel (system call b). In the kernel, the corresponding system call processing function is called. Subsequently, a permission check is performed using the access control information in the operation mode (permission check d). The processing flow of the permission function is shown in FIG. Since access is permitted here, processing is executed (if access control c and access permission, processing execution e and FIGS. 7, S71, and S72).

Next, it is assumed that a malicious user acquires the authority of the user by some means (password crack, buffer overflow, etc.). The intention of the malicious user is to stop the system by executing the “/ sbin / shotdown” command (FIG. 5, command execution f).
In this case as well, a system call “exec (sbin / shot)” is issued to the kernel (system call g), and the corresponding system processing function is called (access control h). This is not permitted in the permission based on the access control information in the operation mode, and the command is not executed (permission check i and FIG. 7, S73). In addition, the unauthorized access detection unit 3 performs unauthorized access detection based on the unauthorized access definition information in the operation mode (unauthorized access detection j and FIG. 7, S74), and corresponds to the detection target, so the state control function is called. Then, the state transition control unit 4 performs state transition from the operation mode to the protection mode (transition from the current mode to the protection mode k, and FIG. 7, S75). Thereafter, the access control information and the unauthorized access definition information are in the protection mode, and the operation according to the transition mode by the access control unit 5 is executed.

FIG. 9 shows the state transition. As shown in FIG. 9, the protection mode (53) indicates a kernel state in which the access right is restricted, and any authority of the security administrator is not permitted. Also, only limited access such as read-only is permitted for externally provided services. Then, when an unauthorized access is detected, a transition from the operation mode (52) and the audit mode (51) is possible, and a transition to another is prohibited.
The operation mode (52) indicates a kernel state in which the access control information cannot be manipulated, and the kernel is selected and activated as a default. All security administrator rights are disapproved if it is used. In addition, with respect to externally provided services, necessary and sufficient access rights are given for normal operation. Then, triggered by unauthorized access detection, a transition from the audit mode (51) is possible, and a transition to another is prohibited. Further, the audit mode (51) indicates a kernel state in which the access control information can be manipulated, and an access right such as writing to the access control information is recognized by the security administrator. Disallow permission. The audit mode (51) can be activated by specifying a boot option, a command, or the like.

FIG. 6 is an operation conceptual diagram quoted for explaining the operation of another embodiment of the present invention. Here, in addition to the embodiment shown in FIGS. 4 and 5, the operation mode (52) is divided into a plurality of stages, and a safety judgment is further included to enable transition between operation modes. doing. This is suitable when the process of transitioning to the protection mode by detecting unauthorized access once is considered as an excessive measure. There are four types of access control information and unauthorized access definition information, including operation modes 1 and 2 shown here.
When unauthorized access is detected, the audit mode (51) and the operation mode 2 (52) shift to the protection mode (53) and the operation mode 1 (52) starts the operation as shown in the state transition diagram of FIG. Transition to mode 2 (52). The operation mode 2 (52) imposes restrictions on the access right of the operation mode 1 (52), and is not as severe as the protection mode (53). In the operation mode 2 (52), the safety judgment is applied, and when it is determined to be in a safe state, for example, there is no sign of unauthorized access for a certain period of time, the operation mode 2 (52) to the operation mode 1 (52 ), And control to relax the access right. Other transitions are prohibited as in the embodiment shown in FIGS.

  In addition, “safety judgment” is a judgment standard that no sign of unauthorized access is seen. For example, the sign of unauthorized access prescribed in “illegal access definition information” was not seen for a certain period of time. This means that the security is determined based on the determination criteria, and in this case, the unauthorized access is not detected for a certain period of time (for example, when 24 hours or more have passed since the previous unauthorized access detection), the service operating status, the access frequency ( If the number of users in use becomes 0), it is determined to be safe.

