KR100577344B1 - Method and system for establishing access control - Google Patents

Abstract

The present invention relates to a system and method for setting an access control policy, and more particularly, to allow or block unauthorized actions and file I / Os automatically according to a control mode to more easily establish an access control policy. The present invention relates to an access control policy setting system and a method thereof.

To this end, the configuration for achieving the access control policy setting system of the present invention, in the system for establishing an access control policy, monitoring the file I / O (Input / Output) through the file system filter driver installed in the system A file system I / O monitoring unit for obtaining a full path of a file, a file access attribute, a user account (SID), and process information from the file I / O; Receive the current control mode from the control mode repository while receiving items such as the full path of the file, the access attributes of the file, the user account (SID), and the process information from the file system I / O monitoring unit; And an access control controller for adding or updating the items to the internal access control policy store or blocking or allowing the items according to the control mode.

In addition, the configuration for achieving the access control policy setting method of the present invention, in the method for establishing an access control policy, monitoring the file I / O (Input / Output) through the file system filter driver installed in the system and A file system I / O monitoring step for obtaining a full path of a file, a file access attribute, a user account (SID), and process information from the file I / O; In the file system I / O monitoring, items such as the full path of the file, the access attribute of the file, the user account (SID), and the process information are received, and the current control mode is obtained from the control mode repository. And an access control control step of adding or updating the items to the internal access control policy repository or blocking or allowing the items according to the control mode.

According to the above configuration, according to the learning mode and the blocking mode of the control mode storage, the allowed and file I / O allowed by the system are stored or allowed, and the unacceptable actions or file I / O by the system are automatically blocked. In addition, it is effective to establish access control policy more easily and easily, and also to effectively prevent hacking and hacker attacks by blocking unacceptable behavior at the source.

Access control, system, file system filter driver, learning mode, blocking mode

Description

System for establishing access control policy and method thereof {Method and system for establishing Access Control}

1 is a schematic diagram showing an operating system of a commonly used Microsoft Windows XP,

2 is a schematic diagram showing an access control policy setting system according to the present invention;

3 is a block diagram showing a method for setting an access control policy according to the present invention;

4 is a flowchart illustrating a file system I / O monitoring step according to the present invention;

5 is a flowchart illustrating an access control control step according to the present invention.

* Description of Major Symbols in Drawings *

S10-File System I / O Monitoring Phase S20-Access Control Control Phase

The present invention relates to a system and method for setting an access control policy, and more particularly, to allow or block unauthorized actions and file I / Os automatically according to a control mode to more easily establish an access control policy. The present invention relates to an access control policy setting system and a method thereof.

In general, the Secure Operating System additionally includes a Security Kernel incorporating security functions into the existing operating system in order to protect the system from various hacking that may occur due to the security flaw inherent in the computer operating system. It is a portable operating system.

As such, a secure operating system with a secure kernel port must have security functional elements such as identification and authentication of computer users, mandatory access control, discretionary access control, reuse prevention, and intrusion detection.

The "openness" of a system in a network environment such as the Internet is an important characteristic, but tools for improving information protection in a computer are very lacking in current systems.

Accordingly, the necessity of a new and safe operating system is emerging in recent years, rather than a temporary method through a patch version or an upgrade that supplements a vulnerability of an existing system.

In addition, access control methodology, which is an important component required for such a safe operating system, forms the core of a safe operating system and many theories have been studied.

Among these access control methodologies, discretionary access control (DAC) and mandatory access control (MAC) rules are applied as a traditional access control policy.

Briefly described below, discretionary access control is a method of controlling access according to the subject's access right to access the object, and compulsory access control compares the label of the subject with the security label of the object that the subject wants to access. It is a method of access control based on access control rules that comply with security policy.

In particular, the security label which is the criterion of the mandatory access control is information indicating the importance of the subject and the object of the access control. In addition, the mandatory access control may provide a high level of security by considering the importance of the object as well as the subject.

Representative theories of such mandatory access control technologies include multi level security ( MLS ) and role based access control (RBAC).

A secure operating system with access control like this can block hacker attacks by blocking actions that are not allowed by policy.

However, the setting of the above access control policy is very difficult, so that even a security officer has difficulty in establishing a proper access control policy. Therefore, the above access control policy is being established by a security operating company or a security consulting company instead.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and has been made to allow an easy access control policy by automatically allowing or blocking unauthorized actions and file I / Os according to a control mode. To provide a control policy setting system and method thereof.

