KR100960358B1 - Mandatory process memory access control method using multi-level security, and computer readable recording medium having thereon programmed mandatory process memory access control method using multi-level security - Google Patents

Abstract

The present invention relates to a method of protecting a process memory by controlling a process running in a computer operating system (OS) to access the process memory.

According to the present invention, (a) allowing the system security manager to assign and set security level and category information to an application installed in the system; (b) when the application installed in the system is executed to allocate a field to the process structure when the process is created, and to include the security level and category information set for the application; And (c) the modified BLP model by comparing the security level and category information contained in the process structure of the object when the running process becomes the subject and the subject accesses the process memory of the object using another running process as the object. In accordance with the present invention, a mandatory process memory access control method based on a multi-class security method is disclosed.

Process, memory, security information, BLP model

Description

Mandatory process memory access control method using multi-level security, and computer readable recording medium having thereon programmed mandatory process memory access control method using multi-level security}

The present invention relates to a security method in a computer operating system (OS), and more particularly, to a method of protecting a process memory by controlling a process running in an operating system to access the process memory.

In the past, security technology research on computer systems has been conducted with an add-on method of adding hardware and software such as encryption, access control, and audit trail to computer systems. However, this approach did not solve the known problems of bypass, modification, and new security issues such as Trojan horses and covert channels, and the need to continue to add new security updates whenever such problems occur. There was.

In addition, with the recent rapid expansion of the information field, illegally accessing internal or external users who do not have access to confidential levels of information stored on a computer, or secret files or devices whose process subjects are objects There are security issues such as reading and writing or performing. In particular, in the content service via the web, problems of theft of the system root authority by hackers and the like and illegal alteration of the home page and related contents by users who do not have access rights cause social controversy.

Accordingly, recently, research and development of a security kernel including a security function in an internal kernel of an operating system of a computer system has been in progress. With the development of such a secure kernel, in recent years, when a user or process subject accesses a secret file or a device that is an object, security is enhanced.

In the case of the previously developed security kernel or operating system, the object is largely composed of regular files, directories, and special file devices stored on disk. Therefore, when a user or a subject of a process accesses a file, a directory, or a device file, security can be maintained by an enhanced access control method. However, the access control and security technology for process memory owned by a process was lacking in research and development.

Therefore, a security problem may occur in which information loaded on the process memory may leak to the outside due to hacking and dumping of the process memory, and it is difficult to solve such problems with the existing security kernel and operating system. have.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, wherein a subject having a certain security level in a computer system, i.e., a process reads or writes a secret security level object, i.e., a process memory. When attempting to control the access by applying the modified BLP (Bell & Lapadula) security model to the class and category relationship between the subject and the object, the process having the security level is leaked or modified by other processes. Its purpose is to provide a compulsory process memory access control method that can be protected from being prevented.

Furthermore, the present invention allows the security manager to assign security level and category information when the application program is installed on the computer system, and to set the security level and category information so that the application is executed and the child process generated by the process. Another purpose is to provide a method to allow the security level and category information set by the security manager to continue to be inherited.

Other objects and advantages of the invention will be described below and will be appreciated by the embodiments of the invention. Further, objects and advantages of the present invention can be realized by the means and the combination shown in the appended claims.

In order to achieve the above object, the mandatory process memory access control method based on the multi-class security method according to the present invention, (a) the system security administrator assigns the security level and category information to the application installed in the system Setting up; (b) when the application installed in the system is executed to allocate a field to the process structure when the process is created, and to include the security level and category information set for the application; And (c) the modified BLP model by comparing the security level and category information contained in the process structure of the object when the running process becomes the subject and the subject accesses the process memory of the object using another running process as the object. And determining, in kernel mode, the subject's access rights to the object's process memory.

According to another aspect of the present invention, there is provided a recording medium on which a program for providing a forced process memory access control method based on a multi-class security method is recorded. (2) assigning fields to a process structure when an application installed in the system is executed to create a process, and including security level and category information set for the application; (3) When a running process becomes a subject and another running process becomes an object, and the subject accesses the object's process memory, the security level and category information contained in the process structure of the object are compared with each other to modify the BLP model. Subject's access to the object's process memory The computer-readable medium storing a program for executing a procedure for determining the kernel mode is provided.

