WO2018049977A1

WO2018049977A1 - Method and device for guaranteeing system security

Info

Publication number: WO2018049977A1
Application number: PCT/CN2017/099338
Authority: WO
Inventors: 费立华
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-14
Filing date: 2017-08-28
Publication date: 2018-03-22
Also published as: CN107818260A; CN107818260B

Abstract

Provided are a method and device for guaranteeing system security. The method comprises: providing a dynamically-loadable kernel module (LKM) in a Linux system of an EPG device; loading a pre-set security configuration file in the LKM; and when executing a file operation, firstly detecting whether a current file operation is legitimate according to the security configuration file, and where it is determined that the file operation is legitimate, executing the current file operation, and where it is determined that the file operation is illegitimate, refusing to execute the file operation. The method and device solves the problem in the relevant art that a security level of an EPG device is low, thereby greatly improving the security of an EPG device.

Description

Method and device for securing system

Technical field

The present application relates to the field of communications, for example, to a method and apparatus for securing a system.

Background technique

Internet Protocol TV or Interactive Personal TV (IPTV) is a display terminal for televisions, computers and mobile devices. It connects set-top boxes, computers or mobile devices to the Internet through the Internet, especially Broadband network provides various real-time and non-real-time multimedia services to TV, PC, mobile terminals and other users.

Some core devices in the IPTV system are deployed in the firewall, but the Electronic Program Guide (EPG) device that provides services for users must be deployed outside the firewall, often attacked by hackers, causing the program to be tampered with. Or it is deleted, which directly causes the IPTV service to be abnormal and cannot provide services for users.

The hardening strategy in the related technologies is based on the security hardening of the Linux device. That is, the security of the Linux device is hardened, so that the hacker cannot crack the login mode of the Linux device and cannot log in. However, the related security hardening still has risks. Once the login method is not updated for a long time, it is artificially leaked or hacked. Once the hacker can log in to the EPG device, the program can be arbitrarily tampering and deleted.

In view of the low security level of EPG equipment in related technologies, there is currently no effective solution.

Summary of the invention

The embodiments of the present disclosure provide a method and apparatus for securing a system to at least solve the problem that the EPG device has a low security level in the related art.

According to an embodiment of the present disclosure, a method for securing a system is provided, including:

Loading the security profile into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security profile includes legality for file operations 170575

Rules of inspection;

Performing a legality check on the detected file operation according to the security configuration file, and performing the file operation when determining that the file operation is a legal operation.

Optionally, the security configuration file includes a file access path, and the legality check of the detected file operation according to the security configuration file includes:

Determining whether the file corresponding to the file operation is located in the file access path, wherein, if the file is not located in the file access path, determining that the file operation is a legal operation.

Optionally, the security configuration file further includes a specified file in the file access path, and performs legality check on the detected file operation according to the security configuration file, including:

Determining whether the file corresponding to the file operation is the specified file, wherein if the file does not belong to the specified file, determining that the file operation is a legal operation.

Optionally, the security configuration file further includes a specified operation process corresponding to the specified file, and determining whether the file corresponding to the file operation is the specified file includes:

Determining whether the first operation process corresponding to the file operation is the specified operation process, where the first operation process is the specified operation process, determining that the first operation process is Specifies that the file operation performed by the file is a legal operation.

Optionally, after performing the legality check on the detected file operation according to the security configuration file, the method further includes:

In the case where it is determined that the file operation is an illegal operation, an alarm is triggered.

Optionally, if the security profile has update information, the update information is loaded into the LKM to form updated security configuration information;

Performing a legality check on the detected file operation according to the updated security configuration file.

According to another embodiment of the present disclosure, an apparatus for securing a system is further provided, including:

a loading module configured to load a security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is disposed in a Linux system, wherein the security configuration file includes a legality check for file operations Rule

The checking module is configured to perform a legality check on the detected file operation according to the security configuration file, and perform the file operation when determining that the file operation is a legal operation.

Optionally, in a case that the security configuration file includes a file access path, the checking module is further configured to determine whether a file corresponding to the file operation is located in the file access path, where If the file is not located in the file access path, it is determined that the file operation is a legal operation.

Optionally, in a case that the security profile further includes a specified file in the file access path, the checking module is further configured to determine whether the file corresponding to the file operation is the specified file, where And if the file does not belong to the specified file, determining that the file operation is a legal operation.