The configuration for achieving the access control policy setting system of the present invention for achieving the above object is, in the system for establishing an access control policy, the file I / O (Input) through a file system filter driver installed in the system File system I / O monitoring unit that monitors and obtains the full path of the file, file access attributes, user account (SID), and process information from the file I / O; Receive the current control mode from the control mode repository while receiving items such as the full path of the file, the access attributes of the file, the user account (SID), and the process information from the file system I / O monitoring unit; And an access control controller for adding or updating the items to the internal access control policy store or blocking or allowing the items according to the control mode.

In addition, the configuration for achieving the access control policy setting method of the present invention, in the method for establishing an access control policy, monitoring the file I / O (Input / Output) through the file system filter driver installed in the system and A file system I / O monitoring step for obtaining a full path of a file, a file access attribute, a user account (SID), and process information from the file I / O; In the file system I / O monitoring, items such as the full path of the file, the access attribute of the file, the user account (SID), and the process information are received, and the current control mode is obtained from the control mode repository. And an access control control step of adding or updating the items to the internal access control policy repository or blocking or allowing the items according to the control mode.

When described in detail with reference to the accompanying drawings a preferred embodiment of the present invention.

First, the background of the present invention will be described briefly. Microsoft's operating system Windows XP includes a user mode in which a general application program is executed, a kernel and a device driver of the operating system. It is divided into Kernel Mode that is executed.

In order to monitor file I / O (Input / Output), the kernel mode is created through a file system filter driver, and a safe operating system is also created through the file system filter driver.

Figure 1 shows the overall structure of the file system of Microsoft's Windows XP as described above. In order to monitor file system I / O in kernel mode, the file system filter driver must be written.

Such a file system filter driver can be attached to the Windows file system itself using the IoAttachDevice () API, the IoAttachDeviceByPointer () API, or the IoAttachDeviceToDeviceStack () API, to be applied as a filter driver, or to the Windows file system. It is based on a well-known method of hooking file I / O by changing the dispatch table in the driver object of the driver.

The file I / O includes file I / O such as IRP_MJ_CREATE for creating or opening a file, IRP_MJ_WRITE for writing a file, and IRP_MJ_READ for reading a file.

2 schematically illustrates an access control policy setting system according to the present invention, and includes a file system I / O monitoring unit and an access control control unit.

First, the file system I / O monitoring unit monitors file I / O (Input / Output) through the file system filter driver installed in the system. When the monitoring result file I / O is IRP_MJ_CREATE, the entire file from the file I / O is monitored. You get the path, file access attributes, user account (SID), and process information.

If the file I / O is not IRP_MJ_CREATE, the corresponding file items are passed.

Subsequently, the access control control unit receives items such as the full path of the file, the file's access attribute, the user account (SID), and the process information from the file system I / O monitoring unit, while the current mode is controlled from the control mode repository. Retrieves the control mode. And, it adds or updates the items to the internal access control policy repository or blocks or allows the items according to the control mode.

Meanwhile, Table 1 below shows an example of a control mode in the control mode store, and it can be seen that the control mode in the control mode store is divided into a learning mode and a blocking mode.

Learning mode Blocking mode Current control mode O

In addition, Table 2 below shows an example of file I / O items stored in an internal access control policy store. The internal access control policy store includes a user account (SID), process information, a file access path, Notice that the access attribute of the file exists.

Subject Object Access Rights User Account (SID) Process information Access file Access properties read writing Execution Administrator System C: \ Windows \ explorer.exe O O Administrator System C: \ Windows \ Notepad.exe O O Administrator Notepad C: \ Log \ Log.txt O O Administrator System C: \ Windwos \ services.exe O O Administrator System C: \ Program Files \ WebServer.exe O O User1 Explorer Notepad.exe O O User1 Notepad C: \ Doc \ Document.txt O O User2 Explorer C: \ Program Files \ IE \ iexplorer.exe O O User2 iexplorer C: \ Windows \ System32 \ msieftp.dll O User2 iexplorer C: \ Windows \ System32 \ msvcr71.dlll O O

Referring to the operation and effect of the present invention configured as described in detail as follows.

As a method for setting an access control policy of the present invention, the file system I / O monitoring step S10 and the access control control step S20 are performed as shown in FIG. 3. File I / O is monitored through the system filter driver, and if the monitoring result is IRP_MJ_CREATE, the file system I / O that obtains the file's full path, file access attributes, user account (SID), and process information from the file I / O. O monitoring step (S10) is executed.

