JP3756397B2 - ACCESS CONTROL METHOD, ACCESS CONTROL DEVICE, AND RECORDING MEDIUM - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a computer system, and more particularly to a method for protecting resources in a computer system by access control in the computer system and accurately controlling access to the resources in the computer system.
[0002]
[Prior art]
With the progress of computer technology and communication technology, more and more computers are connected via a network, and a computer network closed to an organization or a community has been changed to a global network. However, it has become widespread while security considerations have not been made, and security issues such as unauthorized access to and unauthorized rewriting of information in computer systems and interruption of services provided on computer systems There are many problems.
[0003]
Today, most computers on computer networks operate on UNIX, compatible operating systems, or operating systems that are heavily influenced by UNIX. The cause of the frequent occurrence of the security problem is that these operating systems have a great problem from the viewpoint of access control.
[0004]
[Problems to be solved by the invention]
The first problem is that the system is protected by a single privileged user (superuser) authority. If you have superuser authority, you can control all resources provided by the operating system, and even if resources that are prohibited from being read or written are physically disabled, you can cancel the setting and read or write Is possible. For this reason, when a program that operates with superuser authority that exists in large numbers on the system is hijacked, all authority relating to the system is taken.
[0005]
The second problem is that authentication is performed only for the user when logging into the system. Since there is no mechanism for authenticating the file storing the program or the program being executed, there is a risk that detection will be delayed even if the program is replaced by some means.
[0006]
The third problem is that access control cannot be performed for users who are not registered in the system. For this reason, in an information providing service program or the like, a code for performing access control on information is incorporated in an application program.
[0007]
However, since the protection mechanism provided by the operating system cannot be used for such access control independently performed by such an application program, the risk of unauthorized information access due to problems in the program increases. Further, since access control is provided for each application, the setting method differs for each application, making it difficult to unify and manage the entire system.
[0008]
The fourth problem is that all programs operate with the maximum possible authority. For this reason , Even a program originally designed to access only a specific file is always in a state where it is possible to access an unexpected file, and illegal leakage or rewriting of information can occur at any time. In addition, when an unauthorized program is installed in the system, the program operates with the maximum authority of the user who executed the program, so the same situation as described above may occur. Even when the intermediate code is executed on the interpreter program or when the data is simply processed by the data processing program, the interpreter program or the data processing program itself may be defective. Therefore, access to resources other than those originally accessed by these programs is possible. If this is not limited, a similar problem occurs.
[0009]
Known techniques for access control include: Mamoru Maekawa, Arthur E.01dehoeft, Rodney R.0ldehoeft, 1987 The Benjamin / Cummings Publishing Company, Inc., "Operating System Advanced Concepts" (Corporation, “Advanced Concept of Operating System”), Chapter 8 Computer Security, and Dorothy ERDenning, 1982 Addison-Wesley Publishing Company, Inc. “Cryptography and Data Security” (Tadahiro Uesono et al.) In 1988, published by Baifukan Co., Ltd., “Cryptography and Data Security”), Chapter 4 is summarized in the section on access control.
[0010]
In these documents, an access matrix model is shown as a method for controlling access based on who is trying to access an object provided by a computer system.
[0011]
The access matrix model is composed of a set 0 of objects (objects) subject to access control, a set S of active objects (subjects) as subjects of accessing the object, and a “row” consisting of subjects and objects. It is composed of an access matrix A made up of a combination of “columns”. An element A [s, o] of the access matrix A represents an access right to the object o of the subject s. An access right is an access type permitted for an object.
[0012]
In a computer system, an object typically includes a file, a memory area, and a process, a subject includes a user, a process, and a domain, and an access type includes read, write, and execute. A domain is a protected environment in which processes are executed. In this model, when access from the subject s to the object o is requested, the access right A [s, o] is searched, and the access is always permitted or always set by setting the access right for the access type. It is not allowed. This access matrix model works correctly when the subject, object, and access matrix are all reliable.
[0013]
The access matrix is generally a sparse matrix, and it is not realistic to realize the matrix as it is. In the above document, a triple table, a capability list, an access list, and a lock / key system are shown as implementation methods.
[0014]
The triple table manages non-empty elements of A as a table of the form (s, o, A [s, o]).
[0015]
The capability list manages the objects that can be accessed by the subject s and their access rights in the form of (0, A [s, o]) for each subject. The value of (o, A [s, o]) is called capability, and the access right can be transferred by transferring a copy of the capability to another subject.
[0016]
The access list manages subjects that can access the object o and their access rights for each object in the form of (s, A [s, o]).
[0017]
Many operating systems such as UNIX employ access control using a degenerated access list. Each file in UNIX has an access list consisting of three elements. The first describes the access rights of the file owner, the second describes the access rights for all users of the owner's group, and the third describes the access rights for all other users. Access rights include read (r), write (w), and execute (x).
[0018]
The lock / key system has a list (L [1], r [1]), (L [2], r [2]) of access rights r [i] to the object L for the object o. .., And the subject s has the access right r [i] for the object o, that is, when A [s, o] = r [i], the key K [i] for the lock L [i] is s To give. The subject manages the key in the form of (o, K).
