KR100853723B1 - Method for illegal privilege flow prevention and mandatory access control using the state transition model of security role in window system - Google Patents

Abstract

The present invention relates to a method of expressing a state transition of a process in a Windows system kernel as a security role state transition model to block illegal authority movement and enforce mandatory access control in connection with a security role.

The present invention provides a security kernel system for protecting a system from various hackings that may occur due to a security flaw of a computer operating system. Block it to prevent hacking and misuse. In addition, by performing the access control function according to the security role status, the unnecessary policy comparison is filtered in advance, and the mandatory access control function using the security level and security category information for the authorized process reduces the system load.

Security Kernel, Mandatory Access Control, Hacking, Security Attributes, Security Role, Security Level

Description

Method and system for preventing and compulsory illegal transfer of rights using the security role state transition model of the system.

1 is a block diagram of an overall system for implementing illegal access control and mandatory access control using a security role state transition model of the Windows system of the present invention.

2 is a flowchart illustrating a method for blocking illegal rights movement and forcibly accessing a control system using a security role state transition model of the Windows system of the present invention.

3 is a security role defined in the user and file system.

4 is a configuration diagram of a file system security attribute table.

5 is a security role state transition model.

6 is a diagram illustrating a process security attribute table.

7 is a state of a security role of a process of a process security attribute table.

8 is an access control policy according to a security role.

* Description of the main parts of the drawings *

101: user security attribute setting unit 102: file system security attribute setting unit

103: system call control unit 104: security role state transition setting and control unit

105: security role access control unit 106: mandatory access control unit

107: User Security Attributes DB 108: Process Security Attributes Table

109: File System Security Attributes Table

The present invention expresses the state transition of a process in a security role state transition model in the Windows system to block illegal authority movement and to provide a compulsory access control function in conjunction with the security role. Mobility blocking and mandatory access control methods.

In the case of access control applied to the existing Windows-based operating system, the file system owner sets permission bits to grant read, write, and execute rights to users, groups, and other users. Allows you to change the permission bits arbitrarily for user-owned files.

In general Windows system, it is difficult to apply consistent security policy to system because user can adjust permission bits arbitrarily, and it is difficult to apply enhanced security policy by classifying important files by class.

In addition, since administrator authority has the highest authority in the system, it cannot be controlled even if misuse occurs.

Accordingly, there are security kernel systems to which a mandatory access control policy is applied to enhance the security of the general-purpose Windows system.

In mandatory access control, security level and security category are assigned to users and file systems, and forced read and write rules are applied using BLP model.

Most secure operating systems adopt a multi-level policy (MLP), which operates by assigning security levels to subjects and objects. The BLP (Bell and Lapadula) model is the highest level in the government classified classification environment. It is a proven representative mathematical model that expresses multistate rating policies that restrict information from flowing to lower levels.

However, secure operating systems using the BLP model inherit the user's security level into the process. The problem with this approach is that the process is not entirely reliable. In other words, if the user's security level and permission range are inherited by a malicious process in which the error is inherent or intentionally modified, the system safety may be destroyed. This is because the BLP model simply defines the identity of the system user and the process that actually handles the access.

When enforced access control is applied to classify important files by class, it provides enhanced security policy and can classify users in administrator status and control authority. However, forced access control is a file system access control. It is difficult to prevent illegal rights transfer. That is, it is possible to destroy the system area environments to which the mandatory access control policy is not applied with the authority obtained illegally by hacking.

An object of the present invention for solving the above problems is to set and modify security attributes, such as security role, security level, security category for the user and file system to protect the system from hacking and system misuse in the Windows-based operating system It is to provide illegal access control and mandatory access control method using security role state transition model of Windows system that enforces access control at kernel level by applying MLS (Multi-Level Security) policy.

Another object of the present invention is to provide an illegal property using a security role state transition model of a Windows system that can grant a security attribute when a user acquires an authority through a user login, adjust a security role state when a new process occurs, and inherit the security attribute. It is to provide a mobility blocking and mandatory access control method.