According to the present invention, a modified BLP model when a process without a security level or a process that does not meet the security level arbitrarily attempts to access a process memory owned by a process to a process memory owned by a process, such as read or write. Based on this, it provides the effect of blocking natively in kernel mode.

In addition, since the security level assigned and assigned by the security officer is continuously inherited at the time of application installation or process creation, the inherited security even if the user attempts to access the process memory by transforming it into a similar process or bypassing the similar process. Provides the effect of blocking access by class.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, the terms or words used in this specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly introduce the concept of terms in order to best explain their invention. It should be interpreted as meanings and concepts in accordance with the technical spirit of the present invention based on the principle that it can be defined. Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

Hereinafter, the modified BLP model employed by the present invention will be described in detail, and then the preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the preferred embodiments of the present invention described below are not intended to limit the technical scope of the present invention, but are intended to explain the present invention more clearly and easily to those skilled in the art. Like reference numerals in the drawings refer to like elements.

In the BLP model applied to the mandatory process memory access control method according to the multi-class security method according to the present invention, whether the subject can read, execute, write (write, create, append, delete) the object. In order to determine whether or not to add a judgment condition as follows.

(1) The subject is granted read (execute) permission on the object only when all of the following conditions are met.

Condition 1: The subject's security level is equal to or higher than the object's security level

Condition 2: The subject's category dominates (includes) the category of the object

Here, the security level refers to the level of information such as 0, 1, 2, etc., the category refers to the category of information, such as personnel, logistics, administration.

If the above conditions 1 and 2 are granted, the subject has read permission on an object having a security level lower than its security level and a category that is included in its category. In addition, an object that has a higher security level than its own security level or that is not included in its category cannot have permission to read.

(2) The subject has write (write, create, append, delete) permission on the object only when all of the following conditions are met.

Condition 3: The subject's security level is the same as the object's security level

Condition 4: The object's category is the same as the subject's category

Given the above conditions 3 and 4, the subject cannot have authority to create, modify, or delete an object with a security level lower than or higher than that of the subject, and the subject and object have the same class and category. Only if the subject can create, modify, or delete the object.

In order to implement a mandatory process memory access control method using a multi-class security method according to the modified BLP model as described above, the present invention owns the process memory to which the subject accesses the object as the process to access the subject process memory. Define each as a process. In addition, the process structure stored in the kernel memory is adopted to add security level and category information to the process which is the subject and the object. The process structure is preferably an EPROCESS (Executive Process) structure in a Windows-based operating system.

1 is a diagram illustrating a configuration of a process structure implemented in a mandatory process memory access control method based on a multi-class security scheme according to an embodiment of the present invention.

Referring to FIG. 1, the configuration of the process structure 10 according to the present invention adds two fields (clearance and category; 20 and 30) for the inclusion of multi-level security information to the process structure defined in the existing Windows operating system. Defined by and used. The detailed configuration of the security level field 20 of the two fields added to the process structure 10 according to the present invention is shown in FIG. 2, and the detailed configuration of the category information field 30 is shown in FIG. 3. same.

2, the security level field 20 is configured to include a security level payer 40. If necessary, the security level field 20 may be configured to include a reservation unit 50, an encryption flag 70, and the like. In the case of FIG. 2 showing the security class field 20 according to an embodiment of the present invention, a total number of bits is allocated to 32 bits, of which 8 bits are used for the recording of the security class; 22 bits are reserved for other use; One bit of it is used for the encryption flag. As such, when 8 bits are used for the inclusion of security classes, 256 classes can be assigned to a process. Of course, the total number of bits constituting the security class field 20 and the number of bits constituting the security class recording unit 40, the reservation unit 50, and the encryption flag 70 may be changed. In configuring the security level field 20, the number of bits for the encryption flag 70 may not be allocated in some cases. For example, the encryption flag 70 may not be used when the subject.