[0019]
In either method, the access is always permitted or not always permitted. Subject, object, and data for access control (triplet table, capability list, access list, lock list / key list) ) Works correctly if you can trust.
[0020]
Other known concepts related to access control include Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-based Access Control (RBAC).
[0021]
The DAC controls access to an object for each subject or group to which the subject belongs, and each user on the system can set access control for an object owned by the user. This is realized by the access control list.
[0022]
MAC enforces control over all access on the system, and all subjects and all objects have a hierarchical classification (eg, no classification, confidential, confidential, confidential, etc.) and non-hierarchical A sensitivity label (referred to as a MAC label) expressed by a combination of categories (for example, sales, research and development, personnel, management, etc.) is assigned, and access control is performed based on the subject and object MAC labels. A subject can read an object when the subject MAC label sensitivity classification is greater than or equal to the object MAC label sensitivity classification and the subject MAC label category includes all of the object MAC label categories. (Leaddown).
[0023]
A subject writes to an object when the subject MAC label sensitivity classification is less than or equal to the object MAC label sensitivity classification and all of the subject MAC label categories are included in the object MAC label category. Can (light up). In general, the MAC is not used alone but is used together with the DAC.
[0024]
The RBAC is for describing a complicated access control policy more simply, and assigns a role for each subject and performs access control by assigning an access right for each role. The subject has the access right of the role assigned to the subject, and the role can have an inclusive relationship. Access control itself is realized by the access control list.
[0025]
The first problem related to the access control described above can be expected to have a certain effect due to an implementation ingenuity such as eliminating superuser authority and distributing authority relating to system management to a plurality of authorities. However, in general, most computer systems are managed by a small number of administrators, and even if the system is simply distributed to a plurality of authorities, the effect is limited. For example, whether you are logged in to the system over a trusted line, whether the system administrator is logged in to the system with the correct login procedure, and whether you are trying to control the system from an illegally replaced program If the execution context such as “how” is not utilized, there is a risk that the authority of the system administrator is taken in order and all the authority concerning the system is eventually taken. Utilization of execution context is not included in known techniques.
[0026]
As a second problem related to the access control, a known technique is used in which a file system or a memory area is periodically scanned and inspected by a checksum or the like stored safely. However, it is possible that the replacement of a program or file may not be detected, such as replacement of an inspection program, replacement that does not require a scanning interval, or existence of a storage area for a log file or a temporary file.
[0027]
The third problem related to the access control cannot be solved by the known access matrix model or MAC. This is because the access matrix model works correctly only when all of the subjects, objects, and access matrices are reliable. Non-system administrators can freely register subjects in the subject set S, and freely add access types. It is not allowed to do. The same applies to the MAC.
[0028]
In order to solve the fourth problem related to access control by using an access list or capability list that is not degenerated, subjects and objects are classified in detail, thereby setting access lists and capability lists. It is necessary to control the setting and transfer of capabilities. For example, when the user u operates the program p, it is necessary to manage not only A [u, o] and A [p, o] but also A [u ［p, o]. . For this reason, in order to set access control for all combinations that permit access, an enormous description is required, which is not realistic.
[0029]
In addition, since it is not permitted for a person other than the system administrator to freely add subjects and access types, it is difficult to limit the authority for any subject. Even if the MAC is used together, it is not possible to prevent an unauthorized program from being installed in the system, and an unexpected file can be accessed. For this reason, the situation where an application or data cannot be trusted cannot be handled positively.
[0030]
In the technique disclosed in Japanese Patent Laid-Open No. 9-319659, the fourth problem is solved by dividing the MAC area into non-overlapping areas. However, it does not solve the first and third problems.
[0031]
US Pat. No. 5,864,683 places the first and fourth of the above problems by placing a completely separate protection domain in the system and defining a set of objects that are accessible from subjects within that protection domain. Is a solution. However, it does not solve the second and third problems.
[0032]
The present invention has been carried out against such a background. In access control in a computer system, an object to be accessed and a subject to be accessed are classified in detail, and specific restrictions based on the classification. It is an object of the present invention to provide an access control method and an access control apparatus that can forcibly add a password. The present invention eliminates a single privileged user and minimizes the damage caused by the hijacking of a program, or eliminates the hijacking of a program and provides access control that is unified throughout the system, thereby providing security for the computer system. It is an object of the present invention to provide an access control method and an access control apparatus that can improve the performance.
[0033]
[Means for Solving the Problems]
In the method of the present invention, a subject that is an access subject holds a capability list that represents the authority of the subject, and an object that is an access target has an access control list that represents a capability condition necessary for permitting access to the object. And when at least one of the capabilities in the capability list meets at least one of the capability conditions required for access permission in the access control list, access to the object is permitted and access to the object This includes restricting the scope of authority accessible from the subject by forcibly changing the capability of the subject based on the specification of capability enforcement defined for each object when permitted.
