KR100772455B1 - Dac strengthening apparatus and method for controlling classification and execution of process - Google Patents

Abstract

The present invention relates to an apparatus and method for classifying / executing a process for strengthening a DAC. The present invention relates to CUS, which is a group of programs whose system commands, utilities, and safety have been proven. The group is divided into DVO group, which is a group of discretionary programs created by internal users, known vulnerable programs, and service programs that are run when an external user connects, and the DVO group member process entity is a CUS group member. In order to prevent the elevation of privileges that can occur by executing a program, the program can be composed of an application program manager that can classify and manage executable objects, an execution process manager, an execution object manager, and a process execution control part of the kernel level. To ensure the operability of the existing DAC system. In addition, it can be used to develop a secure system by reducing the threat of system exploitation due to an attack such as a buffer overflow.

DAC, Process Management, Execution Object Management, Process Execution Control

Description

DAC STRENGTHENING APPARATUS AND METHOD FOR CONTROLLING CLASSIFICATION AND EXECUTION OF PROCESS}

1 illustrates an elevation of privilege attack due to a lack of inter-process relationships in a traditional DAC system.

2 shows an overview of a DAC enhancement system;

3 is a diagram illustrating execution access permission / disallow relationship between executable objects;

4 is a screen showing the operation of the DAC enhancement system.

<Explanation of symbols for main parts of the drawings>

1: CUS group 2: DVO group

3: program group management program 4: Linux kernel

5: Kernel Module 51: Program Classification Executive

52: process execution control unit 53: process management unit

54: execution object management unit 6: the system call interface

7: running object store

The present invention relates to a process classification / execution control apparatus and method for DAC enhancement, and more particularly, to classify executable objects into two groups in order to enhance security of a discretionary access control (DAC) system. The present invention relates to a process classification / execution control apparatus and method for strengthening a DAC that blocks an elevation attack by a malicious process by controlling a process subject to access (execute) an executable object.

The access control scheme of existing Linux systems employs discretionary access control (DAC) policies. Discretionary access control policies restrict access to objects based on the identity of the subject or groups to which they belong. In this way, the identity of the subject is very important, so if the action is performed using the identity of another subject, the DAC may be destroyed. In addition, attack cases that gain root privileges by exploiting vulnerable programs show that the DAC policy is invalid when the program is executed.

As such, traditional discretionary access control restricts access to objects based on the identity of the subject or groups to which they belong. That is, access control is arbitrarily performed by the owner of the object. The following faults are inherently inherited from discretionary access control policies.

■ In the nature of the DAC, access is based entirely on the identity of the subject, so the mechanism has no knowledge of the meaning of the data (object) and does not determine access permissions based on it.

■ As such, ID is so important that if the action can be done using another subject's ID, the DAC is out of control.

■ Generally vulnerable to Trojan horse attacks.

1 is a diagram illustrating an elevation of privilege attack due to the absence of a relationship between processes in a conventional DAC system.

As an example of a typical attack in which a DAC system is destroyed, as shown in FIG. 1, a malicious user performs an elevation attack of a root shell using a buffer overflow (BOF) vulnerability of a web server such as Apache. Can be mentioned. This is because the flow of execution between the Apache executable object program and the shell executable object program is based solely on the identity of the execution subject. In other words, there is no definition of any relationship to execution between programs. Attacks such as Trojans also occur because the access control policy by identity is reflected and the knowledge of the meaning of the program does not exist in the traditional DAC.

Accordingly, the present invention has been made to solve the above-mentioned problems of the prior art, and an object of the present invention is to program programs that can be executed in a system, and to show system commands, utilities, and safety. The CUS group, which is a group of users, is divided into DVO group, which is a group of service programs that are created by discretionary users, known vulnerable programs, and external users when connected, and the DVO group member process subject. The present invention provides an apparatus and method for controlling process classification / execution for strengthening a DAC that can block an elevation of privilege that can occur by executing a CUS group member program.

An apparatus for classifying / executing a process for strengthening DAC of the present invention for achieving the above object includes an application stage including a program group management program for requesting a program classification task for objects classified into a CUS group and a DVO group; In response to a request of the program group management program, a classification of a CUS group and a DVO group is performed, and a group of executable programs is maintained in kernel memory while maintaining information consistent with information of a group of processes running in a system and an execution object store. A kernel module for linking information to control program execution; And an execution object store for dividing and storing the CUS group or the DVO group.

On the other hand, the process classification / execution control method for the DAC strengthening of the present invention, in response to the request of the program group management program, the program classification execution unit classifying the CUS group and the DVO group and stores in the execution object store; When the user accesses the execution object by the user process, the process execution control unit hooks the system call execve to inquire the currently executing process group information through the process management interface, and the group information of the program attempting to access through the execution object management interface. Querying; And denying execution access if the group information of the process subject is DVO and the group information of the execution object is CUS.

As such, the present invention controls the elevation of privilege resulting from malicious execution access to executable objects to ensure the safe execution of programs. In order to achieve the above object, executable objects are classified into two groups according to the following classification criteria.

■ CUS Group

-System command commonly used by internal users

(E.g. / bin / bash, id, etc.)

System utilities commonly used by internal users

(E.g. vi, gzip, etc.)

-Program whose safety has been certified by the administrator

(Example) nessus, etc.

■ DVO Group

-Program created by internal users arbitrarily

Known Vulnerable and Hacking Programs

(Eg) fingerd, etc.

-Service program driven when an external user connects

(E.g. httpd, sendmail, etc.)