Referring to FIG. 3, the category information field 30 is configured to include a category display unit 80. In Fig. 3 showing an embodiment according to the present invention, the category information field 30 is allocated to 32 bits, and all the bits are used as the category display unit 80. However, the total number of bits of the category information field 30 and the number of bits of the category display unit 80 included therein may be changed as necessary.

In the present invention, a method of assigning category information to the category information field 30 is to set category information assigned or inherited to 1 in a bit at a predetermined position corresponding thereto. For example, when the assigned category information is AB, 1 may be set to a specific bit unit corresponding to A and B. FIG. Therefore, when several bits in the category display section are set to 1, the category information has as many category information as the number of bits set to one. This category information display method allows the subject or object to have as many categories as the number of bits allocated to the category display unit 80. In the case of the category information field 30 shown in FIG. 3, since all 32 bits are reserved and used by the category display unit 80, subjects and objects can have up to 32 categories.

In the present invention, a method of assigning security information, that is, security level and category information, to an application creating a process in the system will be described. When assigning security information to the application program, a system administrator or a system security manager may grant security information when the application program is installed in the system, or may provide security information to the installed application program. In order to provide security information to such an application program, the security level and category information is added by allocating fields separately to a file information area or a header area to an executable file of the application program.

Specifically, in the case of a Windows-based operating system, an area in which information on an executable file of an application program is stored is located in a data structure called an extended file attribute. Accordingly, two fields of the reserved fields of the extended file attribute of the corresponding executable file are newly allocated, and the security information and category information are respectively added to the security information. In this case, two fields are newly allocated, and the number of bits of each field is allocated to 32 bits, and one of them is used to store security level and the other field to contain category information. Of course, the total number of bits allocated to the fields used for the recording of security level and category information and the relative positions between these fields may vary depending on the case. In addition, the detailed configuration of the two fields assigned to the extended file attribute to include the security level and category information in the application, the fields assigned to the process structure to contain the security level and category information of the process (Fig. 2 and Fig. Substantially identical to that of 3). Therefore, the detailed configuration of the security level and category information recording field assigned to the extended file attribute may refer to the detailed configuration of the security level field 20 and the category information field 30 shown in FIGS. 2 and 3. . Therefore, when 8 bits are allocated to include the security level in the security level field of the extended file attribute, up to 256 security levels may be assigned. When 32 bits are allocated to include category information in the category information field of the extended file attribute, up to 32 categories can be assigned. As such, adding security level and category information to the extended file attribute may be performed by the system security manager.

However, in the case of the security level field of the extended file attribute, one bit may be allocated to the most significant bit (MSB), which is an encryption flag, to indicate that the file is encrypted. For example, if the encryption flag MSB is set to 1, this means that the executable file of the application is an encrypted file.

According to the present invention, as described above, security information, that is, security level and category information is added to an application, and when the application is executed to generate a process, the security information is inherited and the process attempts to access the process memory. In this case, a mandatory process memory access control method of multi-class security is implemented.

4 is a flowchart illustrating the overall flow of a mandatory process memory access control method based on a multi-class security scheme according to an embodiment of the present invention.

4, an example of implementing a mandatory process memory access control method of a multi-class security method according to the present invention will be described.

First, a system security manager assigns security information to an application program in a system, and a procedure of assigning the security information assigned to each application program is performed. At this time, it is desirable to set security information when the application program is installed in the system. In addition, when allocating security information, the security information is classified into security level and category information, and the security information assigned to the above-mentioned assigned field of the extended file attribute is recorded to set security information. Here, the security level refers to the level of information, such as 0, 1, 2, etc., the category refers to the category of information, such as personnel, logistics, administration, etc. (S10)

The application installed with this security information is executed by the user or other running process. Execution of an application is accomplished by executing the executable file of the application. In addition, it may be executed by a user (or an administrator), may be executed by another running process, or may be executed by receiving an execution command from the outside through a network (S20).

When the application runs, it creates a process. Specifically, an executable file is loaded by a program loader to generate a process in which an application and DLLs linked thereto are loaded together in memory and under the control of an operating system. In addition, there may be one or more processes created by the execution of an application. That is, a plurality of processes may be created in the system even by executing one application program (S30).