[0034]
According to the present invention, a subject can only discard the capabilities held by the subject itself and weaken the capabilities' authority, so that the subject has the capabilities enforced by the object being accessed. You must use it. Subject authority is dynamically limited and restricted by the accessed object, and the accessible range for each object can be restricted.
[0035]
In addition, a variable-length list of attributes (a pair of attribute name and attribute value) is used as the capability, and an access right deletion specification and an attribute addition or overwriting specification are used as the capability enforcement specification. This replaces capability enforcement with attribute list operations, and by observing the attribute list, the origin of subject authority can be traced.
[0036]
Further, when the capability is forced, the subject is authenticated based on the information about the subject, and the capability is forced based on the authentication result. By placing an authentication server for the attribute name, subject authentication is performed when the attribute name is enforced, so the choice of whether to authenticate and the choice of the authentication algorithm can be freely done according to the system management policy .
[0037]
The attributes in the capabilities are not limited in any way, not only the user, application type, origin of information (trusted site / untrusted site / local, etc.), security level, etc., but also CPU usage Those that can be handled as resources on the operating system, such as the rate, network bandwidth usage rate, and the maximum number of child processes, and those that can be used to determine access restrictions can be used as attributes in the capability.
[0038]
In addition, the elements in the access control list include not only the capabilities required for access permission but also the attribute conditions for the capabilities required for access permission, and a value with a certain attribute value to access the object. Expressions such as larger are also available.
[0039]
As a description of capability forcing, not only adding an attribute but also forcing that an attribute value is decreased by 1 when an object is accessed.
[0040]
That is, a first aspect of the present invention is an access control method for a computer system, and the feature of the present invention is that all accessible objects existing in the computer system and a database in the computer system are characterized. A first step of storing access control information for each one, a second step of determining access permission to a specific object from a specific subject using the computer system, and the second step The third step of accepting an access request from the subject to the object, limited within the scope of the access permission, and the capability in the access request to the object with respect to the capability list held by the subject. It is in place and a fourth step of forced of I.
[0041]
As information for determining the access permission, an object that the subject is trying to access and its access type, access control information of the object, and a capability list held by the subject are used as the access control information. Information for determining the access permission, including an access control list having an entry of a set of access type, capability condition necessary for access permission, and capability forced when access is permitted In addition, there is at least one combination of an effective capability in the capability list held by the subject that satisfies the capability condition necessary for access permission in the access type and an entry in the access control list of the object. Only the access of the object when there is permission it is desirable.
[0042]
When any subject in the capability list is changed by the subject itself, it is desirable that it is permitted to discard the capability or weaken the capability.
[0043]
It is desirable to include a capability forcing function that inputs a capability list before being forced as an input and outputs a capability list after being forced as a specification of the capability to be forced when the access is permitted.
[0044]
The capabilities in the capability list and the capabilities required for the access permission are configured as a variable-length list of attribute names and attribute values, and the capability conditions required for the access permissions are It is constructed as a variable length list of attribute name and attribute value conditions included in the capability, and the capability forcing function is a variable length pair consisting of attribute name and attribute value forcibly adding or overwriting the capability. It is configured as a list or defined as an operation that is compulsorily performed on the capability, and when the capability is weakened, the authority of the capability is deleted, or a pair of attribute name and attribute value is set in the capability It is desirable to do so by adding.
[0045]
Instead of the fourth step, based on attribute names and attribute values that are forcibly added or overwritten to the capability, information held by the subject, information specified by the subject, and for each subject A fifth step of collecting information necessary for authentication from the information held by the unique computer system, the information collected in the fifth step, and the validity of a preset subject A sixth step of verifying the validity of the subject from the information, and forcibly adding an attribute name and an attribute value to the capability in the capability list based on the verification result in the sixth step; Alternatively, a seventh step of overwriting can be provided.
[0046]
According to a second aspect of the present invention, there is provided an access control apparatus for a computer system. The feature of the present invention is that each of all accessible objects existing in the computer system and a database in the computer system is provided. Means for storing access control information; means for determining an access permission from a specific subject using the computer system to a specific object; and within the range of the access permission determined by the means for determining the access permission And means for accepting an access request from the subject to the object, and means for forcing the capability in the access request to the object with respect to a capability list held by the subject. It is in place.
[0047]
As information for determining the access permission, an object that the subject is trying to access and its access type, access control information of the object, and a capability list held by the subject are used as the access control information. An access control list having an entry of a set of an access type, a capability condition necessary for access permission, and a capability forced when access is permitted, and the means for determining the access permission includes: In the information for determining the access permission, the effective capabilities in the capability list held by the subject that satisfies the capability conditions necessary for the access permission in the access type and the access control list of the object of Combination of entry may be desirable to include means for permitting only the access of the object when at least one present.
[0048]
Means for changing any capability in the capability list by the subject itself is provided, and it is preferable that the means for changing comprises a means for discarding the capability and a means for weakening the capability.
[0049]
It is desirable to include a capability forcing function that inputs a capability list before being forced as an input and outputs a capability list after being forced as a specification of the capability to be forced when the access is permitted.
