CN104036166A - User privilege escalation method supporting mandatory access control - Google Patents
User privilege escalation method supporting mandatory access control Download PDFInfo
- Publication number
- CN104036166A CN104036166A CN201410257094.0A CN201410257094A CN104036166A CN 104036166 A CN104036166 A CN 104036166A CN 201410257094 A CN201410257094 A CN 201410257094A CN 104036166 A CN104036166 A CN 104036166A
- Authority
- CN
- China
- Prior art keywords
- privileged
- program
- user
- privileged program
- configuration file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a user privilege escalation method supporting mandatory access control. The method comprises the following steps that: (1) privilege programs of an operating system are subjected to mandatory classification in advance and are correlated with different administrator roles; (2) access requests of users are detected, and when a privilege operation request is detected, jumping is carried out to execute the step (3); and (3) a user sending out the privilege operation request is authenticated, if the authentication is passed, a child process is derived, security attributes of the child process are set and are enabled to inherit security attributes of the administrator roles corresponding to the target privilege programs, and the target privilege programs are executed through the child process; and if the authentication is not passed, the privilege operation request of the user is refused, and exiting is carried out. The user privilege escalation method has the advantages that a realization method is simple; the privilege escalation operation of the user can be realized; in addition, the mandatory access control is supported; the safety of the operating system is high; and in addition, the usability is high.
Description
Technical field
The user who the present invention relates to computer operating system promotes authority technical field, relates in particular to a kind ofly to support to force the user of access control to put forward power method.
Background technology
Along with the development of computer technology and network technology, the safety of computer system becomes more and more important, and operating system is as the supvr of computer resource, the basis of whole host computer system safety especially.An effective reliable operating system also should have very strong security and corresponding safeguard measure; can stop or limit the potential safety hazard that skylight, convert channel, Trojan Horse etc. form system; provide enough protections to the information in system, prevent the resource of abuse or the breaking space software of unauthorized user.
It (is Administrator under Windows system that many users like using keeper's account, under the class such as Unix, Linux Unix system, be root) login system, user can obtain the highest weight limit of operating system like this, carries out any operation and can not be subject to Warrant Bounds.But user also can cause a significant threat the security of computer system by using keeper account to offer convenience when, if for example there is the rogue program being hidden in system, in the time of access management person's account login system, infect under virus or unknown situation and carried out rogue program in system, rogue program has also obtained the authority identical with keeper's account so, can manage all resources of operating system, this is very dangerous, even can cause heavy losses to system.
In order to tackle the safety problem becoming increasingly conspicuous, in the time using operating system, suggestion is used regular account login conventionally, in the time that needs are carried out privileged operation, then carrys out complete operation by the method for putting forward power.The so-called power of carrying refers to by certain mode and makes domestic consumer temporarily have the process of the authority of MOS resource.Use said method, even if user has carried out rogue program, the authority that rogue program obtains also only limits to the authority of domestic consumer, cannot carry out privileged program, can not cause great harm to system.
Mainstream operation system all provides corresponding user to put forward the solution of power at present, comprising:
1) UAC (user account control) mechanism that Windows system provides.
UAC starts from Windows Vista the technology of introducing, and this technology is carried out privileged program and be used for strengthening the security of Windows system by limited subscriber, only have the program of users to trust just can obtain administrator right.The mechanism of authorization control based of UAC is provided at present under Windows system, prevent that user from carrying out unwarranted change to computing machine, in the time that carrying out some mounting softwares or the operations such as fire wall are set, user all can trigger UAC, after needing user to complete authentication, carry out the lifting of an authority by UAC, the user who makes login has higher administrator right and carries out these privileged operations carrying Quan Houcai.
2) the su/sudo/polkit mechanism that Unix/Linux system provides.