FIG. 8 is a flowchart showing the processing flow of the permission function in the embodiment shown in FIG.
In FIG. 8, as a result of the permission check (S81), it is checked whether or not the current mode is operating in the operation mode 2 (52) when access is permitted (S83). Here, in the case of the operation mode 2, the above-described safety is further determined (S84), and when it is determined to be safe, the mode transition control unit 4 makes a state transition to the operation mode 1 (52), and the access control is performed. The unit 5 starts execution in that mode.
On the other hand, as a result of the permission check (S81), when access is not permitted (S86), the unauthorized access detection unit 3 checks for unauthorized access (S87), and when unauthorized access is detected here, It is checked whether or not the current mode is operating in the operation mode 1 (52) (S88). When operating in the operation mode 1 (52), the state transition control unit 4 makes a state transition to the operation mode 2 (52). When operating in a mode other than the operation mode 1 (52), the protection mode ( A state transition is made to 51). Then, the access control unit 5 starts execution according to the mode.

As described above, the present invention updates the security level every time an unauthorized access is detected based on the unauthorized access definition information, and controls the access control information accordingly to reduce the access authority as described above. Security of the network and avoiding external interference with access control information. Further, flexible security control is performed by performing control to lower the security level when it is determined that the risk of unauthorized access is low based on a predetermined safety determination.
The procedure executed by each of the unauthorized access detection unit 3, the state transition control unit 4 and the access control unit 5 shown in FIG. 1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded. The access control apparatus of the present invention can also be realized by reading it into a computer system and executing it. The computer system here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within the scope not departing from the gist of the present invention.

It is a block diagram which shows the internal structure of the access control apparatus in this invention. It is a figure which shows an example of the data structure of the database shown in FIG. It is the operation | movement conceptual diagram quoted in order to demonstrate the basic operation | movement of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate operation | movement of one Embodiment of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate operation | movement of one Embodiment of this invention. It is the operation | movement conceptual diagram quoted in order to demonstrate operation | movement of other embodiment in this invention. It is a figure which shows the flow of a permission function process in embodiment shown in FIG. 4, FIG. It is a figure which shows the flow of a permission function process in embodiment shown in FIG. It is a figure which shows an example of the state transition obtained by embodiment shown in FIG. 4, FIG. It is a figure which shows an example of the state transition obtained by embodiment shown in FIG. It is the operation | movement conceptual diagram quoted in order to demonstrate operation | movement of the conventional access control apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Access control information DB (Database), 2 ... Unauthorized access definition information DB, 3 ... Unauthorized access detection part, 4 ... State transition control part, 5 ... Access control part

Claims (6)

An access control apparatus for controlling an access request issued from a user to each resource of a computer system including a network,
Comparing the requested access with predetermined unauthorized access definition information defined in advance, and determining whether or not the requested access is an unauthorized access;
Triggered by the detection of unauthorized access, a state transition control unit that permits state transition from the audit mode to the protection mode, and from the operation mode to the protection mode,
In the audit mode, at least the service provided to the outside is disallowed, in the operation mode, the access right by the security administrator is disallowed, and in the protection mode, all permissions that can change the system are disallowed. An access control unit,
An access control device comprising: The state transition control unit
The access control apparatus according to claim 1, wherein the transition is controlled by detecting unauthorized access by the unauthorized access detection unit, except for transition from the audit mode to the operation mode. The access control according to claim 1 or 2, wherein the unauthorized access definition information includes a set of an access side and an access unit for each of the modes, and is stored in a storage device. apparatus. 2. The access control apparatus according to claim 1, wherein the operation mode is defined by being divided into at least two, and transition between the modes is permitted according to the frequency of unauthorized access detection by the unauthorized access detection unit. . A program used in an access control device for controlling an access request issued from a user to each resource of a computer system including a network,
A first step of comparing the requested access with predetermined unauthorized access definition information defined in advance to determine whether the requested access is an unauthorized access;
A second step of allowing state transition from the audit mode to the protection mode and from the operation mode to the protection mode, triggered by the detection of the unauthorized access;
In the audit mode, at least the service provided to the outside is disallowed, in the operation mode, the access right by the security administrator is disallowed, and in the protection mode, all permissions that can change the system are disallowed. A third step,
Is an access control program for causing the computer to execute. 6. The second step includes a sub-step in which the operation mode is defined by dividing into at least two, and transition between the modes is permitted according to the frequency of the unauthorized access detection. The access control program described in 1.

Images