[0050]
The capabilities in the capability list and the capabilities required for the access permission are configured as a variable-length list of attribute names and attribute values, and the capability conditions required for the access permission are set as capabilities. Configured as a variable length list of included attribute names and attribute value conditions, and the capability forcing function as a variable length list of attribute names and attribute values that are forcibly added or overwritten to the capability. Configure or define as an operation that is compulsorily applied to the capability, and the means to weaken the capability is to add a pair of attribute name and attribute value to the capability and a means to delete the authority of the capability It is desirable to include the means to do.
[0051]
Alternatively, instead of means for forcing the capability, based on an attribute name and an attribute value forcibly added to or overwritten to the capability, information held by the subject, and information specified by the subject Means for collecting information necessary for authentication from information held by the computer system unique to each subject, and for verifying validity of the information collected by the collecting means and a preset subject Means for verifying the validity of the subject from the information, and the means for forcing the capability includes an attribute name and an attribute value in the capability list based on a verification result by the means for verifying the validity. It must be configured to include means for forcibly adding or overwriting capabilities. It can also be.
[0052]
According to a third aspect of the present invention, the access control method of the present invention is further installed in a computer device that includes predetermined hardware and predetermined basic software installed in the hardware. This is a recording medium on which software to be executed or software that uses the computer device as a device corresponding to the access control device of the present invention is recorded.
[0053]
DETAILED DESCRIPTION OF THE INVENTION
The configuration of the access control apparatus according to the embodiment of the present invention will be described with reference to FIGS. 1, 3, and 6. FIG. FIG. 1 is a block diagram of the entire system of the embodiment of the present invention. FIG. 3 is a block diagram of the access control unit of the embodiment of the present invention. FIG. 6 is a block diagram of an access control unit using the authentication server of the embodiment of the present invention.
[0054]
The present invention is an access control apparatus for a computer system as shown in FIG. 1, and the feature of the present invention is that the computer system and the computer system as shown in FIGS. An ACL repository 34 for storing access control information for every accessible object in the database, and an access authority checking unit 36 for determining permission to access a specific object from a specific subject using the computer system; The request acceptance unit 5 that accepts an access request to the object from the subject, and the capability list held by the subject are limited to the range of the access permission determined by the access authority inspection unit 36. The object It is in place and a capability forced unit 38 of forced capabilities in the access request Kutohe.
[0055]
As information for determining the access permission, an object that the subject is trying to access and its access type, access control information of the object, and a capability list held by the subject are used as the access control information. An access control list having an entry of a set of an access type, a capability condition necessary for access permission, and a capability forced when access is permitted, In the information for determining permission, an effective capability in the capability list held by the subject that satisfies the capability condition necessary for permitting access in the access type and an entry in the access control list of the object Only allow access of the object when a combination of at least one present.
[0056]
The capability list holding unit 4 can change any capability in the capability list according to the request of the subject itself. This change is made by discarding the capability or weakening the capability.
[0057]
A capability forcing function for inputting a capability list before being forced as an input and outputting a capability list after being forced as an indication of the capability to be forced when the access is permitted is included.
[0058]
The capabilities in the capability list and the capabilities required for the access permission are configured as a variable-length list of attribute names and attribute values, and the capability conditions required for the access permission are set as capabilities. It is configured as a variable length list of the attribute name and attribute value conditions included, and the capability forcing function is a variable length list of attribute names and attribute values that are forcibly added or overwritten to the capability. When the capability forcing unit 38 weakens the capability, the capability authority is deleted or the capability name and attribute value are added to the capability. This is done by adding a pair.
[0059]
Further, in FIG. 6, instead of the capability forcing unit 38 shown in FIG. 3, the information held by the subject based on the attribute name and the attribute value forcibly added or overwritten to the capability, and the subject An authentication information collection unit 42 that collects information necessary for authentication from designated information and information held by the computer system unique to each subject, information collected by the authentication information collection unit 42, and presetting And the authentication server 2 that verifies the validity of the subject from the information for verifying the validity of the subject, and the capability forcing unit 40 uses the attribute name and the attribute based on the verification result by the authentication server 2 The value is forcibly added or overwritten to the capability in the capability list.
[0060]
The access control apparatus according to the embodiment of the present invention is further installed in a computer apparatus provided with predetermined hardware and predetermined basic software installed in the hardware, thereby making the computer apparatus an access control apparatus according to the present invention. This is realized by installing the software in a computer device using a recording medium on which software corresponding to the device is recorded. Thereby, the computer apparatus executes the access control method of the present invention.
[0061]
In the following, embodiments of the present invention will be described in more detail.
[0062]
FIG. 1 shows an embodiment of the present invention. In this embodiment, the access control method according to the present invention is implemented in the operating system 13. All access requests 6 issued from the process 1 are subjected to access control according to the present invention in the access control unit 3, and only the access requests 8 permitted here are processed in the remaining part of the operating system. According to the present embodiment, the independence of the portion for realizing the access control is strengthened, and the modification of the operating system for realizing the access control method according to the present invention can be reduced.