Unix/Linux system provides the mechanism such as su/sudo/polkit to allow user promote authority.Su and sudo are the order line programs providing under UNIX/Linux system, can make user carry out executive routine with the UID (user ID) or the GID (group ID) that specify by them.Su order completes certification with the user's who is switched to password, and sudo order user's self password authenticates, and has the grace period of general 15 minutes by sudo after authenticating, and during this period of time user carries out sudo order again does not need certification.There is no the shortcoming of graphical interfaces for su/sudo, gksu/gksudo provides graphical interfaces certification; Polkit provides a pkexec order to put forward power, and this order can carry out executive routine with designated user, and it also provides a graphical interfaces to authenticate simultaneously, and what in certification, use is root user's password.
The a certain validated user of operating system can be revised arbitrarily the file access control information that this user has, but operating system cannot be distinguished legal operation that this amendment is user oneself or the illegal operation of rogue program; In addition, do not have yet a kind of effective method can prevent computer virus by information exchange cross share object pass to another process from a process.Therefore, in order addressing the above problem, to make operating system there is higher security, to have introduced mandatory Access Control Mechanism.Having enabled in the system of forcing access control, system is that subject and object all distributes the special security attribute that generally can not change, and system decides a main body whether can access certain object by the security attribute of subject and object relatively.User during for certain object working procedure, can not change its security attribute own and any other object, comprises the one's own object of this user.But force in the system of access control in support, the common power of carrying is only ID and the group ID that has changed user, pressure access control safety attribute corresponding to privilege process acquiescence is what to inherit from parent process, do not make corresponding changes along with putting forward power, therefore propose the prevention that operation after power may still be subject to forcing access control, carry and weighing unsuccessfully thereby cause finally.
In sum, existing carrying in power method do not supported or part support pressure access control, and force in access control system to carry temporary in support, the security attribute of putting forward the process after power does not correctly arrange, cause proposing the prevention that privileged operation after power is still subject to forcing access control system, user cannot carry out privileged operation.
Summary of the invention
The technical problem to be solved in the present invention is just: the technical matters existing for prior art, the invention provides a kind of implementation method simple, can realize user and propose power operation and support to force access control, operating system security is high and availability is strong support to force the user of access control to put forward power method.
For solving the problems of the technologies described above, the technical scheme that the present invention proposes is:
Support to force the user of access control to put forward a power method, concrete implementation step is as follows:
1) force in advance the privileged program classification of operating system and carry out associated from different administrator roles;
2) request of access of detection domestic consumer, in the time privileged operation request being detected, redirect execution step 3);
3) domestic consumer that sends privileged operation request is carried out to authentication, if authentication is passed through, derive from subprocess, the security attribute of described subprocess is set and makes the security attribute of described subprocess inherit the security attribute of the associated administrator role of the target privileged program of privileged operation request, by described subprocess performance objective privileged program; If authentication is not passed through, refuse user's privileged operation request and exit.
As a further improvement on the present invention, the concrete implementation step of described step 1) is as follows:
1.1) force in advance the privileged program of operating system to be classified by function;
1.2) according to the classification of described privileged program, each the class privileged program after sorting out is carried out associatedly with corresponding administrator role respectively, obtain the incidence relation between each privileged program and administrator role;
1.3) incidence relation between described each privileged program and administrator role is as configuration file stores, and provide the privileged program of amendment configuration file for described configuration file, the amendment privileged program of configuration file and the administrator role of appointment are carried out associated, make domestic consumer only carry power to the administrator role of appointment and just there is the access limit to described configuration file.
Administrator role as a further improvement on the present invention: described step 1.1) specifically comprises system manager, safety officer, audit administrator three classes, and described pressure in advance classified the privileged program of operating system specifically to refer to that forcing the privileged program of operating system is to be carried out, carried out, carried out three classes by audit administrator by safety officer by system manager by Function Classification by function.
The administrator role of specifying as a further improvement on the present invention: described step 1.3) specifically refers to safety officer.