At this time, looking at the method to obtain the full path of the file in the file system I / O monitoring step (S10), IRP (I / O Request Packet) and IoGetCurrentIrpStackLocation () API that is passed to each parameter at the time of file I / O Through this, an IRP Stack of type IO_STACK_LOCATION is obtained, and a FileObject of type FILE_OBJECT is obtained from the IRP Stack. Then, by inputting the FileObject as a parameter of ObQueryNameString (), the full path of the current file can be obtained. Alternatively, the full path of the file to be accessed may be obtained through the FileName.Buffer member of the FileObject.

Here, if FileObject-> RelatedFileObject exists, FileObject-> FileName is a path relative to FileObject-> RelatedFileObject, and FileObject-> RelatedFileObject.FileName.Buffer and FileObject-> FileName.Buffer are combined to obtain the file. You get the full path.

Subsequently, a method of obtaining access attributes of a file is obtained by obtaining a Create.Options field from an IRP stack and examining the contents of the Create.Options field.

In this case, if FILE_READ_DATA is included in the content of the field, the read attribute is accessed. If FILE_WRITE_DATA is included, the write attribute is accessed. If FILE_EXECUTE is included, the access attribute is accessed.

Next, look at how to get the process information such as the process identifier of the current process and the full path of the process at the time of file I / O. First, the process identifier is obtained through an API such as PsGetCurrentProcess () or PsGetCurrentProcessId (). Simply get

And, how to get the full path of the process, the full path of the process is located in the PEB (Process Environment Block), the PEB information of the currently running process is located at 0x7FFDF000 address. After retrieving the PEB in this manner, an ImagePathName of type UNICODE_STRING in ProcessParameters of type RTL_UESR_PROCESS_PARAMETERS in the PEB is retrieved. And the ImagePathName obtained gets the full path of the current process.

Continuing to look at how to get the current user account (SID) for file I / O, we typically use an object called a token to define the security information of the currently running process or thread. At this time, by obtaining the token of the process in the process monitoring unit, it is possible to obtain the ID (SID) of the user currently logged in.

In more detail, the method first obtains information of the SECURITY_SUBJECT_CONTEXT type through the SeCaptureSubjectContext () API, and obtains the token of the current process by calling the SeQuerySubjectContextToken () API with the information. In addition, the SeQueryInformationToken () API is called with the token to obtain a currently logged in user account (SID).

Alternatively, the same effect can be achieved by calling the ZwQueryInformationToken () API that takes the handle of the current process token as an input parameter.

On the other hand, in the file system I / O monitoring step (S10) as described above, after receiving the items such as the full path of the file, the access attribute of the file, the user account (SID), the process information and the current from the control mode storage Retrieves the control mode of. Then, according to the control mode, the access control control step (S20) of adding or updating the items to the internal access control policy store or blocking or allowing the items is performed.

In this case, the control method of each item according to the control mode will be described in more detail with reference to FIG. 5. First, when the control mode is the learning mode, the file obtained in the file system I / O monitoring step (S10) is described. Items such as the full path, file access attributes, user account (SID), and process information are compared with the items previously stored in the internal access control policy store to find out if there are identical items.

If there is no identical item in the internal access control policy store, the items received in the file system I / O monitoring step S10 are added to the internal access control policy store. On the other hand, if there is the same item in the internal access control policy store, the current access property is added to the access property in the same item and updated.

For example, if the access property of the same item found in the internal access control policy store is set to Read and the current access property is Execution, set the Execution Access property to the Read and Execution Access property by adding the Execution Access property to the existing Read Access property. do.

Subsequently, when the control mode is the blocking mode, items such as the full path of the file received in the file system I / O monitoring step (S10), the access attribute of the file, the user account (SID), and the process information are internally stored. It compares with the items stored in the access control policy store and finds out whether they are identical.

Here, when there is no identical item in the internal access control policy store, the items received in the file system I / O monitoring step S10 are blocked.

On the other hand, if there is an identical item in the internal access control policy store, if there is the same access property in comparison with the access property in the same item, the item received in the file system I / O monitoring step (S10) Allow them to listen. If the same access attribute is not present, the items received in the file system I / O monitoring step S10 are blocked.