[0063]
In the present application, an embodiment using a UNIX and UNIX-compatible operating system is shown as a base operating system, but the applicable range of the present invention is not limited to a UNIX and UNIX-compatible operating system. . Also, it does not depend on hardware architecture, such as a single processor system, a multiprocessor system, or a distributed computing system.
[0064]
In this embodiment, a subject (access subject) is a process (a program running on the operating system and a unit for allocating resources provided by the operating system), and an object (access target) is a file or other operating system. It is a resource to be provided. The capability list holding unit 4 is placed on a protected memory area on the system.
[0065]
The process 1 can indicate which capability in the capability list holding unit 4 held by the process itself, but cannot directly access or change the contents of the capability. Process 1 uses the capabilities held by its own process to pass a duplicate of the capability to another process (but only if it is permitted by the authority in the capability) It is possible to delete and weaken the capability.
[0066]
When a duplicate of a process is created, that is, when a child process is created, the capability list of the parent process is copied and taken over by the child process. When a new program is read and started, whether or not the capability is inherited is determined depending on the authority of each capability in the capability list.
[0067]
(Capability)
FIG. 2 is an example of capabilities. An example of the authority 22 in the capability is shown below.
[0068]
d (duplicate / modify): an authority for passing the capability copy to another process, removing an arbitrary authority from the authority field of the capability, or taking over the capability when a new program is started. a (allocate): Resource allocation authority. If this permission is not set during the capability, requests that require resource allocation (file creation, additional file size writing, process creation, etc.) are not allowed.
r (read): Read Right Limit. Permission to read data from files.
w (write): Write authority. Permission to write data to a file (overwrite).
x (execute): Execution authority. The right to execute a file as a program, the right to search a directory, and the right to create a socket (endpoint of communication).
[0069]
The simplest examples of cid 23 in the capability include uid (user identifier) and gid (user group identifier). In cid, uid is handled as it is, and gid is handled as cid = − (gid + 1). Capabilities are protected by the operating system, so no encryption is required. A more general example is a method of generating a unique number in the system and assigning that number to (a set of) rights to a particular object.
[0070]
In the present embodiment, as a description of capability, a character string representing authority and a value of uid or gid enclosed in [] are used.
[0071]
For example, as a capability list
[Darwx uid = 201] [darwx gid = 31]
Can exercise all the authority as uid = 201, gid = 31.
[--R-- uid = 9] [-a-w-uid = 201] [-a-w-gid = 31]
Can hold only read authority when uid = 9 and only resource allocation authority and write authority when uid = 201 and gid = 31. Since this process does not hold execution authority, a new program cannot be started.
[-Ar-x uid = 9] [-ar-x gid = 9]
Uid = 9 and gid = 9 can exercise resource allocation authority, read authority, and execution authority. Since this process does not hold the capability duplication authority, even if a new program is started in this process, the capability list becomes an empty process. Even if a process with such a capability list is hijacked, it will not be possible to launch a program that obtains some useful information. In other words, by setting the necessary minimum authority, even if the program is hijacked, damage can be minimized. Capability forcing described later is for forcibly setting such capability list.
[0072]
(Access control process flow)
Hereinafter, the flow of access control will be described with reference to FIG. First, the ACL repository 34 is set. The ACL repository 34 stores an access control list for each object, and the access control list can be searched by the object identifier 31. The access control list is also allowed to make changes while the system is operating. For this reason, the access control list itself is also handled as an object.
[0073]
When the operating system 13 receives the access request 6 from the process 1, the object to be accessed is converted into the object identifier 31, the ACL repository 34 is searched, and the access control list 35 of the object is taken out. Subsequently, it is determined from the three pieces of information of the access control list 35, the access type 32, and the capability list 7 held by the process whether access to the object should be permitted (36).
[0074]
When the operating system permits access to the object, the compulsory capability list 10 is obtained from the capability list 7 held by the process using the capability forcing function list 37 in the access control list (40). And a capability list of processes.
[0075]
(Access control list and capability enforcement)
FIG. 4 is an example of an entry in the access control list. An example of the access right 62 in the access control list entry is shown below.
[0076]
m (modify): Authority to change the access control list.
a (allocate): Resource allocation authority. If the access control list does not have this authority, requests that require resource allocation (file registration in the directory, file size expansion, process creation, etc.) are rejected.
r (read): Read authority. Permission to read data from files.
w (write): Write authority. Permission to write data to a file.
x (execute): Execution authority. The right to execute a file as a program, the right to search a directory, and the right to create a socket (endpoint of communication).
[0077]
In order to enable the authority to change the access control list, at least the authority in the capability must be included. In order to make other resource allocation authority, read authority, write authority, and execution authority effective, at least both the authority in the capability and the access authority in the corresponding access control list must be set. Further, the access right in the access control list set when a new object such as a file is created cannot exceed the right in the corresponding capability.
[0078]
The capability condition 63 necessary for access permission describes the authority condition and cid condition in the capability as a logical expression. In many cases, the authority condition in the capability can be uniquely determined from the access right representing the access type, so the authority condition in the capability can be omitted.