Hereinafter, an apparatus and method for classifying / executing a process for enhancing DAC of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is a diagram illustrating an outline of a DAC enhancement system, and FIG. 3 is a diagram illustrating execution access permission / disallow relationship between executable objects.

As shown in FIG. 2, the CUS group 1, the DVO group 2, and the program group management program 3 are located in the application stage, and the kernel module 5 is located between the application stage and the Linux kernel 4. Done. The kernel module 5 and the application end are interfaced through a system call interface 6, and the kernel module 5 stores an execution object store divided into a CUS group 1 or a DVO group 2. (7) is connected.

Execution objects (CUS group (1), DVO group (2)) classified by the classification policy described above are substantially the program classification execution unit 51 of the kernel module 5 by the program group management program 3 of the application stage. You will be asked to classify your program. The program classification execution unit 51 divides and stores the execution object programs into the CUS group 1 or the DVO group 2 in the execution object store 7. The executable objects of the CUS group 1 are mainly commands and programs used by internal users, and programs that have proven utility or safety, and the executable objects of the DVO group 2 are mainly programs that provide services for access of external users. It consists of known vulnerable programs. Considering the recent type of hacking attack exploiting a root shell by exploiting a vulnerability such as a web daemon or an internal program's buffer overflow, the root shell should not be allowed to execute by vulnerable programs.

In addition, the process execution control unit 52 is a kernel module that controls program execution by the process shown in FIG. 3. That is, the process execution control unit 52 cooperates with the process management unit 53 and the execution object management unit 54 to determine whether to allow or deny execution access. The process manager 53 is configured with an interface for inquiring and modifying group (CUS (Pc) or DVO (Pd)) information of processes running in the system. Execution object management unit 54 is an interface for querying and modifying information of a group of executable programs (CUS (Pc) or DVO (Pd)) while maintaining information consistent with the information of the execution object store 7 in kernel memory. consist of.

As shown in FIG. 3, when the execution process makes an execution access to the executable object, the access process is allowed or denied. Execution of programs (P ₁ , P ₂ , Pi) of the CUS group (1) by the process of the DVO group (2), which executes services for vulnerabilities or external users, is not allowed.

4 is a screen showing the operation of the DAC enhancement system.

As shown in Figure 4, the system shows how the system works internally the moment a user process accesses an execution object. The process execution control unit 52 hooks the system call execve to inquire process group information currently running through the process management unit 53 interface, and retrieves group information of a program attempting to access through the execution object management unit 54 interface. do. Execution access is denied if the group information of the process subject is DVO (2) and the group information of the execution object is CUS (1). At this time, the running processes in the system are maintained in the kernel memory in the form of a linked list, and the execution objects are also maintained in the kernel memory in synchronization with the information in the execution object storage.

Although the present invention has been described in more detail with reference to some embodiments, the present invention is not necessarily limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.

As described above, the apparatus and method for classifying / executing a process for strengthening DAC according to the present invention provides a group information to execution objects, and defines and controls their execution relations to solve the vulnerability of a program frequently occurring recently. It can be used to develop a safe system by blocking abuse of privilege elevation attacks.

Claims (8)

An application stage including a program group management program for requesting a program classification task for an object classified into a CUS group, which is a group of programs whose stability is proven, and a DVO group, which is a group of service programs driven when an external user is accessed; In response to a request of the program group management program, the CUS group and the DVO group are classified, and the executable program is maintained in kernel memory while maintaining information consistent with information of a group of processes running in the system and an execution object store. Kernel module for controlling the program execution by linking the group information; And A process classification / execution control apparatus for strengthening a DAC, comprising: an execution object store for dividing and executing execution object programs into a CUS group or a DVO group. The method of claim 1, wherein the kernel module, And a program classification execution unit for dividing and storing the execution object programs into a CUS group or a DVO group in the execution object store. The method of claim 1, wherein the kernel module, A process manager for querying and modifying group information of processes running in the system; An execution object manager for querying and modifying group information of executable programs while maintaining information consistent with the information of the execution object store on kernel memory; And Process execution control unit for determining whether to allow or disallow execution access in connection with the process management unit and the execution object management unit Process classification / execution control device for enhancing the DAC, characterized in that comprises a. When the user accesses the execution object by the user process, the process execution control unit hooks the system call execve to inquire the currently executing process group information through the process management interface, and the group information of the program attempting to access through the execution object management interface. A first step of querying; And The currently running process group information belongs to a DVO group, which is a group of service programs driven when an external user accesses, and the program group information attempting to access through the execution object manager interface is a group of programs whose stability has been proven in the system. Step 2 to deny execution access if it is a CUS group Process classification / execution control method for enhancing the DAC, characterized in that comprises a. The method of claim 4, wherein before the first step, And classifying the CUS group and the DVO group and storing the CUS group and the DVO group in an execution object store in response to a request of a program group management program. 5. The method of claim 4, wherein in the second step The running processes in the system are maintained in kernel memory in the form of a linked list, and the execution objects are maintained in the kernel memory while synchronizing with the information of the execution object storage. The method according to any one of claims 4 to 6, wherein the CUS group is Process classification / execution control method for strengthening DAC, including system commands commonly used by internal users, system utilities commonly used by internal users, and programs certified by the administrator to prove safety . The method according to any one of claims 4 to 6, wherein the DVO group is Process classification / execution control for DAC enhancement, which includes discretionary programs created by internal users, known vulnerable programs and hacking programs, and service programs that are run when an external user connects. Way.

Images