Detailed implementation step as a further improvement on the present invention: described step 2) is as follows:
2.1) intercept and capture the request of access of domestic consumer, if receive privileged operation request, redirect execution step 2.2), re-execute step 2.1 otherwise continue to return);
2.2) trigger the client that starts C/S model, described in the client of described C/S model has, store the read-only authority of the configuration file of incidence relation between privileged program and administrator role; Described in reading, the client of described C/S model stores the configuration file of the incidence relation between privileged program and administrator role, the privileged operation request that parsing is received also sends to the service end of C/S model by the user profile of privileged operation request, target privileged program, the administrator role associated with target privileged program by the mode of interprocess communication, by the service end execution step 3 of C/S model).
As a further improvement on the present invention: described step 3) specifically realizes by the service framework program of the service end as C/S model, and the security attribute of described service framework program is forced to control the security attribute, the execution privileged program that derive from subprocess for arranging, carry out interprocess communication realization with the password authentication module of operating system domestic consumer is carried out to authentication, and the client of C/S model is carried out interprocess communication.
Compared with prior art, the present invention has following technique effect:
1) the present invention, by advance by the privileged program classification of operating system and carry out associatedly from different administrator roles, limits the access rights of privileged program, realizes and forces access control, operating system safe; Complete and propose power operation by the reception privileged operation request of domestic consumer and the authentication of domestic consumer, can in the situation that using domestic consumer's login, carry out privileged operation by carrying weighing, improve the ease for use of supporting the operating system of forcing access control; Carrying power rear derivation subprocess and the security attribute of subprocess is being arranged simultaneously, making the security attribute of subprocess inherit the security attribute of the administrator role associated with privileged program, guaranteeing to carry and weigh successfully, completing the execution of privileged program.
2) when the present invention adopts the power of the putting forward mode of C/S model, intercept and capture user's privileged operation request by client, after being resolved by client, information is sent to service end, carried out the setting of security attribute and replaced user to carry out privileged operation by service end, implementation method is simple, it is flexible to put forward power mode.
3) the present invention, by specific safety attribute being set for the privileged program configuration file associated with administrator role, prevents unwarranted rogue program amendment configuration file, ensures security of system; Service framework programming specific safety attribute to service end in C/S model simultaneously all moves privileged program, service framework program in the scope limiting, and has realized principle of least privilege and responsibility separation principle.
Brief description of the drawings
Fig. 1 is that the present embodiment support forces the user of access control to carry the realization flow schematic diagram of power method.
Fig. 2 is privileged program and administrator role incidence relation schematic diagram in the present embodiment.
Fig. 3 is step 2 when C/S model in the present embodiment) concrete implementing procedure schematic diagram.
Embodiment
Below in conjunction with Figure of description, the invention will be further described with concrete preferred embodiment, but protection domain not thereby limiting the invention.
As shown in Figure 1, to force the user of access control to put forward the concrete implementation step of power method as follows in the present embodiment support:
1) force in advance the privileged program classification of operating system and carry out associated from different administrator roles;
2) operation requests of detection domestic consumer, in the time privileged operation request being detected, redirect execution step 3);
3) domestic consumer that sends privileged operation request is carried out to authentication, if authentication is passed through, derive from subprocess, the security attribute of subprocess is set and makes the security attribute of subprocess inherit the security attribute of the associated administrator role of the target privileged program of privileged operation request, by subprocess performance objective privileged program; If authentication is not passed through, refusal user's privileged operation request is also exited.
The present embodiment, by forcing the privileged program to classify and carrying out associatedly from different administrator roles, limits the access rights of privileged program, realizes and forces access control, operating system safe; By receiving the power of the proposing operation of user's privileged operation request and user's authentication completing user, operating system can be carried out privileged operation by putting forward power in the situation that using domestic consumer's login, improves the ease for use of supporting the operating system of forcing access control; Carrying power rear derivation subprocess and the security attribute of subprocess is being arranged simultaneously, making the security attribute of subprocess inherit the security attribute of the administrator role associated with privileged program, guaranteeing the final success of the power of proposing, completing the execution of privileged program.