[0079]
An example of the capability forcing function 64 in the access control list is shown below.
[0080]
f (flash): The capability list is emptied.
i (insert): The argument capability is added to the capability list.
m (modify): Takes a logical product of authorities for the capabilities in the capability list having the same cid as that of the capability of the argument.
, (Concatenate): The functions are applied in order from the front.
[0081]
In this embodiment, the notation of the access control list uses a character string representing an access right, a value of uid or gid, and a description of a capability forcing function following:.
[0082]
(Example of access control list)
marw-uid = 201
Can be accessed by a process having a capability satisfying uid == 201, and the access control list can be changed, resources can be allocated, read and written.
[0083]
marwx uid = 10
The directory specified by can be accessed by processes with capabilities that satisfy uid = 10, and can change the access control list, register and read files, rename files, delete files, and search directories. It is.
-Ar-x uid = 201
Can be accessed by a process having capabilities that satisfy uid = 201, and file registration, reading, file name change, and directory search are possible.
--- xany: [-a-w-any], i [--r--uid = 9]
Can be executed by a process having a capability including an arbitrary execution authority, and when this object is executed, all the capabilities of the process are determined according to the authority and the logic of -aw. The product is modified so that the product is taken, and the capability of reading authority with uid = 9 is added to the capability list. The capability list of the process is
[Darwx uid = 201] [darwx gid = 31]
If this is the case,
[--R-- uid = 9] [-a-w-uid = 201] [-a-w-gid = 31]
It becomes.
[0084]
(Capability by attribute)
The present invention also proposes a method of using a variable-length list of attributes (a combination of an attribute name and an attribute value) as a capability expression. This can be realized by replacing the cid field 23 with an attribute list. An example is shown in FIG.
[0085]
There is no restriction on what kind of attribute is used, and what can be used for determination for restricting access can be used as an attribute. In addition to the attributes provided by the system, it is also possible to use attributes that can be freely defined by the interested party. Examples of attributes are shown below.
User identifier (uid): An identification number assigned to each user of the system.
User group identifier (gid): an identification number assigned to each user group of the system.
Program identifier (progid): An identification number assigned to each program.
Application identifier (applied): an identification number assigned to each type of application (application group).
Information origin identifier: an identification number assigned to each origin of information. Distinguish between trusted sites / untrusted sites / local. The notation is also treated as an information origin name (orig).
Security level (sl): represents a confidential classification, and can be considered as general (unclassified), confidential, confidential (secret), confidential (topsecret), and the like.
CPU utilization (pcpu): CPV utilization reserved for the process.
Network Bandwidth Usage (pnwb): Network bandwidth usage reserved for the process.
Maximum number of child processes (nproc): The maximum number of child processes that a process can hold.
Maximum number of simultaneous use (nopen): The maximum number of processes that can use a file simultaneously.
Maximum file size (fsize): Maximum value of a file that can be generated.
[0086]
As a description of capability by attribute, a character string representing authority is used followed by “attribute name = list of attribute value” enclosed in [].
[0087]
(Access control when using capabilities based on attributes)
Removing one or more authorities from a capability or adding one or more attributes to a capability is considered to weaken the capability relatively. Therefore, “capability C1 is weaker than capability C2” means “C1 ≠ C2, C1 includes all attributes included in C2, and C2 includes all authorities included in C1”. Define. For example, the capability [rightsx, y, z] is a weakening of [rights x, y], and if an object is accessible with [rights x, y, z], then [rights x, y] ] Is also accessible in the same manner. In other words, the set of objects accessible by [rights x, y, z] is a subset of [rights x, y]. However, when such access is permitted, the effect of compulsory capability disappears. i When accessing with ghts x, y], z is automatically forced. This is called “implicit enforcement”.
[0088]
An example of the capability forcing function when the capability by attribute is used is shown below.
f (flash): The capability list is emptied.
i (insert): The argument capability is added to the capability list.
m (modify): For each capability in the capability list, a logical product with the capability authority of the argument is taken and an attribute of the capability of the argument is added. If the same attribute name already exists, the attribute value of that attribute name is replaced.
, (Concatenate): The functions are applied in order from the front.
[0089]
As a capability condition necessary for permission of access, a privilege condition and an attribute condition in the capability are described as a logical expression. In many cases, the authority condition in the capability can be uniquely determined from the access right representing the access type, so the authority condition in the capability can be omitted.
[0090]
(Flow of access control processing with attribute authentication)
The present invention also proposes a method of performing subjecting of a subject based on information on the subject when forcing capability (38) and forcing capability based on the authentication result. Hereinafter, the flow of access control will be described with reference to FIG.
[0091]
First, the ACL repository 34 is set. The ACL repository 34 stores an access control list for each object, and the access control list can be searched by the object identifier 31. The access control list is also allowed to make changes while the system is operating. For this reason, the access control list itself is also handled as an object.
[0092]
When the operating system 13 receives the access request 6 from the process 1, the object to be accessed is converted into the object identifier 31, the ACL repository 34 is searched, and the access control list 35 of the object is taken out. Subsequently, it is determined from the three pieces of information of the access control list 35, the access type 32, and the capability list 7 held by the process whether access to the object can be permitted (36).