Although a process may be created by the execution of an application program, another process may be created by the created and running process. This is called a child process. That is, the running process can continue to create another child process (S35).

As such, when a process is created in the system, a program is loaded into the process memory, and information about the created process is stored in the process structure in the kernel memory. This kernel memory is a region of memory that can only be accessed in kernel mode and allows for management and separation of processes within the system. As such, when the information is recorded in the process structure together with the process generation, the security information set in the application is inherited and stored. That is, the security information inherited in the security level field 20 and the category information field 30 of the process structure described with reference to FIGS. 1 to 3 are copied and recorded. In addition, even when the process is generated by the process as in step S35, the security information of the parent process is inherited and stored in the process structure of the child process (S40).

Next, an event occurs that attempts to access process memory in the running process (each process inherits the security information of the parent process or the running application). At this time, it may include both an attempt to access process memory owned by another process and an attempt to access process memory owned by another process. Here, the process that attempts to access the process memory is defined as a subject, and the process that owns the process memory that has been accessed by the subject is defined as an object. In this case, the subject and the object may be the same or may be different (S50).

When an access attempt occurs, kernel mode proceeds to extract the security information of the subject and object process. That is, the security level and category information is extracted from the process structure of the subject and object process. At this time, the security level and the category information are respectively searched and extracted from the two fields allocated to the process structure as described above (S60).

When the security information of the subject and the object is extracted, the procedure of comparing the security information with the modified BLP model is performed. This procedure compares the security level and category information for each subject and object defined above based on the BLP model. In detail, a procedure of comparing whether the subject's security level is equal to or higher than the object's security level and whether the subject's category is the same as or includes the object's category is performed (S70).

After comparing the security information based on the BLP model, the access rights of the subject's objects are determined. Again, the access right is determined by applying the modified BLP model described above. That is, it checks whether the subject can read (execute), write (write, create, append, delete) the object, and decides this as an authority. For example, if a subject attempts to access an object that has a category with a security level lower than its own security level, it grants read permission and has a level higher or higher than its security level. If you attempt to access an object with a category, do not grant read permission. In addition, if a subject attempts to write to an object with a security level lower or higher than its own security level, the authority is not granted. Only when the object's security level and category are the same as the principal's security level, the write right is granted. At this time, the target of reading and writing is the process memory owned by the object process (S80).

In operating system or kernel mode, if access authority is determined according to the above-described procedure, access to the process memory of the subject is controlled accordingly. That is, if the subject is granted access (read, write) access to the object, in step S50 the subject is attempted to access the object's process memory is allowed, the subject accesses (read, write) the object's process memory And do the work. On the other hand, if the subject has not been granted access to the object, the access attempt to the subject's process memory is rejected and the process memory access to the subject's object fails (S90).

Hereinafter, a specific method of implementing the security information set in the application program, which is the procedure from step S10 to step S40 of FIG. 4, and its child processes are continuously inherited will be described.

Referring to FIG. 5, first, a P1 program executable file is stored in a disk of a storage area, and an extended file attribute, which is an area in which file information of the program executable file 100 is recorded, contains security information granted from a system security manager. It is divided into three fields and is included as security level and category information.

The P1 application program with the security information set up goes through the procedure of being executed in the execution region (S150). The process is generated 250 as the application executes. That is, the program loader loads the application program together with the linked DLL into the process memory of the storage area, and a process structure containing information about the generated process is generated in the kernel memory. As such, when the P1 application program is executed, the P1 process 200 is loaded in the process memory and the P1 process structure 300 is generated in the kernel memory.

Looking at the structure in which the program is loaded in the process memory according to the P1 process 200, it is loaded into four areas, each structure divided into text, data, heap, and stack, which is called a segment. In brief, for each segment, the text contains the program's executable code, machine code, and read-only data. Data is a variable area declared as a global variable, a static variable, and so on. The heap is a region of memory that is allocated and freed by system calls during program execution. The stack pushes local variables and arguments to the function call and the address to return when the function finishes.