In the present embodiment, the concrete implementation step of step 1) is as follows:
1.1) force in advance the privileged program of operating system to be classified by function;
1.2) according to the classification of privileged program, each the class privileged program after sorting out is carried out associatedly with corresponding administrator role respectively, obtain the incidence relation between each privileged program and administrator role;
1.3) incidence relation between each privileged program and administrator role is as configuration file stores, and provide the privileged program of amendment configuration file for configuration file, the amendment privileged program of configuration file and the administrator role of appointment are carried out associated, make domestic consumer only carry power to the administrator role of appointment and just there is the access limit to configuration file.
The present embodiment step 1.1) in administrator role specifically comprise system manager, safety officer, audit administrator three classes, force in advance by the privileged program of operating system by function classify specifically refer to force by the privileged program of operating system by Function Classification for by system manager carry out, by safety officer carry out, carry out three classes by audit administrator.The authority of the root that can carry out all privileged programs in existing operating system is assigned to respectively on system manager, safety officer and audit administrator three class administrator roles, and the privilege that each administrator role has is a part of root.
In the present embodiment, according to the function of privileged program, privileged program in operating system is divided into by system manager and carries out, carried out and carried out three classes by audit administrator by safety officer, sorted privileged program carries out associated with corresponding administrator role again, the privileged program of being carried out by system manager and system manager's role association, the privileged program of being carried out by safety officer and safety officer's role association, the privileged program of being carried out by audit administrator and audit administrator Role Management.In system, have multiple privileged programs, each privileged program can only be associated with an administrator role, and an administrator role can associated multiple privileged programs.As shown in Figure 2, taking n privileged program, (n) (administrator role 1～administrator role is n) as example with n administrator role for privileged program 1～privileged program, privileged program 1 is associated with administrator role 2, privileged program 2 is associated with administrator role 1, privileged program 3 is associated with administrator role 3,, privileged program n is associated with administrator role n.It should be noted that, Fig. 2 enumerates the part of the many-to-one incidence relation between privileged program and administrator role, because privileged program and administrator role are to carry out associated in many-to-one mode, therefore the inevitable corresponding administrator role of each privileged program, an administrator role may corresponding multiple privileged programs.
In the present embodiment, the incidence relation of each privileged program and administrator role is stored in the configuration file of system, by the setting to configuration file security attribute, make configuration file be subject to forcing the protection of access control, prevent the amendment of unauthorized program, concrete grammar is: the privileged program that amendment configuration file is provided for configuration file, the privileged program of amendment configuration file is carried out associated with safety officer role, making only to carry power to the administrator role of specifying could conduct interviews and edit configuration file, domestic consumer and other keeper all cannot directly conduct interviews to configuration file and edit.
The present embodiment arranges specific safety attribute by the configuration file of the incidence relation for each privileged program of storage and administrator role, and the privileged program of amendment configuration file is provided, and by associated with safety officer the privileged program of amendment configuration file.Domestic consumer only carries power to the administrator role of specifying and just has the access limit to configuration file, thereby can conduct interviews to configuration file, editor, domestic consumer, the role of system manager and audit administrator all cannot directly conduct interviews, edit or check, prevent domestic consumer, system manager, audit administrator role's amendment, thereby realize, the privileged program of amendment configuration file is carried out associated with safety officer role, configuration file is implemented to protection, domestic consumer can only be carried weigh could modify to configuration file to safety officer role, prevent unwarranted rogue program amendment configuration file, ensure security of system.