[0093]
If it is determined that access to the object can be permitted, the capability forcing function list 37 in the access control list is applied to the capability list 7 held by the process (38). Capability forcing functions include the following four.
Empty the f (flash) capability list.
The capability of the argument is added to the i (insert) capability list.
In the case of an attribute that does not require m (modify / authenticate) authentication, for each capability in the capability list, a logical product with the capability authority of the argument is taken, and the capability attribute of the argument is added. In the case of an attribute that requires authentication, for each capability in the capability list, the authentication server 2 that handles the capability attribute of the argument is called, and if the authentication is successful, the attribute is added to the capability. Logical AND with argument capability authority. If authentication fails, it is assumed that the capability forcing failed. , (Concatenate) function is applied in order from the front.
[0094]
If the forcible capability fails, access to the object is disallowed. Otherwise, the forced capability list 10 is made the process capability list and access to the object is permitted.
[0095]
The authentication server 2 is called with an attribute name, an attribute value, and other information 12 necessary for authentication. Then, the data is verified against the authentication data held by the authentication server itself, and the result 11 is returned.
[0096]
(Authentication server)
An authentication server can be placed for each attribute to be authenticated and for each attribute of the capability being enforced. Advantages of doing so include the following reasons.
(1) By minimizing the program size of each authentication server, design and coding bugs are avoided as much as possible, and even if one of the authentication servers is hijacked, damage is minimized. It can be kept in.
(2) By preparing an authentication server according to the attribute of the capability, for example, an authentication method can be selected according to the type of application and the security level.
[0097]
When implementing an authentication server, use the operating mode of the operating system, start the authentication server in the maintenance mode or equivalent operation mode, and stop or start the authentication server in the normal operation mode. It is desirable not to allow it. In addition, it is desirable that the authentication data used by the authentication server is allowed to be arbitrarily read / written only in the maintenance mode or the corresponding operation mode, and in the normal operation mode, it is prohibited to write or overwrite. .
[0098]
The uid, gid, proid, applied, and origin can be handled as attributes that require authentication as shown below.
uid: The uid authentication server obtains information that can identify a user such as a user name and a password, and performs authentication by collating with data held by the authentication server in order to authenticate the user.
gid: The gid authentication server receives the capability, verifies the uid attribute in the capability, and returns the gid for the group to which the uid belongs.
progid: Authentication is performed by verifying an electronic signature for a program developed on the memory. For example, a hash value by a hash function such as MD5 or SHA-1 of the program code is sent to the authentication server, and the authentication server collates the program identifier held by itself with the hash value.
applied: The applied authentication server takes the capability as an input, verifies the progid attribute in the capability, and returns an apply for the application group to which the progid belongs.
origin: The origin authentication server takes as input a list of files, devices, sockets, and the like accessed by the process, verifies what information origin is accessing, and returns the origin to that.
[0099]
【The invention's effect】
As described above, according to the present invention, in access control in a computer system, an object to be accessed and a subject to be accessed are classified in detail, and a specific restriction is forcibly added based on the classification. Make it possible. This eliminates a single privileged user and minimizes the damage caused by hijacking the program, or eliminates hijacking of the program and provides access control that is unified throughout the system, thereby improving the security of the computer system. Can be increased.
[Brief description of the drawings]
FIG. 1 is a block diagram of an entire system according to an embodiment of the present invention.
FIG. 2 is a diagram showing capabilities according to an embodiment of the present invention.
FIG. 3 is a block diagram showing a flow of access control processing according to the embodiment of the present invention.
FIG. 4 is a diagram showing entries in an access control list according to the embodiment of the present invention.
FIG. 5 is a diagram illustrating capabilities including attributes according to an embodiment of the present invention.
FIG. 6 is a block diagram showing a flow of access control processing with attribute authentication according to the embodiment of the present invention.