Optionally, in the case that the security configuration file further includes a specified operation process corresponding to the specified file, the checking module is further configured to determine whether the first operation process corresponding to the file operation is the Specifying an operation process, wherein, in a case where the first operation process is the specified operation process, determining that a file operation performed on the specified file by the first operation process is a legal operation.

Optionally, the checking module is configured to trigger an alarm after determining that the file operation is an illegal operation after performing the legality check on the detected file operation according to the security configuration file.

Optionally, if the security profile has update information, the update information is loaded into the LKM to form updated security configuration information; and the detected security profile is detected according to the updated File operations are checked for legality.

According to still another embodiment of the present disclosure, a storage medium is also provided. The storage medium is arranged to store program code for performing the following steps:

Loading the security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security configuration file includes rules for checking the legality of the file operation;

Typically, the program code is embodied as computer executable instructions, and the computer executable instructions are Set to perform the above method.

Optionally, the device further includes: a monitoring module configured to monitor the loading module or the checking module, and restart the loading module if an abnormality occurs in the loading module or the checking module Or the inspection module.

An embodiment of the present disclosure further provides an electronic device, including:

At least one processor;

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the method described above.

Through the disclosure, a dynamically loadable kernel module LKM is set in the Linux system of the EPG device, and the pre-configured security configuration file is loaded into the LKM. When the file operation is performed, the file is first detected according to the security configuration file. Whether the operation is legal. If it is determined that the file operation is legal, the file operation is performed. Otherwise, the above file operation is refused. The problem of low security level of the EPG device in the related technology is solved, and the security of the EPG device is greatly improved.

BRIEF abstract

The drawings described herein are intended to provide an understanding of the present disclosure, and are intended to be a part of the present disclosure. In the drawing:

1 is a flow chart of a method for securing a system in accordance with an embodiment of the present disclosure;

2 is a schematic diagram of an LKM in accordance with an embodiment of the present disclosure;

3 is a schematic diagram of a file system kernel function rewriting in accordance with an embodiment of the present disclosure;

4 is a schematic flow chart of implementing file tamper prevention according to an embodiment of the present disclosure;

5 is a structural block diagram of an apparatus for securing a system according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.

detailed description

The present disclosure will be described in detail below with reference to the drawings in conjunction with the embodiments. The embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

The terms "first", "second" and the like in the specification and claims of the present disclosure and the above-mentioned figures are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

Example 1

The technical solution of the present application can be run on an EPG device in an IPTV service system, that is, the technical solution in the application file is executed in a Linux system in the EPG device.

FIG. 1 is a flowchart of a method for securing a system according to an embodiment of the present disclosure. As shown in FIG. 1 , the process includes:

Step S102, loading the security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security configuration file includes a rule for checking the legality of the file operation;

Step S104: Perform a legality check on the detected file operation according to the security configuration file, and perform the file operation when determining that the file operation is a legal operation.

The file operations described in the above steps include modifying files, deleting files, moving files, and the like.

Optionally, the security configuration file includes a file access path, and determines whether the file corresponding to the file operation is located in the file access path, wherein, if the file is not located in the file access path, determining that the file operation is Legal operation.

In an optional embodiment, the file access path included in the security configuration file may also be a path that can perform file operations, and other file paths except these paths are not accessible. In fact, this is in addition to the above optional embodiment. There is essentially no difference in the technical solution.

Optionally, the security configuration file further includes a specified file in the file access path, and determines whether the file corresponding to the file operation is the specified file, where the file is determined if the file does not belong to the specified file. The operation is a legal operation. The specified file in the optional embodiment may also be a specified file type, that is, the specified file type in the access path is within the protection scope, and may not be modified by random operations.

Optionally, the security configuration file further includes a specified operation process corresponding to the specified file, and determines whether the first operation process corresponding to the file operation is the specified operation process, where the first operation process is the specified operation In the case of a process, it is determined that the file operation performed on the specified file by the first operation process is a legal operation. For example, a file in a location on the C drive can be copied and cannot be deleted.

For the technical solutions in the above three alternative embodiments, the details of the three legality detections are respectively listed.

Optionally, after performing the legality check on the detected file operation according to the security configuration file, if it is determined that the file operation is illegal, the alarm is triggered, and the related alarm log is generated for reference by the user, and the monitoring process is further increased. Monitor whether the above method steps are performed normally and find that the abnormal restart.

Optionally, if the security profile has update information, the update information is loaded into the LKM to form updated security configuration information.

The legality check of the detected file operation is performed according to the updated security configuration file.

The details are described below in conjunction with the embodiments of the present disclosure.

