KR100343069B1 - Mandatory Object Access Control Method Using Multi-Level Security, and Computer Readable Recording Medium Having thereon Programmed Mandatory Object Access Control Method Using Multi-Level Security - Google Patents

Abstract

The present invention relates to a mandatory object access control method using a multi-level security method and a computer-readable recording medium which is programmed and recorded. The mandatory object access control method according to the multi-class security method according to the present invention gives a security permission level and a category to a specific subject (that is, a process to use the object), and assigns a specific object (regular file, directory, or device file) Security classes and categories classified according to the degree of secrecy. Then, the subject's permission to the object is forcibly controlled by comparing the subject's permission to the object in kernel mode according to a predetermined security model. The computer-readable recording medium according to the present invention is stored in a predetermined recording device so as to be computer-readable by programming the mandatory object access control method using the multi-level security method.

Description

Mandatory Object Access Control Method Using Multi-Level Security, and Computer Readable Recording Medium Having thereon Programmed Mandatory Object Access Control Method Using Multi-Level Security}

The present invention relates to a security method in the Unix OS (Operating System) series, and more particularly, to assign a specific security level among various security levels to an object such as a subject, a regular file, a directory, and a device file. The present invention relates to a method of forcibly controlling access by comparing a permission authority between a subject and an object according to a predetermined security model, and to a recording medium that is programmed to be computer-readable.

In recent years, as the field of information has been rapidly expanded, illegally read objects by randomly accessing secret files or devices whose internal and external users, or process subjects, do not have access to secret-level information stored on a computer. There are security issues such as writing and performing. In particular, in the content service via the web, problems of theft of the system root authority by hackers and the like and illegal alteration of the home page and related contents by users who do not have access rights cause social controversy.

In the case of the access control applied to the conventional Unix-based OS, a permission bit is set for a file owned by a user to arbitrarily grant read, write, and execute permission to a user or another user in the group. This access control method is called Discretionary Access Control (DAC), and the root with the highest authority in the system can arbitrarily change the permission bit for all user-owned files.

Therefore, the problems in the above arbitrary access control may include the following points.

First, a secret level file may be illegally leaked to a third party who is not obliged to keep it confidential by copying it by another user who does not have the right to grant a secret at the discretion of the owner.

Second, it is possible to write to an object (file, directory, printer, floppy diskette, CD-ROM, etc.) that does not have a security level despite being a secret file. May leak.

Third, root, the user with the highest privileges as a system administrator, can have access rights to all files because he or she can arbitrarily change the permission bits for all user files, even though they do not have the secret permission. Can be.

Fourth, in the case of a web service that provides content using the web, anyone can access the web content without restriction. Therefore, there is a problem that an illegal user such as a hacker can illegally tamper or manipulate the contents of the home page or the file related to the web by using the loophole.

The technical problem to be solved by the present invention is that a subject having a certain security level in a Unix-like OS, that is, a process reads, writes, appends, or executes a secret security level object. In order to execute, by applying the modified BLP (Bell Lapadula) security model to the class and category relationship between the subject and the object, the object is accessed through comparison, so that the object having the security level is used as illegal user, object owner, And it provides a mandatory object access control method that can be protected from the arbitrary access of the root system administrator.

Another technical problem to be solved by the present invention is to allow the user process to additionally input the security permission level and category information desired by the current user in addition to the user ID and password when the user logs in to the system, and then the user process continuously generates the child process (fork). ) Provides a way for the child process to continue to inherit the security permission level and category entered by the user at login.

Another technical problem to be solved by the present invention is to allow a legitimate system user to read and write a data file using the mandatory access control method, but not to modify the data file if the user illegally takes root authority. It provides a way to control.

Another technical problem to be achieved by the present invention is to provide a recording medium in which a computer-readable program is recorded for the compulsory object access control method implemented according to the present invention.

1 is a structural diagram showing a task structure of a subject to which the subject's security permission level and category information are added.

2 is a detailed structural diagram of a field of a task structure to which a subject's security permission level is granted.

3 is a detailed structural diagram of a field of a task structure to which category information of a subject is assigned.

4 is a detailed structural diagram of an i-node to which security level and category information of an object are assigned.

5 is a conceptual diagram schematically illustrating a principle of inheriting a security permission level and category information of a process into a child process in a mandatory object access control method using a multi-class security method according to the present invention.