[Explanation of symbols]
1 process
2 Authentication server
3 Access control unit
4 Capability list holding part
5 Request acceptance department
6 Access request
7 Capability list before object access
8 Permitted access requests
9 Access permission flag
10 Capability list after object access check
11 Authentication results
12 List of information required for authentication
13 Operating system
22,52 Authority in capabilities
23 Capability identifier cid
31 Object identifier
32 Access type
34 ACL Repository
35 Access control list
36 Access Authority Inspection Department
37 List of capability forcing functions
38, 40 Capability forcing part
41 List of attribute name / attribute value pairs and capability list
42 Information collection unit for authentication
51 Total data length of capability
53 Attribute value length 1
54 Attribute name 1
55 Attribute value 1
56 Attribute value length 2
57 Attribute name 2
58 Attribute value 2
62 Access rights
63 Capability requirements for permission
64 Capability forcing function

Claims (14)

An access control method for a computer system, comprising:
Access control information for each accessible object existing in the computer system and a database in the computer system is stored in storage means ,
When there is an access request from a specific subject using the computer system to a specific object , the access control unit stores the access type, the access control information stored in the storage means, and the capability list held by the subject. Determining permission to access the object from the subject with reference to
The step of determining permission of access includes a step of changing the capability of the capability list held by the subject when permitting access and not permitting access when the change is rejected. Access control method. As information for determining permission of the access, the object that the subject is trying to access and its access type, access control information of the object, and a capability list held by the subject,
The access control information includes an access control list having an entry of a set of an access type, a capability condition necessary for permitting access , and a capability forced when access is permitted,
In the information for determining the permission of access, an effective capability in the capability list held by the subject that satisfies the capability condition necessary for the access permission in the access type and the access control list of the object The access control method according to claim 1, wherein access to the object is permitted only when there is at least one combination with the entry.   3. The access control method according to claim 1, wherein, when an arbitrary capability in the capability list is changed by the subject itself, it is permitted to discard the capability or weaken the capability on a limited basis.   A capability forcing function for inputting a capability list before being forced as an input and specifying a capability list to be forced when the access is permitted, and outputting a capability list after being forced. 3. The access control method according to 2. The capabilities in the capability list and the capabilities required for permitting the access are configured as a variable-length list of attribute names and attribute values,
The capability conditions necessary for permitting the access are configured as a variable-length list of attribute name and attribute value conditions included in the capability,
The capability forcing function is configured as a variable-length list of attribute names and attribute values that are forcibly added or overwritten to the capability, or is defined as an operation that is forcibly performed on the capability. ,
5. The access control method according to claim 2, wherein when the capability is weakened, the capability authority is deleted or a combination of an attribute name and an attribute value is added to the capability. The allowed subjects to modify the capability of the capability list held in the case to allow access, steps that do not allow access when a change is rejected,
Based on attribute names and attribute values that are forcibly added or overwritten to the capability,
The information the subject held, the information specified from the subject, and Luz step to collect information required for authentication from the information held inherent said computer system for each of the subject,
And the child of the scan information that has been collected in the step, and Luz steps to verify the validity of the subject from the information in order to verify the validity of the subject that has been set in advance,
Based on the verification result at this step, force the addition of attribute names and attribute values to capabilities in the capability list, or access according to claim 1 or 5, wherein including an automatic answering step overwriting Control method. An access control device for a computer system,
Means for storing access control information for each accessible object present in the computer system and a database in the computer system;
When there is an access request from a specific subject using the computer system to a specific object, refer to the access type, the access control information stored in the storage means, and the capability list held by the subject. A means of determining permission to access the object;
The access control is provided with a capability forcing means for changing the capability of the capability list held by the subject when permitting access to the subject and denying access when the change is rejected. apparatus. As information for determining the permission of the access,
The object that the subject is trying to access and its access type;
Access control information of the object;
Using the capability list held by the subject,
The access control information includes an access control list having an entry of a set of an access type, a capability condition necessary for permitting access , and a capability forced when access is permitted,
Means for determining the permission of the access, the information for determining the permission of the access, the capability in capability list satisfy the subject of the capabilities necessary to allow access in the access type holds 8. The access control apparatus according to claim 7, further comprising means for permitting access to the object only when at least one combination of a valid capability and an entry in the access control list of the object exists. Means for changing any capability in the capability list by the subject itself;
The access control apparatus according to claim 7 or 8, wherein the means for changing comprises means for discarding capabilities and means for weakening capabilities.   A capability forcing function for inputting a capability list before being forced as an input of a capability list before being forced and outputting a capability list after being forced as a specification of the capability to be forced when the access is permitted. The access control apparatus according to any one of 9. The capability to configure the capabilities and capabilities needed to allow the access in capability list and attribute names and values as a list of variable length which is a set,
The Configure condition of capabilities needed to allow access as a list of conditions for the attribute names and values variable-length included in the capability,
The capability forcing function is configured as a variable-length list of attribute names and attribute values that are forcibly added or overwritten to the capability, or is defined as an operation that is forcibly performed on the capability. ,
The access control apparatus according to any one of claims 8 to 10, wherein the means for weakening the capability includes means for deleting capability authority and means for adding a combination of an attribute name and an attribute value to the capability. In place of the strength Seite stage of the capability,
Based on attribute names and attribute values that are forcibly added or overwritten to the capability,
Means for collecting information required for authentication from information held by the subject, information specified from the subject, and information held by the computer system unique to each subject;
Means for verifying the validity of the subject from the information collected by the means for collecting and information for verifying the validity of the subject set in advance,
Force means of the capability is or claim 7 including means for forcibly add or override an attribute name and attribute value capability in the capability list on the basis of the verification result by the means for verifying the validity 11. The access control device according to 11.   The access control method according to any one of claims 1 to 6 is executed on a computer device provided with predetermined hardware and predetermined basic software installed on the hardware, thereby further installing the computer device. Recording media on which software to be recorded is recorded. The computer apparatus corresponding to the access control apparatus according to any one of claims 7 to 12 is further installed in a computer apparatus including predetermined hardware and predetermined basic software installed in the hardware. recording medium which software has been recorded to apparatus and to the ability to.

Images