In addition, another object of the present invention, by expressing the user's security role in the security role state based on the process owner state, and only allow the transfer of authority defined in the security role state transition model to block the takeover of illegal administrator authority due to hacking, etc. By providing a security role state transition model of the Windows system to protect the system, it provides a method of blocking illegal rights movement and mandatory access control.

In addition, another object of the present invention is to reduce the system load by performing an access control function according to the security role status in advance to filter out unnecessary policy comparisons and to perform a forced access control function using the remaining information for the authorized process. It is to provide illegal access control and mandatory access control method using security role state transition model of Windows system.

As described above, in the method of maintaining security using the security kernel of the Windows operating system, the user security attribute setting unit 101 sets, changes, or deletes the security attributes of the user, and the set security attributes are the user of the kernel. Storing in the security attribute DB (107); A file system security attribute setting unit 102 setting, changing, and deleting a file system security attribute, and constructing and storing a file system security attribute table 109 configured as the file system security attribute in a kernel; If an application event is performed in the system to generate a system call, the system call controller 103 intercepts only the access control-related system call and bypasses the remaining system call; The security role state transition setting and control unit 104 constructs a process security attribute table including the process security role state by using the user security attribute DB 107 according to the occurrence of a process that is the subject of the intercepted system call. Wow; The security role access control unit 105 compares the security role state in the process security attribute table with the security role in the file system security attribute table to determine only one of permission, denial, and comparison, and enforces only the event determined by the comparison. Delivering to an access control unit; Compulsory access control unit 106 is configured to apply the mandatory access control policy using the security level and security category information of the remaining security roles of the subject and the object and to call the original system call, the security kernel is a normal Convert process state transition to security role state transition model and perform access control function according to security role state to filter out unnecessary policy comparisons in advance and enforce mandatory access control function using security level and security category information for authorized process. It is achieved by blocking illegal permission movement and mandatory access control method using security role state transition model of Windows system.

Hereinafter, a method and a system for preventing illegal rights movement and forced access control using a security role state transition model of the Windows system of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating the entire system for implementing illegal rights movement blocking and mandatory access control using a security role state transition model of the Windows system of the present invention, and FIG. 2 is a view illustrating a security role state transition model of the Windows system of the present invention. This is a complete flow chart of illegal rights movement blocking and mandatory access control methods.

3 is a security role defined in a user and a file system, and FIG. 4 is a diagram of a file system security attribute table configuration.

In addition, Figure 5 is a security role state transition model, Figure 6 is a process security attribute table configuration diagram.

7 is a security role state of a process of the process security attribute table, and FIG. 8 is an access control policy according to the security role.

In order to achieve the above technical problem, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Windows system according to the present invention includes a user security attribute setting unit 101, a file system security attribute setting unit 102, System call control unit 103, security role state transition setting and control unit 104, security role access control unit 105, and compulsory access control unit 106 is configured.

1 is an overall system configuration diagram for performing an illegal rights movement blocking and mandatory access control system using the security role state transition model of the Windows system of the present invention.

The user security attribute setting unit 101 sets, changes, and deletes the security attributes of the user and stores the set security attributes in the user security attributes DB 107 of the kernel.

Here, the user security role, which is one of the user security attributes DB 107, may be a security manager 301, a system administrator 302, a security user 303, or a general user 304 according to a system administration job and a need for root authority. Separated by.

The security manager 301 is defined as a security administrator authorized as a user who performs the top-level administrator role among several users who have obtained administrator authority.

The system administrator 302 is defined as an authorized system administrator who needs administrator authority for service and system management.

The security user 303 is defined as a user who is granted security attributes (security level, security category) and does not require general user authority to handle important data.

The general user 304 is defined as a Windows user with general user rights without being granted security attributes.

The file system security attribute setting unit 102 sets, changes, and deletes a file system security attribute, configures a file system security attribute table 109, and stores the file system security attribute table 109 in the kernel.

The file system security attribute table 109 includes four fields: a security role field 401, a control field 402, a security level field 403, and a security category field 404.

The security role field 401 stores a security role (security manager, system administrator, security user, general user) information about the file system, the control field 402 is a file applied to an exceptional access control policy Used to represent a system.