In the present embodiment, step 2) detailed implementation step as follows:
2.1) intercept and capture the request of access of domestic consumer, if receive privileged operation request, redirect execution step 2.2), re-execute step 2.1 otherwise continue to return);
2.2) trigger the client that starts C/S model, the client of C/S model has the read-only authority that stores the configuration file of incidence relation between privileged program and administrator role; The client of C/S model reads the configuration file that stores the incidence relation between privileged program and administrator role, resolve privileged operation request and the user profile of privileged operation request, target privileged program, the administrator role associated with target privileged program are sent to the service end of C/S model by the mode of interprocess communication, by the service end execution step 3 of C/S model).
In the present embodiment, step 2), step 3) realizes by C/S model, step 2) realized by the client of C/S model, step 3) is realized by the service end of C/S model, also can adopt in other embodiments alternate manner to realize.In the time that power program is put forward in domestic consumer's execution, the client that just can trigger C/S model reads configuration file, the client of C/S model in system (C/S client) is to be configured to have the read-only authority that stores the configuration file of incidence relation between privileged program and administrator role, therefore can directly read configuration file (read-only); And domestic consumer only carry power to specify administrator role just there is the access limit to configuration file; thereby can conduct interviews to configuration file, edit; by above-mentioned setting; fundamental purpose is to protect configuration file not by unauthorized access and amendment, and the authority that reads of configuration file only has the client (can be transformed into special context when operation) of operation C/S and the program of configuration file amendment (power of putting forward is to safety officer).
In the present embodiment, in the time intercepting the request of access of domestic consumer, trigger client privileged operation request and by client to privileged operation request resolve, the mode that in target privileged program that the user of corresponding initiation privileged operation request, privileged operation request are carried out, configuration file, the information exchange such as administrator role and relevant system environment variable associated to target privileged program crossed interprocess communication sends to the service end of C/S model.
In the present embodiment, step 3) specifically realizes by the service framework program of the service end as C/S model, and the security attribute of service framework program is forced to control the security attribute, the execution privileged program that derive from subprocess for arranging, carry out interprocess communication realization with the password authentication module of operating system domestic consumer is carried out to authentication, and the client of C/S model is carried out interprocess communication.After the information that service framework program sends by the mode of interprocess communication in the client of receiving C/S model, first by the password authentication module of interprocess communication call operation system, the domestic consumer that initiates privileged operation request is carried out to authentication, if authentication is passed through, derive from subprocess and the security attribute of subprocess is set, make the security attribute of subprocess inherit the security attribute of the corresponding administrator role of target privileged program of privileged operation request, then carry out privileged program by the subprocess deriving from; If authentication is not passed through, refuse the privileged operation request of domestic consumer and exit.When the present embodiment adopts the power of the putting forward mode of C/S model, intercept and capture user's privileged operation request by client, after being resolved by client, information is sent to service end, carried out the setting of security attribute and replaced user to carry out privileged operation by service end, implementation method is simple, it is flexible to put forward power mode.The present embodiment is given service framework programming specific safety attribute simultaneously, when the operation of service framework program, the security attribute of its process is also set up specific safety attribute, by forcing access control system to limit the authority of franchise service framework, make its security attribute that derivation subprocess can only be set, carry out the privileged program existing in configuration file, carry out interprocess communication with client, the password authentication module of C/S model, other operation all can be restricted.
Service framework process when the configuration file of the present embodiment by the incidence relation to storage privileged program and administrator role and C/S model arranges specific safety attribute, privileged program, franchise service framework process are all moved in the scope limiting, realized principle of least privilege and responsibility separation principle.
As shown in Figure 3, step 2 under C/S model in the present embodiment) concrete implementing procedure, when domestic consumer sends request franchise services request, intercepted and captured the request of domestic consumer by client, client sends information to the franchise service framework to service end after franchise services request, and wherein information comprises user profile, target privileged program, the administrator role associated with target privileged program; The franchise service framework of service end receives after the information of client, call password authentication module checking and initiate the user's of franchise services request identity, judge whether user is authorized user, if after user successfully authorizes, switch user role, derive from subprocess by franchise service framework and the security attribute of subprocess is set, make the security attribute of subprocess inherit the security attribute of the corresponding administrator role of target privileged program of privileged operation request, then by subprocess performance objective privileged program; If the unsuccessful mandate of user, returns to execution subscriber authentication.