FIG. 6 is a flowchart illustrating a process from when a user logs in to a process after the user logs in in a method for controlling mandatory object access based on a multi-level security method according to the present invention.

7 is a detailed structural diagram of a security level field assigned to an i-node of an executable file which is one of objects.

Compulsory object access control method according to the multi-level security method according to the present invention for achieving the above technical problem, the progress of the following steps. First, (a) the system security manager allows the security field and category information of the object to be included in the reserved field of the i-node of the object, and the user's security permission level and category information is databased for authentication. Then, (b) a user of the Unix-like OS enters user information including security permission level and category information upon login and authenticates the user using the database. Subsequently, (c) a field is assigned to the task structure of the process subject to store the security permission level and category information of the user, and the security permission level and category information is inherited to the task structure of the child process. In the present invention, when the subject accesses the object, the security permission level and category information of the subject contained in the task structure and the security level and category information of the object contained in the i-node are compared with each other according to the BLP security model modified in kernel mode. To force the subject's access to the object.

In the present invention, the security level and category information of the object is preferably contained separately in two fields of the reserved field of the i-node.

In the present invention, the security permission level and category of the subject is preferably separately recorded in two fields allocated to the task structure of the process subject.

In the present invention, it is preferable that a field containing the security permission level of the subject and a field containing the security level of the object include a security level indicating unit having a predetermined number of bits.

In the present invention, the step (c), when creating a swapper that performs the scheduling function when loading the kernel image, to ensure a storage space in the task structure to store the security permission level and category information of the subject step; Storing the security permission level and category information received from the user in the storage space; And when a process is created by using a fork or clone method, the task structure of each process may automatically secure a storage space for the user's security permission level and category information. The storage space preferably includes a step of copying and inheriting the security permission level and category information of the user.

In the present invention, the object is an executable file, and a field for storing security level information of the object may include an executable file display unit having a predetermined number of bits indicating that the object is an executable file.

In the present invention, when a legitimate user having the execution permission bit permission executes the executable file, the kernel permits reading regardless of the security information of the object and executes the security file with the security level and category information that the object has, and converts it into a process subject. Can be.

In the present invention, when a user having a right permission with the execution permission bit right executes the executable file, the object is converted into a process subject, and the security level and category information of the executable file is stored in the task of the process subject. It can be copied to any field area assigned to the structure.

In the present invention, the executable file is an executable file associated with a web service, and the executable file converted into a process subject may access a web home page and a related content file based on the modified BLP security model.

In the present invention, the executable file is an executable file that is converted from an object to a process subject to access the object, and the executable file that is converted to the process subject may access the object based on the modified BLP security model.

The computer-readable recording medium according to the present invention for achieving the above technical problem, (a) allows the system security administrator to record the security level and category information of the object in the reserved field of the object i-node A program module for databaseing the security permission level and category information of the user for authentication; (b) a program module for allowing a user of a UNIX-based OS to input user information including security permission level and category information upon login and authenticating a user using the database; (c) a program module for allocating a predetermined number of fields in the task structure of the process subject and for storing the security permission level and category information of the user; (d) a program module for allowing the security permission level and category information to be inherited in a task structure of all child processes created by a user after logging in; And (e) a program module that enables the subject to determine access rights according to the modified BLP model when the subject accesses the object.

In the present invention, the modules (c) and (d) may store the security permission level and category information received from the user in the task structure in the step of creating a swapper that performs a scheduling function when loading a kernel image in a Unix system. A program module for assigning a predetermined number of fields to the task structure; And a program module for storing the security permission level and category information of the user in a predetermined number of fields automatically assigned to the task structure of all processes generated by using fork and clone methods. Can be.

Hereinafter, the modified BLP model employed by the present invention will be described in detail, and then the preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the preferred embodiments of the present invention described below are not intended to limit the technical scope of the present invention, but are intended to explain the present invention more clearly and easily to those skilled in the art. . Like reference numerals in the drawings refer to like elements.

In the BLP model applied to the mandatory object access control method according to the multi-class security method according to the present invention, whether the subject can read (execute), write (write, create, append, delete) the object. In order to determine whether or not to determine whether or not to.

(1) The subject is granted read (execute) permission on the object only when all of the following conditions are met.