The security level and security category fields 403 and 404 store security category information that is configured under the file system security level and security role.

The system call control unit 103 filters only system calls for the corresponding file system and process when an application event is performed in a Windows system and a system call occurs.

The security role state transition setting and control unit 104 configures the process security attribute table 108 by using the information of the user security attribute DB 107 when a new process occurs.

The process security attribute table 108 includes four fields, such as a security role status field 501, a control field 502, a security level field 503, and a security category field 504.

The security role status field 501 expresses a security role based on user status information of a process.

The control field 502 stores control information used for process control.

The security level and security category fields 503 and 504 store security category information configured under a user security level and a security role.

The security role access control unit 105 compares the security role state in the process security attribute table with the security role in the security attribute table of the file system to determine whether to allow, deny, or compare the event. Only to the mandatory access control unit.

The mandatory access control unit 106 applies a mandatory access control policy using the remaining category information and security level of the security role and calls the original system call.

Figure 2 shows the overall flow chart of the illegal rights movement blocking and mandatory access control method using the security role state transition model in the Windows system in the present invention.

First, (a) the system security manager sets, changes, and deletes the user security attributes in the user security attribute setting unit 101 so that the set security attributes are stored in the user security attributes DB 107 of the kernel.

The security attribute defined by the system security manager in the user security attribute setting unit 101 is configured to include user information, security role, security level, and security category.

In general, the mandatory access control defines a security level and a security category for the user, but in the present invention, the security category is classified as a security role for the user, and then the security category is reconfigured according to the security role.

Therefore, the security role in the present invention is a large category for the security category, and the security category is configured under the security role.

3 illustrates the classification of security roles among user security attributes.

Among the user security attributes, the user security role is divided into a security manager 301, a system administrator 302, a security user 303, and a general user 304 according to the duties of system management and the necessity of administrator authority.

The security administrator 301 is defined as a security administrator authorized as a user who performs the highest root role among several users who have obtained administrator authority.

The system administrator 302 is defined as an authorized system administrator who needs administrator authority for service and system management.

The security user 303 is a user who has been granted security attributes (security level, security category) to handle important data and is defined as a user with general user authority.

The general user 304 is defined as a Windows user with a user right without a security attribute.

(b) The system security manager sets, changes, and deletes file system security attributes in the file system security attribute setting unit 102 and stores a file system security attribute table 109 composed of file system security attributes in the kernel. .

The security attributes of the file system as an object are configured to include security roles, security levels, and security categories.

In general, the mandatory access control defines a security level and a security category for the file system, but in the present invention, the security category is classified as a security role for the file system, and then the security category according to the security role is reconfigured.

Therefore, in the present invention, the security role is a large category for the security category, and the security category is configured under the security role.

The security roles used in the file system are divided into security administrator, system administrator, security user, and general user, and are identical to the security roles defined in the user described above.

4 shows a file system security attribute table structure.

The file system security attribute table consists of four fields: a security role field 401, a control field 402, a security level field 403, and a security category field 404.

The security role field 401 stores a security role (security manager, system administrator, security user, general user) information about the file system, the control field 402 is a file applied to an exceptional access control policy Used to represent a system.

The security level and security category fields 403 and 404 store security category information that is configured under the file system security level and security role.

(c) When an application event is performed in the Windows system and a system call occurs, the system call controller 103 intercepts only the access control related system call and bypasses the remaining system call (201).

In general, when an application is executed by a system or a user, a system call of an operating system occurs and the operating system performs a function requested by the system call. However, the system call control unit 103 of the present invention performs a function related to the present invention among system calls of the operating system. It replaces the system call (related to access control) and calls the system call of the operating system after performing the function of the present invention. In addition, a control system call may be added for security policy and security function environment setting used in the present invention.

(d) The security role state transition setting and control unit 104 configures the process security attribute table 108 by using the user security attribute DB 107 information when a process, which is the subject of the intercepted system call, is generated. The transfer of illegal rights is controlled according to the transition.

The process checks whether the process that is the subject of the system call intercepted by the kernel is a newly created process (202).