In this case, referring to the method of blocking the items received in the file system I / O monitoring step (S10), access restriction may be implemented by setting the returned status value to an appropriate status value such as STATUS_ACCESS_DENIED to restrict access. . You can also implement access restrictions by not calling the original function to call, or by modifying the arguments of the function to appropriate values that can restrict access to the function.

As described above, the present invention compares the items such as the process information, the user account (SID), the full path of the file, the access property of the file with those in the internal control policy store according to the learning mode and the blocking mode. Add or update, block or allow the internal control policy repository.

Therefore, the system permits storing and allowing the behaviors and file I / Os allowed in the system, and automatically blocks the behaviors or file I / Os that are not allowed in the system. Without having to go through a complicated process for establishing an access control policy or through an access control policy, an access control policy can be easily and simply set inside the system.

In addition, by blocking the unacceptable behavior as described above, there is also an effect that can effectively prevent hacking and hacker attacks.

Claims (6)

In the system for establishing an access control policy, Monitors file I / O (Input / Output) through the file system filter driver installed in the system, and provides the full path of the file from the file I / O, the access attribute of the file, the user account (SID), and the process information. A file system I / O monitoring unit to obtain a; Receive the current control mode from the control mode repository while receiving items such as the full path of the file, the access attributes of the file, the user account (SID), and the process information from the file system I / O monitoring unit; And an access control control unit for adding or updating the items to an internal access control policy store or blocking or allowing the items according to a control mode. In a method for establishing an access control policy, Monitors file I / O (Input / Output) through the file system filter driver installed in the system, and provides the full path of the file from the file I / O, the access attribute of the file, the user account (SID), and the process information. File system I / O monitoring step (S10) to obtain; In the file system I / O monitoring step (S10), items such as the full path of the file, the access attribute of the file, the user account (SID), and the process information are received, and the current control mode is obtained from the control mode repository. And an access control control step (S20) of adding or updating the items to an internal access control policy store or blocking or allowing the items according to the control mode. 3. The file system I / O monitoring step (S10) is an IRP stack of IO_STACK_LOCATION type through I / O Request Packet (IRP) and IoGetCurrentIrpStackLocation () APIs, which are passed as respective parameters at the time of file I / O. Obtain a FileObject of type FILE_OBJECT from the IRP Stack and input the FileObject as a parameter of ObQueryNameString () to obtain the full path of the current file, or the file's full path through the FileName.Buffer member of the FileObject. And access property of a file to be accessed by obtaining a Create.Options field from the IRP stack and examining the contents of the Create.Options field. The method according to claim 2, wherein the file system I / O monitoring step (S10) obtains a process identifier (Process Identification) through an API such as PsGetCurrentProcess () or PsGetCurrentProcessId () at the time of file I / O, and is currently running PEB. After obtaining the, obtain the ImagePathName of the UNICODE_STRING type in the ProcessParameters of the RTL_UESR_PROCESS_PARAMETERS type in the PEB, and obtain the full path of the current process through the ImagePathName, thereby obtaining the process information. Obtain the SECURITY_SUBJECT_CONTEXT type information through the SeCaptureSubjectContext () API, call the SeQuerySubjectContextToken () API with the above information to obtain the token of the current process, and call the SeQueryInformationToken () API with the token to present the current user account (SID). Or obtaining the currently logged in user account (SID) through a call to the ZwQueryInformationToken () API using the token handle of the current process as an input parameter. The method of claim 2, wherein when the control mode in the access control control step (S20) is a learning mode Items such as the full path of the file received in the file system I / O monitoring step (S10), the access properties of the file, the user account (SID), and the process information are the same as those previously stored in the internal access control policy store. Compare if there is, If there is no identical item in the internal access control policy store, the items received in the file system I / O monitoring step (S10) are added to the internal access control policy store, And if the same item exists in the internal access control policy store, updating and adding the current access property to the access property in the same item. The method of claim 2, wherein when the control mode in the access control control step (S20) is a blocking mode Items such as the full path of the file received in the file system I / O monitoring step (S10), the access attributes of the file, the user account (SID), and the process information are stored in the internal access control policy store. Compares for equal items, When there is no identical item in the internal access control policy store, the items received in the file system I / O monitoring step (S10) are blocked, If there is an identical item in the internal access control policy store, compares whether there is a current access property in the access property in the same item, and if the same access property exists, allowing the items received in the file system I / O monitoring step (S10). and, If the same access attribute does not exist, the access control policy setting method characterized in that for blocking the items received in the file system I / O monitoring step (S10).

Images