The embodiment of the present disclosure provides a security hardening method for prohibiting malicious tampering. According to the service implementation provided by the EPG device in the IPTV service system, only the specified process is allowed to operate the specified file type or specified file in the specified directory, that is, as long as the EPG device The security hardening program is deployed. Even if the user logs in to the system as the root user, data and file modifications cannot be performed.

The following technical solutions are adopted in the embodiment of the present disclosure, and an event triggering technology is used to implement a Linux dynamically loadable kernel module LKM (Loadable Kernel Modules): rewriting the kernel function of the file system, when modifying the operation of the file system, first Check the legality, alarm and reject the illegal operation, and continue the original file operation for the legal operation to implement the program tamper-proof.

The core technology of this application file is to implement a Linux dynamically loadable kernel module LKM (Loadable Kernel Modules): rewrite the kernel function of the file system. When the user modifies the operation of the file system, the kernel function of the rewriting file system performs the legality check according to the loaded security configuration file rule, and the rule is considered to be a legal file operation, and the original file operation is continued for the legal operation; If the rule is not satisfied, it is considered to be an illegal file operation, and interception and alarm are given.

The following are embodiments in the embodiments of the present disclosure.

First, the Linux file system call process is introduced. The Linux file system call process is divided into two parts: user space processing and kernel space processing.

The user space processing part is the process of system call switching from user mode to kernel mode. When the system call occurs, the library function enters the 0x80 interrupt after saving the system call number and corresponding parameters. At this point, the processing of the system call in user space is complete.

The kernel space processing part is the whole process of system calls handled in the Linux kernel. After the ox80 interrupt handler takes over, it first checks its system call number, then looks up the system call table according to the system call number, and gets the kernel function that handles the system call from the system call table, then passes the parameters and runs the function. At this point the kernel really started processing the system call.

Secondly, the Linux kernel module LKM (Loadable Kernel Modules) can be used to implement the security configuration file. 2 is a schematic diagram of an LKM in accordance with an embodiment of the present disclosure. The security configuration file is a criterion for the LKM kernel module to implement file operation security. LKM determines whether the file is allowed to operate according to the configuration in the security configuration file.

The security profile can contain the following components:

1. The specified full path of program protection.

2. The specified file or specified file type in the specified path included in the program supports wildcards, multiple files or file types are available, and split. Such as: *.jsp, *.jpg.

3. The name of the process that allows file operations. Multiple processes can be configured, used, and split. Such as /bin/cp, /usr/bin/vi.

The contents of 1, 2, and 3 can be used: splitting. For example, the configuration in the security profile:

/home/test:*.jsp,*.jpg:/bin/cp, /usr/bin/vi

According to the above settings, it can be concluded that the file ending with jsp and jpg in the /home/test directory only allows /bin/cp, /usr/bin/vi process operation, and other processes cannot operate.

Introducing the dynamically loadable kernel module LKM, LKM can be understood as a custom implementation. Any file operation enters the kernel mode and calls the 0x80 interrupt operation. It will enter the custom program entry in LKM. The custom program will determine whether to allow file operations. If it is not allowed, it will be rejected.

The following focuses on the core technology of the disclosure, namely Linux dynamically loadable kernel module LKM The implementation of rewriting the kernel function of the file system and the deployment and validation of the security configuration file.

3 is a schematic diagram of a file system kernel function rewriting according to an embodiment of the present disclosure, as shown in FIG. 3, including the following steps:

Step one, the user mode has a file operation, enters the kernel state ox80 interrupt call operation, and enters the custom program LKM.

Step 2: LKM first determines whether the security configuration content in the LKM memory is empty. If it is empty, the above file operation is allowed, and no restrictions are imposed.

Step 3: If it is not empty, and then judge whether the file to be operated is in the security configuration, determine that the logic in the security configuration needs to include the following:

1) Under the specified directory of the security configuration;

2) is the specified file type or specified file of the security configuration;

Step 4: If the file of the operation is not set in the security configuration, the operation is allowed without any restriction processing.

Step 5: If the file of the operation is set in the security configuration, the process name of the file operation is obtained.

Step 6. According to the rules set in the security configuration, determine whether the process is allowed to do this operation on the file. If it is allowed, continue the file operation without any restrictions.

Step 7: If the operation is not allowed, an alarm is generated and an alarm log is generated.