All processes have security attributes, and newly created processes do not have security attributes.

Accordingly, in the case of the newly created subprocess, the owner authority of the existing upper process and the newly created subprocess is checked in order to grant the subject's security attribute to the corresponding process (203).

If the owner authority of the parent process and the owner authority of the child process are the same, the security attributes of the parent process are inherited by the child process (204).

If the owner authority of the upper process and the lower process is different, user information is collected (205).

The collection of user information collects the user's login or authorization path, system information about the user, user security attributes, and the like.

Based on the collected user information and security attributes, a security role state transition model is applied to verify whether there is a violation (206).

5 shows a security role state transition model.

When the user logs in, a user authentication and identification process is performed, and the security role state transition setting and control unit 104 identifies the user role and authority status of the subject process logged in, and configures the process security attribute table 108.

In the present invention, the system process state before the user logs in starts from the general use-system state 701 and the process created in the system itself inherits the general use-system state 701.

When the user logs in, the user authentication and identification process is performed, and the security role state transition setting and control unit 104 identifies the logged in user role and authority state of the subject process, and configures the process security attribute table 309.

If the user of the security administrator (301) role is logged in, the security management-user status (702), if the user of the system administrator (302) role is logged in, the system management-user status (703), security user (303) of the role If the user is logged in, the security-user status (704), or if the user of the normal user 304 role logs in, is transitioned to the general-user status (705), and the security attributes are inherited and maintained until the user logs out. do.

In the case of the owner change due to legitimate authority movement, the process security attribute table including the subject security role status information is configured using the user security attribute DB and the user information (207).

6 shows a process security attribute table 108.

The process security attribute table 108 includes four fields, such as a security role status field 501, a control field 502, a security level field 503, and a security category field 504.

The security role status field 501 expresses a security role based on user status information of a process.

The control field 502 stores control information used for process control.

The security level and security category fields 503 and 504 store security category information configured under a user security level and a security role.

The security role status of the security role status field 501 is shown in FIG.

Security role status is security management-user status (601), system management-user status (602), security management-user status (603), general use-user status (604), general use-system status (605), etc. It is expressed in the state of dogs.

The subject created by the user belonging to the security administrator group is represented by the security management-user state (601), and the subject created by the user belonging to the system administrator group is represented by the system management-user state (602).

The subject created by the user belonging to the security user group is represented by the security management-user state (603), and the subject created by the user who has not been granted the security attribute is represented by the general use-user state. The system token of the internal user concept used internally by the operating system as a system process is expressed in the general use-system state.

(e) The security role access control unit 105 compares the security role state of the process with the security role of the file system to determine only one of permission, denial, and comparison, and delivers only the event determined by the comparison to the forced access control unit.

First, allow, deny, compare, etc. are determined according to the security role state of the subject process and the security role of the object (209).

As shown in FIG. 8, when the security role state of the subject is a general use-system state (801), all access is allowed for system operation. If the security role state of the subject is the general user-user state (802), if the security role of the object is the general user role, access is allowed and access is denied to the objects of the remaining security roles. If the security role status of the subject is security-user status (803), access is allowed if the security role of the object is a normal user role, access is denied if the security role of the object is a system administrator role or security administrator role, and the security role of the object. If the security user role, the security attributes are compared in the mandatory access control unit 106.

If the security role status of the subject is system management-user status (804), access is allowed if the security role of the object is a general user role, access is denied if the security role of the object is a security user role and a security administrator role, and the security role of the object. If this role is the system administrator, the compulsory access control unit 106 compares the security attributes.

If the security role state of the subject is security management-user state (804), if the security role of the object is the role of security manager, the compulsory access control unit 106 compares the security attributes and allows access to the objects of the remaining security roles.

If it is determined to be allowed, the original system call is called, and if it is determined to be denied, the process performs the defined response actions such as stopping and warning. In case of comparison, it enforces mandatory access control.

(f) The mandatory access control unit 106 performs a mandatory access control function using the security level and security category information of the subject and the object.

In the mandatory access control, it applies only when the security roles of the subject and the object are the same, and the MLS policy is applied to the security level and the security category (210).