Condition 1: The subject's security level is equal to or higher than the object's security level

Condition 2: The subject's category dominates (includes) the category of the object

Here, the security permission level or security level refers to the level of information such as 0, 1, 2, etc., and the category refers to the category of information such as personnel, logistics, administration.

If the above conditions 1 and 2 are granted, the subject has read permission on an object having a security level lower than its security permission level and a category that is included in its category. In addition, an object that has a higher security level than its security permission level or that is not included in its category cannot have a read permission.

(2) The subject has write (execute) permission on the object only when all of the following conditions are met.

Condition 3: The subject's security clearance is the same as the object's security

Condition 4: The object's category is the same as the subject's category

Given the above conditions 3 and 4, the subject cannot have the authority to create, modify, or delete an object with a security level lower than or higher than the subject's security permission level. Only in the same case will the subject be able to create, modify, or delete objects.

In order to implement a mandatory object access control method using a multi-class security method according to the modified BLP model as described above, in the present invention, a task structure of a process subject is added to the subject to add security permission level and category information to the subject. I-node of the object is adopted as a target to add security level and category information to the object.

Specifically, in the present invention, in the present invention, two fields (clearance and category; 20 and 30) for the recording of multi-level security information are further added to the task structure 10 defined in the UNIX OS according to the prior art. Use by definition. The detailed configuration of the security permission level field 20 among the two fields added to the task structure 10 according to the present invention is as shown in FIG. 2, and the detailed configuration of the category information field is shown in FIG. 3.

Referring to Fig. 2, the security permission level field 20 is configured to include a security permission level pay 40 of the subject. If necessary, the security permission level field 20 may be configured to include a reservation unit 50, an executable file display unit 60, an encryption flag 70, and the like. In the case of Fig. 2 showing the security clearance class field 20 according to the embodiment of the present invention, a total number of bits is allocated to 32 bits, of which 8 bits have been used for the recording of the security clearance level; 22 bits are reserved for other use; 1 bit of it was used for the encryption flag; One bit of it is used to indicate that it is an executable file. As such, when 8 bits are used for the inclusion of security permission levels, 256 levels can be assigned to process subjects. Of course, the total number of bits constituting the security permission level field 20 and the bits constituting the security permission level recording part 40, the reservation part 50, the executable file display part 60, and the encryption flag 70 which are its components The number is changeable. In configuring the security permission level field 20, the number of bits for the executable file display unit 60 or the encryption flag 70 may not be allocated in some cases. For example, the encryption flag 70 may not be used when the subject.

Referring to FIG. 3, the category information field 30 is configured to include a category display unit 80. In Fig. 4 showing an embodiment according to the present invention, the category information field 30 is allocated to 32 bits, and all the bits are used as the category display unit 80. However, the total number of bits of the category information field 30 and the number of bits of the category display unit 80 included therein may be changed as necessary.

In the present invention, the category information of the subject is given to the category information field 30 by setting the category information possessed by the subject to a bit at a predetermined position corresponding thereto. For example, if the category information of the subject is AB, 1 may be set to a specific bit unit corresponding to A and B. Therefore, if several bits in the category display section are set to 1, the subject has a plurality of category information as many as the number of bits set to one. This category information display method allows a subject to have as many categories as the number of bits allocated to the category display unit 80. In the case of the category information field 30 shown in FIG. 3, since all 32 bits are reserved and used by the category display unit 80, the subject may have up to 32 categories.

In the present invention, in order to apply the modified BLP model, the security level and category information is added to the i-node of the object corresponding to the granting of the security permission level and category information of the subject as described above.

Specifically, referring to FIG. 4, in the case of a Unix-based OS, an object is largely composed of a regular file, a directory, and a device file, which is a special file. These objects have one i-node 90 in the file system. In the present invention, two fields of the reserved fields of the i-node 90 are newly renewed for recording the security level and category information of the object. By assigning (see 100 and 110), it is used for the recording of the security level and category information of the object.

Specifically, in the embodiment of the present invention, two reserved fields are allocated to the last part of the i-node 90 (see 100 and 110), and the number of bits of each field is allocated to 32 bits, and the left side 100 of the i-node 90 is allocated. In order to record the security level of the object, the right side 110 is used to record the category information of the object. Of course, the total number of bits of the two fields (see 100 and 110) used for the recording of the security level and category information on the object and the relative position between these fields may vary depending on the case.