FIG. 4 is a schematic diagram of a process for implementing file tampering according to an embodiment of the present disclosure. As shown in FIG. 4, after the operating system is deployed, the LKM is effective for the security configuration file, and the implementation process of implementing the file tamper-proof is as follows:

The tamper-proof program can deploy two processes and one alarm module on the device. The two processes can be defined as the tamper-proof monitoring process and the tamper-resistant security operation process. The process is as follows:

Step 1. The anti-tampering program starts two processes, one is a monitoring process, one is used for a security operation process, and the monitoring process monitors a security process. If the security process is suspended or killed, the monitoring starts the security process.

Step 2: LKM finds that the file operation is not allowed. When an alarm is to be sent, the message is sent to the security operation process, and the process is sent to the alarm module.

Step 3: The security operation process can monitor the security configuration file in real time. If the security configuration file is found to be modified, the security configuration file is considered to be updated.

In step 4, the security operation process can also periodically read the updated security configuration file content and send the updated content to the LKM.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a general hardware platform, and of course, can also be implemented by hardware. Based on such understanding, the technical solution of the present disclosure, which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.

Example 2

In the embodiment, a device for securing the system is provided, and the device is configured to implement the foregoing embodiments and implementation manners, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the devices described in the following embodiments are implemented in software, hardware, or a combination of software and hardware, is also possible and conceivable.

FIG. 5 is a structural block diagram of an apparatus for securing a system according to an embodiment of the present disclosure. As shown in FIG. 5, the apparatus includes:

The loading module 52 is configured to load the security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security configuration file includes rules for checking the legality of the file operation. ;

The checking module 54, connected to the loading module 52, is configured to perform a legality check on the detected file operation according to the security configuration file, and perform the file operation when it is determined that the file operation is a legal operation.

Optionally, in a case that the security configuration file includes a file access path, the checking module 54 is further configured to determine whether the file corresponding to the file operation is located in the file access path, where the file is not located in the file. In the case of an access path, it is determined that the file operation is a legitimate operation.

Optionally, in the case that the security profile further includes a specified file under the file access path, The checking module 54 is further configured to determine whether the file corresponding to the file operation is the specified file, wherein if the file does not belong to the specified file, it is determined that the file operation is a legal operation.

Optionally, in the case that the security operation file further includes a specified operation process corresponding to the specified file, the checking module 54 is further configured to determine whether the first operation process corresponding to the file operation is the specified operation process, Wherein, in the case that the first operation process is the specified operation process, it is determined that the file operation performed on the specified file by the first operation process is a legal operation.

Optionally, the checking module 54 is configured to trigger an alarm after determining that the file operation is an illegal operation after performing the legality check on the detected file operation according to the security configuration file.

Optionally, if the security profile has update information, the update information is loaded into the LKM to form updated security configuration information; and the detected file operation is legal according to the updated security profile. Sex check.

Optionally, the device further includes: a monitoring module configured to monitor the loading module or the checking module, and restart the loading module or the checking module if the loading module or the checking module is abnormal. The monitoring module monitors the running state of the loading module or the checking module, that is, the two modules can normally perform the functional steps described in the foregoing embodiments.

The above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the above modules are all located in the same processor; or, the above modules are respectively located in different combinations. In the processor.

Example 3

Embodiments of the present disclosure also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1, loading the security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security configuration file includes a rule for checking the legality of the file operation;

S2: Perform a legality check on the detected file operation according to the security configuration file, and perform the file operation when determining that the file operation is a legal operation.

Optionally, the storage medium is a computer readable storage medium storing computer executable instructions arranged to perform the method of any of the above embodiments.

The computer readable storage medium may be a transitory computer readable storage medium or a non-transitory computer readable storage medium.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

Optionally, in this embodiment, the processor performs the method steps in the foregoing optional embodiment according to the stored program code in the storage medium.

For example, the examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

The embodiment of the present disclosure further provides a schematic structural diagram of an electronic device. Referring to FIG. 6, the electronic device includes:

At least one processor 60, which is exemplified by a processor 60 in FIG. 6; and a memory 61, may further include a communication interface 62 and a bus 63. The processor 60, the communication interface 62, and the memory 61 can complete communication with each other through the bus 63. Communication interface 62 can be used for information transfer. Processor 60 may invoke logic instructions in memory 61 to perform the methods of the above-described embodiments.

Furthermore, the logic instructions in the memory 61 described above may be implemented in the form of a software functional unit and sold or used as a stand-alone product, and may be stored in a computer readable storage medium.