When the security role status of the subject is security-user-user and the security role of the object is security-user role (803), and the security role status of the subject is system-user status and the security role of the object is system administrator (804). ) Enforces mandatory access control policy using security attributes and security category information. When the security role state of the subject is the security management-user state and the security role of the object is the security manager role (805), the mandatory access control policy is applied using only the security level information among the security attributes.

If it is determined to be allowed by the MLS policy, it calls the original system call, and if it is determined to be denied, it performs defined actions such as process stop and warning.

As described in detail above, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Windows system of the present invention sets and modifies security attributes such as security role, security level, and security category for the user and file system. By applying MLS (Multi-Level Security) policy, enforced access control at the kernel level can protect the system from hacking and system misuse in the Windows-like operating system.

In addition, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Windows system of the present invention expresses the user's security role as the security role state based on the process owner state, and the authority defined in the security role state transition model. By allowing only the movement, the system can be protected by preventing the takeover of illegal root authority due to hacking.

In addition, the illegal rights movement blocking and mandatory access control method using the security role state transition model of the Windows system of the present invention performs an access control function according to the security role state to filter out unnecessary policy comparisons in advance, and provides the remaining information on the authorized process. By using the mandatory access control function, the system load can be reduced.

In the above description, the technical concept of the illegal permission movement blocking and the forced access control method using the security role state transition model of the Windows system of the present invention has been described with the accompanying drawings. It is not intended to limit the invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

Claims (15)