The detailed configuration of the two fields (see 100 and 110) assigned to the i-node 90 to store the security level and category information of the object described above is shown in the task structure (FIG. 1). Is substantially the same as that of the field (see FIGS. 2 and 3). Accordingly, the detailed configuration of the security class and category information recording fields (see 100 and 110) of the object allocated to the i-node 90 is detailed in the security permission class field and the category field of the subject shown in FIGS. See configuration. Therefore, when 8 bits are allocated to include the security level of the object in the security level field 100 of the i-node 90, up to 256 security levels may be assigned to the object. When 32 bits are allocated to include category information of an object in the category information field 110 of the i-node 90, up to 32 categories may be assigned to the object. As such, adding security level and category information to the i-node 90 may be performed by the system security manager.

However, in the case of the security level field 100 of the i-node 90, one bit may be allocated to the most significant bit (MSB), which is an encryption flag, to indicate that the object is an encrypted file. For example, if the encryption flag MSB is set to 1, this means that the object is an encrypted file.

After the security information and category information are added to the subject and the object according to the present invention as described above, in the present invention, the security permission level and category information of the subject is continuously inherited from the parent process of the subject to the child process. Implement a mandatory object access control method.

Specifically, referring to FIG. 5, a user who intends to use the system performs a process through login 120. According to the present invention, in addition to inputting a user ID and password for the login 120, the user has security permission level and category information (hereinafter, referred to as "security permission information of the current subject) within a range authorized for the user logging in 120. You can additionally enter "." Here, the security permission level refers to the level of information such as 0, 1, 2, etc., the category refers to the category of information, such as personnel, logistics, administration.

As described above, when the user inputs ID, password, and security permission information into the system, the general password authentication step of the Unix OS is performed based on the user ID and password, and an authentication process for multi-level security is performed in addition thereto. do. That is, the system security manager searches the user security permission information database registered by the system security manager in advance, and checks whether the security permission information of the registered user matches the security permission information entered by the user at the time of login, thereby authenticating the authentication for multi-level security. It is finished.

The security permission class and category information of the authenticated user is then copied into two fields 130, 140 and 150 in the corresponding task_struct of the system user. A user who logs in to the system 120 executes a child process such as a login user shell 180 or a cell command 190 through fork system calls (fork ()) 160 and 170 to execute another program. At this time, the security permission level and category information owned by the user is copied to the child process as it is, inheritance 200 is made (the specific mechanism of inheritance will be described later). In addition, the inheritance of the security permission information is repeated in subsequent execution of the child process, so that the security permission information of the parent process is continuously reflected to the child process. Thus, even if a lower level child process accesses (230, 240 and 250) a security class object through the file table 210 and the i-node table 220, it has the same security permission information as the parent process. It becomes accessible.

When a subject having security permission information 130, 140, and 150 in a task structure accesses an object having a security level, the open () system call routine in the kernel is executed in the UNIX OS. The security permission level and category information of the subject process that wants to use a specific object in this routine is obtained from the task structure, and the security level and category of the specific object are obtained from the i-node of the object. Then, using the modified BLP model described above using the subject and object security information and category information, the subject can read, execute, write (create, append, delete) the object. You can check whether you can.

In other words, if a subject accesses an object with a category that contains a security level lower than its security permission level, it grants read permission, and has a category that has a level higher or higher than its security permission level. Accessing an object does not grant read permission. In addition, if a subject attempts to create, modify, or delete an object with a security level lower than or higher than its own security level, it does not grant the right, and only if the security level and category of the object are the same as the security permission information of the subject. Grants permission to create, modify, and delete objects.

Hereinafter, the process of creating a process according to the present invention when the user logs in to the system and how security permission information of the subject process can be inherited by the child process will be described in more detail.

In detail, referring to FIG. 6, first, a swapper having a scheduling function when a kernel image is loaded is generated (step S0), which has pid 0. This swapper creates an init process (step S1) and finishes the kernel image loading process. The init process manages all processes with one pid, and creates a getty process when logging in an internal user and a tty process when logging in an external user (telnet user) (step S2). User authentication is performed through the login id and the password (step S3).