Next, the P1 process structure 300 stored in the kernel memory is the same as described with reference to FIGS. 1 to 3, and inherits the security level and category information 101, which is security information included in the extended file attribute of the application. .

Another process may be generated 260 in addition to the P1 process generated and executed in this manner. At this time, the process additionally created by the P1 process will be referred to as a P2 process as a child process. When a process is additionally generated 270 by the process, the program is loaded into the process memory and the kernel memory as described above, and a process structure is generated. The P2 process 210 generated as described above is loaded with a program in process memory, and the P2 process structure 310 is generated and stored in kernel memory. At this time, the security information of the P2 process structure 310 also inherits the security level and category information 102 allocated to the P1 process structure.

Therefore, the security information set up by the initial system security manager is continuously maintained in the process (exactly, the process structure in the kernel memory) so that it can be applied to the mandatory access control according to the present invention.

Next, a specific method of implementing mandatory access control on a process memory access attempted by a process by applying the modified BLP model, which is a procedure from step S50 to step S90 of FIG. 4, will be described.

For reference, the embodiment described below is a procedure that is processed in a Windows-based operating system, and may be somewhat different from the procedure that is performed in the Unix-based or other series, but the concept is to be understood to be the same.

Referring to FIG. 6, first, an access request (event) of a process running in a system occurs. An access request for process memory occurs during this access request. (1) Specifically, an access request for process memory is an example of calling Kernel32.dll's ReadProcessMemory or WriteProcessMemory function API. Here, the ReadProcessMemory function is a function that accesses process memory to perform a read operation, and the WriteProcessMemory function is a function that accesses process memory and performs a write operation.

When such a request for access to the process memory occurs, a procedure of capturing and hooking the process is performed. Here, hooking refers to the technique of intercepting a specific section that executes code. In other words, when you want to track an event such as file creation or memory access for a specific purpose, you can hook the event-related API. Hooking is used as a useful way to modify the behavior of the operating system. You can modify the given arguments or return values to control the behavior of the program or to log API calls. In this way, API hooking can be attempted by declaring and defining a function that does something after API hooking. In the present invention, a function for hooking a function for requesting (eventing) access to the process memory is defined.

In this way, the procedure of hooking a function corresponding to a process memory access request and checking access authority is performed. (3) In the figure, MAC is an abbreviation of Mandatory Access Control. At this time, the authority check procedure is performed by referring to a database (4) in which the security level and category information of the subject and the object are stored. Since a detailed authority check procedure is included in the above description, it will be omitted.

After the permission check procedure, the result is returned to the hooking function. (5) The hooking function determines whether to allow or block the processing of the hooked function, that is, the ReadProcessMemory or WriteProcessMemory function, based on the returned permission check result information. To judge.

If allowed (6), the function hooked back to the Windows system is returned to the function processing. Through this, the function that attempts to access the process memory handles the hardware abstraction layer (HAL) and normal work. (7, 8) The Windows system returns the processed result back to the function that attempted to access the process memory (9,10). This function normally completes the task (the task according to the process's request for access).

On the other hand, if it is determined that the access function does not have access to the process memory as a result of the authority check, the hooking function returns a failure value as a result of the operation without calling the API function. Calls to the ReadProcessMemory or WriteProcessMemory functions will fail and the process will be blocked as well.

In addition, if the process access request is not related to the ReadProcessMemory or WriteProcessMemory functions related to accessing process memory, then after calling other APIs (13) and processing them accordingly with the HAL on the Windows system (14,15,16) The result is returned (17), and the procedure according to the final process access request is completed (18).

As shown in the figure, the permission check based on the modified BLP proceeds in kernel mode, and API calling and hooking proceeds in application mode.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in detail any more.

Although the present invention has been described above by means of limited embodiments and drawings, the present invention is not limited thereto and will be described below by the person skilled in the art to which the present invention pertains. Of course, various modifications and variations are possible within the scope of the claims.

The following drawings, which are attached to this specification, illustrate exemplary embodiments of the present invention, and together with the detailed description of the present invention serve to further understand the technical spirit of the present invention, the present invention includes matters described in such drawings. It should not be construed as limited to.