Above-mentioned is preferred embodiment of the present invention, not the present invention is done to any pro forma restriction.Although the present invention discloses as above with preferred embodiment, but not in order to limit the present invention.Any those of ordinary skill in the art, in the situation that not departing from technical solution of the present invention scope, can utilize the technology contents of above-mentioned announcement to make many possible variations and modification to technical solution of the present invention, or be revised as the equivalent embodiment of equivalent variations.Therefore, every content that does not depart from technical solution of the present invention,, all should drop in the scope of technical solution of the present invention protection any simple modification made for any of the above embodiments, equivalent variations and modification according to the technology of the present invention essence.
Claims (6)
1. support to force the user of access control to put forward a power method, it is characterized in that concrete implementation step is as follows:
1) force in advance the privileged program classification of operating system and carry out associated from different administrator roles;
2) request of access of detection domestic consumer, in the time privileged operation request being detected, redirect execution step 3);
3) domestic consumer that sends privileged operation request is carried out to authentication, if authentication is passed through, derive from subprocess, the security attribute of described subprocess is set and makes the security attribute of described subprocess inherit the security attribute of the associated administrator role of the target privileged program of privileged operation request, by described subprocess performance objective privileged program; If authentication is not passed through, refuse user's privileged operation request and exit.
2. support according to claim 1 forces the user of access control to put forward power method, it is characterized in that, the concrete implementation step of described step 1) is as follows:
1.1) force in advance the privileged program of operating system to be classified by function;
1.2) according to the classification of described privileged program, each the class privileged program after sorting out is carried out associatedly with corresponding administrator role respectively, obtain the incidence relation between each privileged program and administrator role;
1.3) incidence relation between described each privileged program and administrator role is as configuration file stores, and provide the privileged program of amendment configuration file for described configuration file, the amendment privileged program of configuration file and the administrator role of appointment are carried out associated, make domestic consumer only carry power to the administrator role of appointment and just there is the access limit to described configuration file.
3. support according to claim 2 forces the user of access control to put forward power method, it is characterized in that, described step 1.1) in administrator role specifically comprise system manager, safety officer, audit administrator three classes, described force in advance by the privileged program of operating system by function classify specifically refer to force by the privileged program of operating system by Function Classification for by system manager carry out, by safety officer carry out, carry out three classes by audit administrator.
4. support according to claim 3 forces the user of access control to put forward power method, it is characterized in that described step 1.3) in the administrator role of specifying specifically refer to safety officer.
5. force the user of access control to put forward power method according to support described in any one in claim 1 ~ 4, it is characterized in that described step 2) detailed implementation step as follows:
2.1) intercept and capture the request of access of domestic consumer, if receive privileged operation request, redirect execution step 2.2), re-execute step 2.1 otherwise continue to return);
2.2) trigger the client that starts C/S model, described in the client of described C/S model has, store the read-only authority of the configuration file of incidence relation between privileged program and administrator role; Described in reading, the client of described C/S model stores the configuration file of incidence relation between privileged program and administrator role, the privileged operation request that parsing is received also sends to the service end of C/S model by the user profile of privileged operation request, target privileged program, the administrator role associated with target privileged program by the mode of interprocess communication, by the service end execution step 3 of C/S model).