Unix-like operating systems use forks or clones to create all processes, so if you have enough storage space for the data you need during the swapper creation step (S0 step), all subsequent processes are automatically created. You have this space. As described above, in the present invention, two fields are allocated to the task structure of the subject process as the storage space. Therefore, by using the above characteristics of the Unix-like OS, the security-related matters that a subject can have can be stored in a field of a task structure, and the security-related matters can be inherited by subsequent processes.

According to the present invention, the security permission level and category among the security-related fields assigned to the task structure are filled in from the user who logs in (step S4). The security permission level and category of the user may be obtained by a direct input method or an indirect input method through a smart card when the user logs in to the system, and the obtained security-related information is transmitted to the kernel through a system call (step S5). The kernel then assigns the security-related fields of the authentication process (step S6). Then, a user shell (step S7) and processes (step S8) are created.

The information inserted into the security-related fields becomes the security information of the subject and becomes a criterion for determining the access right based on the modified BLP model when the subject accesses the object. Accordingly, unless the security information of the subject and the object satisfies the condition based on the modified BLP model, the subject's access to the object is forcibly blocked in kernel mode.

The following describes in detail how access control to the data file is performed in the kernel mode in the process of applying the technical idea according to the present invention when the data file is to be accessed after the execution file, which is one of the objects, is converted to the subject. . For convenience of description, the executable file and the data file will be exemplified by daemons such as inetd and httpd, and web-related data files such as index.html. Of course, the executable file and the data file are not limited to the above examples, and it is natural to those skilled in the art to which the present invention pertains.

Specifically, referring to FIG. 7, for an executable file which is one of the objects, for example, a web-related executable file, a predetermined area of the security level field 260 assigned to the i-node of the object is allocated to the executable file display unit 270. Can be. For example, as shown in FIG. 7, the 26th bit of the security information field allocated to the size of 32 bits may be allocated to the execution file display unit 270 and set to 1 to indicate that the web-related execution file is the same. Looking at the implementation process of the mandatory object access control method according to the present invention based on this as follows.

When the system loads daemons such as inetd and httpd for web services into memory as an executable from the kernel, it checks the 26th bit of the security level field of this object in the save file state. Recognizes it as an associated executable, permits reads, turns it into a process, and turns objects into subjects. Of course, the modified BLP security model according to the present invention is applied when the subject accesses the web-related executable file. At this time, copy the security level and category information attached to the object into the security permission level field and category field assigned to the task structure of the process converted to the subject. Then, if the process (inetd, httpd, etc.) converted to the subject meets the conditions according to the modified BLP security model, web-related objects can be accessed (read, write, etc.) without any restrictions. On the other hand, if this approach is adopted, the requirement that the root should be readable when the Web daemon process first starts is met.

In the case of web content, the system security administrator assigns the security level and category to web-related objects such as index.html and the same security permission level and category for the daemon (inetd, httpd, etc.) process that accesses it. Even root can't access objects related to web services unless it meets the conditions imposed by the modified BLP model. Therefore, the home page associated with the web service and the content file associated with the web service can be illegally blocked in kernel mode.

The mandatory object access control method based on the multiple security level method according to the present invention described above may be programmed and stored in a computer-readable recording medium. The recording medium may include a program module as follows.

A program module for allowing a system security administrator to include the security level and category information of the object in a reserved field of the i-node of the object, and to database the security permission level and category information of the user for authentication;

A program module for allowing a user of a UNIX-based OS to input user information including security permission level and category information upon login and authenticating a user using the database;

A program module for authenticating a user based on the user information;

A program module for assigning a predetermined number of fields to the task structure of the process subject and for storing the security permission level and category information of the user;

A program module for allowing the security permission level and category information to be inherited in the task structure of all child processes created after the user logs in;

⑥ Program module that allows subject to determine access authority according to modified BLP model when object accesses.

The program modules ④ and ⑤ may include the following subprogram modules.

Ⓐ Program module to assign a certain number of fields to task structure so that security permission level and category information input from user can be saved in task structure in swapper generation step that schedules kernel image loading in Unix system. ;

A program module that allows a user to store security clearance levels and category information in a predetermined number of fields that are automatically assigned to the task structure of all processes created using fork and clone methods.