1 is a diagram illustrating a configuration of a process structure implemented in a mandatory process memory access control method based on a multi-class security scheme according to an embodiment of the present invention.

2 is a detailed structural diagram of a field of a process structure to which a security level is assigned.

3 is a detailed structural diagram of a field of a process structure to which category information is assigned.

4 is a flowchart illustrating the overall flow of a mandatory process memory access control method based on a multi-class security scheme according to an embodiment of the present invention.

5 is a conceptual diagram schematically illustrating a principle of inheriting security information set according to a mandatory process memory access control method based on a multi-class security method according to an embodiment of the present invention.

6 is a block diagram illustrating a processing procedure in which a mandatory access control on a process memory access is performed according to a mandatory process memory access control method based on a multi-class security method according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

10: process structure

20: security level field

30: Category Information Field

Claims (12)

(a) allowing the system security manager to assign and set security level and category information to an application installed in the system; (b) when the application installed in the system is executed to allocate a field to the process structure when the process is created, and to include the security level and category information set for the application; (c1) the subject calling the API for accessing the process memory of the object, with the running process becoming the subject and another running process as the object; (c2) hooking the called API and comparing the security level and category information contained in the object and the subject's process structure with each other to check the subject's access authority in the kernel's process memory according to the modified BLP model in kernel mode. Connecting to a hooking function; And (c3) The hooking function checks that a subject having access has granted an API call for process memory access, and a subject having no access has refused the API call; Memory access control method. The method of claim 1, The process structure is a mandatory process memory access control method based on a multi-class security method, characterized in that the two security fields and category information is stored separately in each of the two assigned fields. The method of claim 1, The security level and category information set in the step (a), A method of mandatory process memory access control based on a multi-class security method, wherein the security level and the category information are separately stored in two fields allocated to the extended file property in which information on the executable file of the corresponding installed application is stored. The method according to claim 2 or 3, And a field indicating the security level and a field containing the category information, each including a security level indicator and a category indicator each having a predetermined number of bits. The method of claim 1, Step (b) is, And copying and inheriting the security level and category information to a child process structure generated by the generated process. The method of claim 1, In step (b), When one application is executed and a plurality of processes are generated, a field is assigned to each generated process structure and the security level and category information set in the corresponding application are identically recorded. Mandatory process memory access control method. delete The method of claim 1, The method for calling the process memory access of the object is a mandatory process memory access control method based on a multi-class security method, characterized in that the Windows-based Kernel32.dll ReadProcessMemory and WriteProcessMemory functions. The method of claim 1, Step (b) is, (b1) when the process is generated and the information on the process is loaded into the process structure in kernel memory accessible only in the kernel mode, securing a storage space for recording security level and category information in the process structure; (b2) storing the inherited security level and category information in the storage space; And (b3) an application program and DLLs linked thereto are loaded by the program loader into a memory to be controlled by an operating system. A recording medium having a program recorded thereon which provides a forced process memory access control method based on a multi-class security method. (1) a procedure in which the system security administrator assigns and sets security level and category information to an application installed on the system; (2) a procedure of allocating fields to a process structure and storing security level and category information set in the application when an application installed in the system is executed to create a process; (3-1) a procedure in which a running process becomes a subject and another running process is an object, and the subject calls an API for accessing the process memory of the object, (3-2) Hooking the called API in kernel mode and comparing the security level and category information contained in the object and the subject's process structure to compare the subject's access rights to the object's process memory according to the modified BLP model. Procedure to connect to hooking function to check and (3-3) The hooking function checks that a computer having a program that executes a procedure for executing an API call for a process memory access by a subject having access authority and a non-access subject denying API call as a result of the check. Record carrier. The method of claim 10, The procedure (2), A process of securing a storage space for storing security level and category information in the process structure when the process is created and loaded with information about the process in a kernel memory accessible only in kernel mode; Storing the security level and category information inherited in the storage space; and A computer-readable recording medium comprising a process in which an application program and DLLs linked thereto are loaded together into a memory by a program loader and controlled by an operating system. delete

Images