The memory 61 is used as a computer readable storage medium for storing software programs, computer executable programs, and program instructions/modules corresponding to the methods in the embodiments of the present disclosure. The processor 60 executes the function application and the data processing by running the software program, the instruction and the module stored in the memory 61, that is, the method for securing the system in the above method embodiment.

The memory 61 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may be stored according to the use of the terminal device The data created, etc. Further, the memory 61 may include a high speed random access memory, and may also include a nonvolatile memory.

The technical solution of the embodiments of the present disclosure may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, or a network) The device or the like) performs all or part of the steps of the method described in the embodiments of the present disclosure. The foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like. A medium that can store program code, or a transitory storage medium.

The various modules or steps of the present disclosure described above may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be calculated The program code executable by the apparatus is implemented such that they may be stored in a storage device by the computing device, and in some cases, the steps shown or described may be performed in an order different than that herein, or They are fabricated separately into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. As such, the disclosure is not limited to any specific combination of hardware and software.

The above description is only for the embodiments of the present disclosure, and is not intended to limit the disclosure, and various changes and modifications may be made to the present disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the scope of the present disclosure are intended to be included within the scope of the present disclosure.

Industrial applicability

The method and device for securing the system provided by the present application solve the problem of low security level of the EPG device in the related technology, and greatly improve the security of the EPG device.

Claims

A method of securing a system, including:

Loading the security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is set in the Linux system, wherein the security configuration file includes rules for checking the legality of the file operation;

Performing a legality check on the detected file operation according to the security configuration file, and performing the file operation when determining that the file operation is a legal operation.
The method of claim 1, wherein the security profile includes a file access path; and the legality check of the detected file operation according to the security profile includes:

Determining whether the file corresponding to the file operation is located in the file access path, wherein, if the file is not located in the file access path, determining that the file operation is a legal operation.
The method of claim 2, wherein the security profile further includes a specified file in the file access path, and the legality check of the detected file operation according to the security profile includes:

Determining whether the file corresponding to the file operation is the specified file, wherein if the file does not belong to the specified file, determining that the file operation is a legal operation.
The method of claim 3, wherein the security configuration file further includes a specified operation process corresponding to the specified file, and determining whether the file corresponding to the file operation is the specified file includes:

Determining whether the first operation process corresponding to the file operation is the specified operation process, where the first operation process is the specified operation process, determining that the first operation process is Specifies that the file operation performed by the file is a legal operation.
The method of claim 1, wherein after the legality check of the detected file operation according to the security profile, the method further comprises:

In the case where it is determined that the file operation is an illegal operation, an alarm is triggered.
The method according to claim 1, wherein in the case that the security profile has update information, the update information is loaded into the LKM to form updated security configuration information;

Performing a legality check on the detected file operation according to the updated security configuration file.
A device that secures a system, including:

a loading module configured to load a security configuration file into the dynamically loadable kernel module LKM, wherein the LKM is disposed in a Linux system, wherein the security configuration file includes a legality check for file operations rule;

The checking module is configured to perform a legality check on the detected file operation according to the security configuration file, and perform the file operation when determining that the file operation is a legal operation.
The apparatus according to claim 7, wherein, in a case where the security profile includes a file access path, the checking module is further configured to determine whether a file corresponding to the file operation is located in the file access a path, wherein the file operation is determined to be a legitimate operation if the file is not located in the file access path.
The apparatus according to claim 8, wherein, in a case where the security profile further includes a specified file under the file access path, the checking module is further configured to determine whether the file corresponding to the file operation is For the specified file, wherein the file operation is determined to be a legal operation if the file does not belong to the specified file.
The apparatus according to claim 9, wherein, in the case that the security configuration file further includes a specified operation process corresponding to the specified file, the checking module is further configured to determine the Whether the first operation process corresponding to the file operation is the specified operation process, and if the first operation process is the specified operation process, determining to execute the specified file by the first operation process The file operation is a legal operation.
The apparatus according to claim 7, wherein the checking module is further configured to, after determining the legal operation of the detected file operation according to the security profile, in the case of determining that the file operation is an illegal operation, Trigger an alarm.
The apparatus according to claim 7, wherein, in the case that the security profile has update information, the update information is loaded into the LKM to form updated security configuration information; The security profile checks the legality of the detected file operations.
The apparatus of claim 7 further comprising:

The monitoring module is configured to monitor the loading module or the inspection module, and restart the loading module or the inspection module if an abnormality occurs in the loading module or the inspection module.
A computer readable storage medium storing computer executable instructions arranged to perform the method of any of claims 1-6.