In the above described with reference to the accompanying drawings, preferred embodiments of the present invention; However, the technical idea according to the present invention can be variously modified or improved by those skilled in the art.

According to an aspect of the present invention, a user who does not have a conventional security level or a user who does not meet the security level arbitrarily accesses a file, a directory, or a device having a security level to read, write, and execute the modified BLP model. Based on this, it can be blocked natively in kernel mode.

According to another aspect of the present invention, even if the system root in the conventional UNIX-based OS, it is possible to prevent the problem of randomly accessing the security information file of another user.

According to another aspect of the present invention, it is possible to prevent unauthorized tampering with a data file such as a web home page or web content from hackers using a malicious user such as a root.

Claims (12)

(a) causing the system security manager to include the security level and category information of the object in a reserved field of the i-node of the object, and to database the security permission level and category information of the user for authentication; (b) allowing a user of a UNIX-based OS to input user information including security permission level and category information upon login and authenticating the user using the database; (c) assigning a field to a task structure of a process subject generated by the user who has been authenticated in step (b) and storing the security permission level and category information of the user; and the security permission level and category in the task structure of the child process. Copying and inheriting information; And (d) When the subject accesses the object, the security class and category information contained in the i-node of the object and the security class and category information contained in the task structure of the subject are compared with each other, and according to the modified BLP model, Compulsory object access control method based on a multi-level security method comprising the step of determining the access authority of the subject in kernel mode. The method of claim 1, The security level and category information of the object are separately recorded in two fields of the reserved fields of the i-node, respectively. The method of claim 1, And a security permission level and a category of the subject are separately included in two fields assigned to a task structure of a process subject, respectively. [4] The multi-class security method of claim 2 or 3, wherein the field in which the subject's security permission level is stored and the field in which the object's security level is stored include a security level indicator having a predetermined number of bits. Based on mandatory object access control method. The method of claim 1, wherein step (c) comprises: (c1) securing a storage space in the task structure for storing a security permission level and category information of a subject when generating a swapper that performs a scheduling function when loading a kernel image; (c2) storing the security permission level and category information received from the user in the storage space; And (c3) When creating all processes using fork or clone method, make sure that the task structure of each process secures storage space for the user's security permission level and category information. And a method of copying and inheriting the security permission level and category information of the user in the stored storage space. The method of claim 1, The object is an executable file, And a field for storing security level information of the object includes an execution file display unit having a predetermined number of bits indicating that the object is an executable file. The method of claim 6, When a legitimate user having an execution permission bit permission executes the executable file, the kernel permits reading regardless of the security information of the object, and executes with the security level and category information that the object has and converts it to a process subject. Mandatory object access control method based on multi-class security method. The method of claim 7, wherein When a user with a right permission having the execute permission bit right executes the executable file, the object is converted into a process subject, and the security level and category information held by the executable file is assigned to the task structure of the process subject. Mandatory object access control method based on the multi-class security method, characterized in that copied to the field area of. The method of claim 7, wherein The executable file is an executable file associated with a web service, and the executable file converted into a process subject accesses a web home page and a related content file based on a modified BLP security model. Mandatory object access control. The method of claim 7, wherein The executable file is an executable file that is converted from an object to a process subject to access the object, Execution file converted to a process subject accesses the object based on the modified BLP security model. (a) A program module that enables the system security administrator to include the security level and category information of the object in the reserved field of the i-node of the object, and to database the security permission level and category information of the user for authentication. ; (b) a program module for allowing a user of a UNIX-based OS to input user information including security permission level and category information upon login and authenticating a user using the database; (c) a program module for allocating a predetermined number of fields in the task structure of the process subject and for storing the security permission level and category information of the user; (d) a program module for copying and inheriting the security permission level and category information to a task structure of all child processes created by a user after logging in; And (e) a computer-readable recording medium containing a program module for allowing a subject to determine an access right according to a modified BLP model when an object accesses an object. The method of claim 11, wherein the (c) and (d) module, A program module for allocating a predetermined number of fields to a task structure such that a security permission level and category information input from a user can be stored in a task structure in a swapper generation step of scheduling a kernel image in a UNIX system; A program module including a program module for storing a user's security permission level and category information in a predetermined number of fields automatically assigned to a task structure of all processes generated by using a fork and a clone method. Computer-readable recording medium, characterized in that the recorded.