6. support according to claim 5 forces the user of access control to put forward power method, it is characterized in that: described step 3) specifically realizes by the service framework program of the service end as C/S model, and the security attribute of described service framework program is forced to control the security attribute, the execution privileged program that derive from subprocess for arranging, carry out interprocess communication realization with the password authentication module of operating system domestic consumer is carried out to authentication, and the client of C/S model is carried out interprocess communication.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410257094.0A CN104036166B (en) | 2014-06-11 | 2014-06-11 | The user of forced symmetric centralization is supported to put forward power method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410257094.0A CN104036166B (en) | 2014-06-11 | 2014-06-11 | The user of forced symmetric centralization is supported to put forward power method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104036166A true CN104036166A (en) | 2014-09-10 |
| CN104036166B CN104036166B (en) | 2017-12-15 |
Family
ID=51466934
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410257094.0A Active CN104036166B (en) | 2014-06-11 | 2014-06-11 | The user of forced symmetric centralization is supported to put forward power method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104036166B (en) |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104392159A (en) * | 2014-12-17 | 2015-03-04 | 中国人民解放军国防科学技术大学 | User on-demand authorization method capable of supporting least privilege |
| CN106295319A (en) * | 2016-08-02 | 2017-01-04 | 中标软件有限公司 | Operating system safety protecting method |
| CN106650500A (en) * | 2016-12-28 | 2017-05-10 | 广州杰赛科技股份有限公司 | Method and system for modifying user authority |
| CN107172053A (en) * | 2017-05-26 | 2017-09-15 | 河南职业技术学院 | The method of controlling security and safety control of computer |
| CN110046205A (en) * | 2019-04-22 | 2019-07-23 | 瀚高基础软件股份有限公司 | A kind of relevant database row safety access control method and system |
| CN111381903A (en) * | 2020-03-18 | 2020-07-07 | 支付宝(杭州)信息技术有限公司 | Program running method, device, equipment and medium |
| CN111475783A (en) * | 2019-01-24 | 2020-07-31 | 阿里巴巴集团控股有限公司 | Data detection method, system and equipment |
| CN112464213A (en) * | 2020-11-18 | 2021-03-09 | 苏州浪潮智能科技有限公司 | Operating system access control method, device, equipment and storage medium |
| CN112751867A (en) * | 2020-12-31 | 2021-05-04 | 南京航空航天大学 | Access control authorization method based on logic unit and trust evaluation |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6023765A (en) * | 1996-12-06 | 2000-02-08 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role-based access control in multi-level secure systems |
| CN1885297A (en) * | 2006-06-02 | 2006-12-27 | 石杰 | Method for role-based access control model with precise access control strategy |
| CN102034052A (en) * | 2010-12-03 | 2011-04-27 | 北京工业大学 | Operation system architecture based on separation of permissions and implementation method thereof |
| CN102663321A (en) * | 2012-04-24 | 2012-09-12 | 百度在线网络技术（北京）有限公司 | Security enhancement system and method for software |
| CN103065100A (en) * | 2012-12-26 | 2013-04-24 | 中国人民解放军总参谋部第六十一研究所 | Container-based method of users to protect private data |
-
2014
- 2014-06-11 CN CN201410257094.0A patent/CN104036166B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6023765A (en) * | 1996-12-06 | 2000-02-08 | The United States Of America As Represented By The Secretary Of Commerce | Implementation of role-based access control in multi-level secure systems |
| CN1885297A (en) * | 2006-06-02 | 2006-12-27 | 石杰 | Method for role-based access control model with precise access control strategy |
| CN102034052A (en) * | 2010-12-03 | 2011-04-27 | 北京工业大学 | Operation system architecture based on separation of permissions and implementation method thereof |
| CN102663321A (en) * | 2012-04-24 | 2012-09-12 | 百度在线网络技术（北京）有限公司 | Security enhancement system and method for software |
| CN103065100A (en) * | 2012-12-26 | 2013-04-24 | 中国人民解放军总参谋部第六十一研究所 | Container-based method of users to protect private data |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104392159B (en) * | 2014-12-17 | 2018-02-06 | 中国人民解放军国防科学技术大学 | A kind of user for supporting least privilege authorization method on demand |