In the method of maintaining security using the security kernel of the Windows operating system, (a) setting, changing, and deleting the security attributes of the user by the user security attribute setting unit 101 and storing the set security attributes in the user security attributes DB 107 of the kernel; (b) the file system security attribute setting unit 102 setting, changing, and deleting a file system security attribute, and constructing and storing a file system security attribute table 109 configured as the file system security attribute in a kernel; (c) when an application event is performed in the Windows operating system to generate a system call, the system call controller 103 intercepts only the access control-related system call and bypasses the remaining system call; (d) The security role state transition setting and control unit 104 generates a process security attribute table including the process security role state by using the user security attribute DB 107 according to the occurrence of a process that is the subject of the intercepted system call. Constructing; (e) The security role access control unit 105 compares the security role status in the process security attribute table with the security role in the file system security attribute table to determine only one of permission, denial, and comparison, and to determine the event. Delivering only to the mandatory access control unit; (f) The mandatory access control unit 106 compares the security level and security category information of the remaining security roles of the process system and the object file system with respect to the event determined by comparison, and then accesses according to the read rule and the write rule. It applies compulsory access control policy to determine the system and calls the operating system call that was intercepted for access control. The security kernel converts normal process state transitions into a security role state transition model and performs an access control function according to the security role state to filter out unnecessary policy comparisons in advance, and uses security level and security category information for authorized processes. Blocking illegal rights movement and compulsory access control method using security role status transition model of Windows system that enforces compulsory access control function. The method of claim 1, The user security attributes defined in step (a) are configured to include user information, security role, security level, and security category. Illegal rights movement blocking and mandatory access control using the security role state transition model of the Windows system Way. The method of claim 1, The file system security attribute table defined in step (b) is configured to include a security role field, a control field, a security level field, and a security category field. Blocking and forced access control method. The method according to claim 2 or 3, The security role and file system security role fields of the user are divided into a security administrator, a system administrator, a security user, and a general user according to the duties of the system administrator and the necessity of administrator authority, respectively. Blocking Unauthorized Rights Movement and Compulsory Access Control Using Model. The method of claim 4, wherein The security manager is a user who performs the top-level administrator role and is a separately authorized security manager. The system administrator is an authorized system administrator who needs administrator authority for service and system management. The security user is a user who has been granted security attributes to handle sensitive data, and has a user right. The general user is a Windows user with a user right without a security attribute, and thus illegal authority movement blocking and mandatory access control method using a security role state transition model of a Windows system. The method of claim 1, In step (c), the system call control unit 103 performs a function by replacing a system call related to access control among system calls of an operating system, and then calls a system call of an operating system. Illegal Rights Movement Blocking and Mandatory Access Control Method using Transfer Model. The method of claim 6, The system call control unit (103) further comprises a control system call to configure a security policy and a security function environment. The illegal authority movement blocking and mandatory access control method using the security role state transition model of the Windows system. The method of claim 1, The step (d) may include a step (202) of checking whether a process that is a subject of a system call intercepted by the kernel is a newly created process; If it is a newly created process, checking the owner authority of the existing parent process and the newly created child process to give the subject security attributes to the process (203); If the owner authority of the parent process and the owner authority of the child process are the same, inheriting the security attributes of the parent process to the child process (204); Collecting user information if the owner authority of the upper process and the lower process is different (205); Verifying whether the change of the owner is caused by a right shift by applying a security role state transition model based on the collected user information and security attributes (206); If there is an illegal transfer of rights, perform the defined response action for the process, and if the owner changes due to legitimate transfer of rights, use the user security attributes DB and user information to create a process security attribute table that contains the process security role status information. Constructing step 207; If inheriting the security attributes of the parent process (204), or if the security attributes are set in the new process (207), the step of collecting information about the file system that is the subject process and the object in the kernel (208) A method for blocking illegal rights movement and forcibly accessing the control system using the security role state transition model of the Windows system. The method of claim 8, If the owner authority of the parent process and the child process is different, in the step of collecting user information (205), the collection of user information is collected including the user's login or permission movement path, system information about the user, and user security attributes. Blocking the illegal rights movement and forced access control method using the security role state transition model of the Windows system, characterized in that. The method of claim 8, The process security attribute table includes a security role status field 501, a control field 502, a security level field 503, and a security category field 504. The security role status field 501 represents a security role based on user status information of a process. The control field 502 stores control information used for process control, The security level and security category fields 503 and 504 store security category information consisting of a user security level and a security role under the security role. Access control method. The method of claim 10, The process security role status field may include security management-user status 601, system management-user status 602, security management-user status 603, and general use-user status according to the security role and process owner status of the user. 604), a method for preventing illegal rights movement and mandatory access control using a security role state transition model of a Windows system, characterized by general use-system state 605. The method according to claim 1 or 11, Step (e) allows all access for system operation when the subject's security role state is a general use-system state according to the process security role state and the object's security role. If the security role state of the subject is the general user-user state (802), if the security role of the object is the general user role, access is allowed and access is denied to the objects of the remaining security roles. If the security role status of the subject is security-user status (803), access is allowed if the security role of the object is a normal user role, access is denied if the security role of the object is a system administrator role or security administrator role, and the security role of the object. If this is a security user role, the compulsory access control unit 106 compares the security attributes, If the security role status of the subject is system management-user status (804), access is allowed if the security role of the object is a normal user role, access is denied if the security role of the object is a security user role and security administrator role, and the security role of the object. If this system administrator role, security attributes are compared in the compulsory access control unit 106, If the security role status of the subject is security management-user status (804), if the security role of the object is the security administrator role, the compulsory access control unit 106 compares the security attributes and grants access to the objects of the remaining security roles. A method for blocking illegal rights movement and mandatory access control using the security role state transition model of the Windows system. The method of claim 12, The illegal authority movement blocking and mandatory access control method using the security role state transition model of the Windows system, characterized by calling the original system call when determined as the permission, and performing a corresponding action defined in the process when it is determined as the denial. The method of claim 1, Step (f), When the security role status of the subject is security-user-user and the security role of the object is security-user role (803), and the security role status of the subject is system-user status and the security role of the object is system administrator (804). ) Enforces mandatory access control policy using security attributes and security category information. When the subject's security role is the security management-user state and the object's security role is the security manager role (805), the mandatory access control policy is applied using only the security level information among the security attributes. Blocking illegal rights movement and mandatory access control using role state transition model. The method of claim 14, Blocking the illegal rights movement and mandatory access using the security role state transition model of the Windows system, which calls the original system call if it is determined to be allowed in the mandatory access control policy, and performs the defined actions in the process if it is determined to be denied. Control method.

Images