| CN104392159A (en) * | 2014-12-17 | 2015-03-04 | 中国人民解放军国防科学技术大学 | User on-demand authorization method capable of supporting least privilege |
| CN106295319A (en) * | 2016-08-02 | 2017-01-04 | 中标软件有限公司 | Operating system safety protecting method |
| CN106295319B (en) * | 2016-08-02 | 2019-07-19 | 中标软件有限公司 | Operating system safety protecting method |
| CN106650500B (en) * | 2016-12-28 | 2020-04-14 | 广州杰赛科技股份有限公司 | User permission modification method and system |
| CN106650500A (en) * | 2016-12-28 | 2017-05-10 | 广州杰赛科技股份有限公司 | Method and system for modifying user authority |
| CN107172053A (en) * | 2017-05-26 | 2017-09-15 | 河南职业技术学院 | The method of controlling security and safety control of computer |
| CN111475783A (en) * | 2019-01-24 | 2020-07-31 | 阿里巴巴集团控股有限公司 | Data detection method, system and equipment |
| CN111475783B (en) * | 2019-01-24 | 2024-02-27 | 阿里巴巴集团控股有限公司 | Data detection method, system and equipment |
| CN110046205A (en) * | 2019-04-22 | 2019-07-23 | 瀚高基础软件股份有限公司 | A kind of relevant database row safety access control method and system |
| CN111381903A (en) * | 2020-03-18 | 2020-07-07 | 支付宝(杭州)信息技术有限公司 | Program running method, device, equipment and medium |
| CN112464213A (en) * | 2020-11-18 | 2021-03-09 | 苏州浪潮智能科技有限公司 | Operating system access control method, device, equipment and storage medium |
| CN112464213B (en) * | 2020-11-18 | 2022-07-08 | 苏州浪潮智能科技有限公司 | Operating system access control method, device, equipment and storage medium |
| CN112751867A (en) * | 2020-12-31 | 2021-05-04 | 南京航空航天大学 | Access control authorization method based on logic unit and trust evaluation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104036166B (en) | 2017-12-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104036166A (en) | User privilege escalation method supporting mandatory access control | |
| EP3208718B1 (en) | Security monitoring at operating system kernel level | |
| US7783891B2 (en) | System and method facilitating secure credential management | |
| US7257835B2 (en) | Securely authorizing the performance of actions | |
| US10348734B2 (en) | Security bypass environment for circumventing a security application in a computing environment | |
| WO2013025592A1 (en) | Method and apparatus for token-based conditioning | |
| CN102831355B (en) | The method of trusted path is set up in secure operating system | |
| CN105656890A (en) | FIDO (Fast Identity Online) authenticator, system and method based on TEE (Trusted Execution Environment) and wireless confirmation | |
| CN104463569A (en) | Secure connection payment method and device | |
| WO2013025590A1 (en) | Method and apparatus for making token-based access decisions | |
| US10762245B2 (en) | Input peripheral device security | |
| WO2013025586A2 (en) | Apparatus and method for performing session validation | |
| WO2017036345A1 (en) | Information input method and device | |
| CN104202296A (en) | Trusted security enhancement method for domestic operating system | |
| WO2017084569A1 (en) | Method for acquiring login credential in smart terminal, smart terminal, and operating systems | |
| CN105930728B (en) | A kind of application checking method and device | |
| KR101561167B1 (en) | System and Method for Controlling Application Permission on the Android Mobile Platform | |
| KR101097942B1 (en) | Process controlling system for managing computer in incorporation using gray list and method thereof | |
| KR101768942B1 (en) | System and method for secure authentication to user access | |
| CN104298925A (en) | Design and implementation method of active immunity platform of operating system | |
| CN103870761A (en) | Leak prevention method and device based on local virtual environment | |
| CN102682230B (en) | For safety protecting method and the device of the Internet Long-distance Control | |
| KR101408276B1 (en) | Security system and method of portable device control with rights management policy in based | |
| KR102201218B1 (en) | Access control system and method to security engine of mobile terminal | |
| US10972469B2 (en) | Protecting critical data and application execution from brute force attacks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |