KR20080057918A - Method for illegal privilege flow prevention and mandatory access control using the state transition model of security role in unix/linux system - Google Patents

Abstract

A method for blocking illegal right transfer and controlling access forcibly by using a security role state transition model of a Unix/Linux system is provided to control the access forcibly in a kernel level by setting security property and applying a modified MLS(Multi-Level Security) policy to a user and a file system. A user security property setting part(101) sets, modifies, and deletes user security property, and stores the set user security property to a user security property database. A file system security property setting part sets(102) modifies, and deletes file system security property, and stores the set file system security property to a file system security property database. A system call controller(103) intercepts a system call related to access control. A security role transition state setting/controlling part forms a process security property table including a process security role state by using the user security property database when the process related to the intercepted system call is generated. A security role access controller determines permission, refuse, or comparison by comparing the security role states of the process and file system security property tables, and transfers an event determined by the comparison to a forcible access controller.

Description

METHOOD FOR ILLEGAL PRIVILEGE FLOW PREVENTION AND MANDATORY ACCESS CONTROL USING THE STATE TRANSITION MODEL OF SECURITY ROLE IN Unix / Linux SYSTEM}

1 is a block diagram of an overall system for implementing illegal rights movement blocking and mandatory access control using a security role state transition model of a Unix / Linux system of the present invention.

2 is a flow chart of a method for blocking illegal rights movement and mandatory access control using a security role state transition model of the Unix / Linux system of the present invention.

3 is a security role defined in the user and file system.

4 is a configuration diagram of a file system security attribute table.

5 is a security role state transition model.

6 is a diagram illustrating a process security attribute table.

7 is a state of a security role of a process of a process security attribute table.

8 is an access control policy according to a security role.

* Description of the main parts of the drawings *

101: user security attribute setting unit 102: file system security attribute setting unit

103: system call control unit 104: security role state transition setting and control unit

105: security role access control unit 106: mandatory access control unit

107: User Security Attributes DB 108: Process Security Attributes Table

109: File System Security Attributes Table

The present invention represents a security role state transition model of a process transition in a Unix / Linux system to block illegal authority movement and provide a compulsory access control function in conjunction with a security role. The present invention relates to a method for blocking illegal mandate movement and forcibly controlling access.

In the case of access control applied to the existing Unix / Linux-like operating system, the file system owner sets permission bits to grant read, write, and execute permissions to users, groups, and other users. Allows arbitrarily changing the permission bits for all user-owned files.

In general Unix / Linux system, it is difficult to apply consistent security policy to system because user can arbitrarily adjust permission bit, and it is difficult to apply enhanced security policy by classifying important files by class.

In addition, when a user moves to root authority using su, etc., the status of which user moved to root cannot be known only by the current process information, and even if abuse occurs, the root authority becomes the highest authority in the system.

Accordingly, there are security kernel systems to which a mandatory access control policy is applied to enhance the security of the general-purpose Unix / Linux system.

In mandatory access control, security level and security category are assigned to users and file systems, and forced read and write rules are applied using BLP model.

Most secure operating systems adopt a multi-level policy (MLP), which operates by assigning security levels to subjects and objects. The BLP (Bell and Lapadula) model is the highest level in the government classified classification environment. It is a proven representative mathematical model that expresses multistate rating policies that restrict information from flowing to lower levels.

However, secure operating systems using the BLP model inherit the user's security level into the process. The problem with this approach is that the process is not entirely reliable. In other words, if the user's security level and permission range are inherited by a malicious process in which the error is inherent or intentionally modified, the system safety may be destroyed. This is because the BLP model simply defines the identity of the system user and the process that actually handles the access.

Since such mandatory access control is an access control to the file system, it is difficult to prevent illegal authority movement due to hacking. In other words, system area environments that are not subject to mandatory access control policy can be destroyed with hacking rights.

An object of the present invention to solve the above problems, to set the security role, security level, security category, etc. for the user and file system to protect the system from hacking and system misuse in the UNIX / Linux-based operating system And, by applying the modified MLS (Multi-Level Security) policy, it provides illegal access control and forced access control method using security role state transition model of Unix / Linux system that enforces forced access control at kernel level.

In addition, another object of the present invention, the security role state of the Unix / Linux system that grants security attributes when obtaining the authority through a user login or a trusted program, adjust the security role state when a new process occurs, and inherit the security attributes. It is to provide illegal access control and mandatory access control using transfer model.

In addition, another object of the present invention, by expressing the user's security role to the security role state based on the process owner state, and by only allowing the authorized movement defined in the security role state transition model to prevent the takeover of illegal root authority due to hacking, etc. By providing the security role state transition model of Unix / Linux system to protect the system, it provides illegal access control and mandatory access control method.

In addition, another object of the present invention is to reduce the system load by performing an access control function according to the security role status in advance to filter out unnecessary policy comparisons and to perform a forced access control function using the remaining information for the authorized process. It is to provide illegal access control and mandatory access control method using security role state transition model of Unix / Linux system.

As described above, a method of maintaining security using a security kernel of a computer operating system includes: (a) the user security attribute setting unit 101 sets, changes, and deletes a security attribute of a user; Storing in the user security attribute DB 107 of the kernel; (b) the file system security attribute setting unit 102 setting, changing, and deleting a file system security attribute, and constructing and storing a file system security attribute table 109 configured as the file system security attribute in a kernel; (c) if an application event is performed in the system to generate a system call, the system call controller 103 intercepts only the access control related system call and bypasses the remaining system call; (d) The security role state transition setting and control unit 104 generates a process security attribute table including the process security role state by using the user security attribute DB 107 according to the occurrence of a process that is the subject of the intercepted system call. Constructing; (e) The security role access control unit 105 compares the security role state in the process security attribute table with the security role in the file system security attribute table to determine only one of permission, denial, and comparison, and the event determined as a comparison. Transmitting only to the mandatory access control unit; (f) the compulsory access control unit 106 applies the compulsory access control policy using the security level and security category information of the remaining security roles of the subject and the object, and calls the original system call. The kernel converts normal process state transitions into a security role state transition model and performs access control functions according to the security role state to filter out unnecessary policy comparisons in advance, and forcibly accesses the authorized process using security level and security category information. It is achieved by blocking illegal permission movement and mandatory access control method using security role state transition model of Unix / Linux system that performs control function.

Hereinafter, a method and a system for preventing illegal permission movement and forced access control using a security role state transition model of the Unix / Linux system of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an entire system for implementing illegal rights movement blocking and mandatory access control using a security role state transition model of a Unix / Linux system of the present invention, and FIG. 2 is a security role state of a Unix / Linux system of the present invention. This is a flowchart of illegal rights movement blocking and mandatory access control method using transfer model.

3 is a security role defined in a user and a file system, and FIG. 4 is a diagram of a file system security attribute table configuration.

In addition, Figure 5 is a security role state transition model, Figure 6 is a process security attribute table configuration diagram.

7 is a security role state of a process of the process security attribute table, and FIG. 8 is an access control policy according to the security role.

In order to achieve the above technical problem, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the UNIX / Linux system according to the present invention includes a user security attribute setting unit 101 and a file system security attribute setting unit 102. ), The system call control unit 103, the security role state transition setting and control unit 104, the security role access control unit 105, and the compulsory access control unit 106.

1 is an overall system diagram for performing an illegal rights movement blocking and mandatory access control system using a security role state transition model of a UNIX / Linux system of the present invention.

The user security attribute setting unit 101 sets, changes, and deletes the security attributes of the user and stores the set security attributes in the user security attributes DB 107 of the kernel.

Here, the user security role, which is one of the user security attributes DB 107, may be a security manager 301, a system administrator 302, a security user 303, or a general user 304 according to a system administration job and a need for root authority. Separated by.

The security manager 301 is defined as a security administrator authorized as a user who performs the highest root role among several users who have obtained root authority.

The system administrator 302 is defined as an authorized system administrator who requires root authority for service and system management.

The security user 303 is defined as a user who is granted security attributes (security level, security category) and does not require root authority to handle important data.

The general user 304 is defined as a general UNIX / Linux user who does not require root authority without granting security attributes.

The file system security attribute setting unit 102 sets, changes, and deletes a file system security attribute, configures a file system security attribute table 109, and stores the file system security attribute table 109 in the kernel.

The file system security attribute table 109 includes four fields: a security role field 401, a control field 402, a security level field 403, and a security category field 404.

The security role field 401 stores a security role (security manager, system administrator, security user, general user) information about the file system, the control field 402 is a file applied to an exceptional access control policy Used to represent a system.

The security level and security category fields 403 and 404 store security category information that is configured under the file system security level and security role.

The system call control unit 103 filters only system calls for the corresponding file system and process when an application event is performed in a UNIX / Linux system and a system call occurs.

The security role state transition setting and control unit 104 configures the process security attribute table 108 by using the information of the user security attribute DB 107 when a new process occurs.

The process security attribute table 108 includes four fields, such as a security role status field 501, a control field 502, a security level field 503, and a security category field 504.

The security role status field 501 expresses a security role based on user status information of a process.

The control field 502 stores control information used for process control.

The security level and security category fields 503 and 504 store security category information configured under a user security level and a security role.

The security role access control unit 105 compares the security role state in the process security attribute table with the security role in the security attribute table of the file system to determine whether to allow, deny, or compare the event. Only to the mandatory access control unit.

The mandatory access control unit 106 applies a mandatory access control policy using the remaining category information and security level of the security role and calls the original system call.

2 is a flowchart illustrating a method for blocking illegal rights movement and a mandatory access control using a security role state transition model in a UNIX / Linux system according to the present invention.

First, (a) the system security manager sets, changes, and deletes the user security attributes in the user security attribute setting unit 101 so that the set security attributes are stored in the user security attributes DB 107 of the kernel.

The security attribute defined by the system security manager in the user security attribute setting unit 101 is configured to include user information, security role, security level, and security category.

In general, the mandatory access control defines a security level and a security category for the user, but in the present invention, the security category is classified as a security role for the user, and then the security category is reconfigured according to the security role.

Therefore, the security role in the present invention is a large category for the security category, and the security category is configured under the security role.

3 illustrates the classification of security roles among user security attributes.

Among the user security attributes, the user security role is divided into a security manager 301, a system administrator 302, a security user 303, and a general user 304 according to system duties and root authority needs.

The security manager 301 is defined as a security administrator authorized as a user who performs the highest root role among several users who have obtained root authority.

The system administrator 302 is defined as an authorized system administrator who requires root authority for service and system management.

The security user 303 is defined as a user who is granted security attributes (security level, security category) and does not require root authority to handle important data.

The general user 304 is defined as a general UNIX / Linux user who does not require root authority without granting security attributes.

(b) The system security manager sets, changes, and deletes file system security attributes in the file system security attribute setting unit 102 and stores a file system security attribute table 109 composed of file system security attributes in the kernel.

The security attributes of the file system as an object are configured to include security roles, security levels, and security categories.

In general, the mandatory access control defines a security level and a security category for the file system, but in the present invention, the security category is classified as a security role for the file system, and then the security category according to the security role is reconfigured.

Therefore, in the present invention, the security role is a large category for the security category, and the security category is configured under the security role.

The security roles used in the file system are divided into security administrator, system administrator, security user, and general user, and are identical to the security roles defined in the user described above.

4 shows a file system security attribute table structure.

The file system security attribute table consists of four fields: a security role field 401, a control field 402, a security level field 403, and a security category field 404.

The security role field 401 stores a security role (security manager, system administrator, security user, general user) information about the file system, the control field 402 is a file applied to an exceptional access control policy Used to represent a system.

The security level and security category fields 403 and 404 store security category information that is configured under the file system security level and security role.

(c) When an application event is performed in the UNIX / Linux system and a system call occurs, the system call control unit 103 intercepts only the access control-related system call and bypasses the remaining system call (201).

In general, when an application is executed by a system or a user, a system call of an operating system occurs and the operating system performs a function requested by the system call. However, the system call control unit 103 of the present invention performs a function related to the present invention among system calls of the operating system. It replaces the system call (related to access control) and calls the system call of the operating system after performing the function of the present invention. In addition, a control system call may be added for security policy and security function environment setting used in the present invention.

(d) The security role state transition setting and control unit 104 configures the process security attribute table 108 by using the user security attribute DB 107 information when a process, which is the subject of the intercepted system call, is generated. The transfer of illegal rights is controlled according to the transition.

The process checks whether the process that is the subject of the system call intercepted by the kernel is a newly created process (202).

All processes have security attributes, and newly created processes do not have security attributes.

Accordingly, in the case of the newly created subprocess, the owner authority of the existing upper process and the newly created subprocess is checked in order to grant the subject's security attribute to the corresponding process (203).

If the owner authority of the parent process and the owner authority of the child process are the same, the security attributes of the parent process are inherited by the child process (204).

If the owner authority of the upper process and the lower process is different, user information is collected (205).

The collection of user information collects the user's login or authorization path, system information about the user, user security attributes, and the like.

Based on the collected user information and (process?) Security attributes, a security role state transition model is applied to verify that there is a violation (206).

5 shows a security role state transition model.

When the user logs in, a user authentication and identification process is performed, and the security role state transition setting and control unit 104 identifies the user role and authority status of the subject process logged in, and configures the process security attribute table 108.

In the present invention, the system process state before the user logs in starts from the general use-root state 701 and the process created in the system itself inherits the general use-root state 701.

Security Admin-user status 702 when a user in the Security Admin (301) role is logged in, System Admin-user status 703 when a user in the System Admin 302 role is logged in, a user in the Security User 303 role Security-user status (704) when the user is logged in, and user-user status (705) when the user of the normal user (304) role is logged in. General usage-root when the system administrator logs in as root from the console. Maintain state 708.

When a logged-in user works on the system and a new process occurs, the state is inherited. A user who can move authority through a trusted program such as su is limited to a user in the role of security administrator 301 and system administrator 302, and does not allow permission transfer through an untrusted program.

When a user of the security administrator 301 role is moved to root through a trusted program, the security role state is transferred from the security management-user state 702 to the security management-root state 706, and the system administrator 302 role. When the user of the authority moves to the root through the trusted program, the security role state transitions from the system management-user state 703 to the system management-root state 707.

If the security role is out of state transition, the countermeasure action is performed such as stopping the reporting process as an illegal transfer of authority.

In the present invention, when an authority is moved to another user through su or the like in the security management-root state 706 and the system management-root state 707, an exception is handled through a separate allow list.

If there is an illegal transfer of rights, it will perform a defined response action such as stopping the process and warning.

In the case of the owner change due to legitimate authority movement, the process security attribute table including the subject security role status information is configured using the user security attribute DB and the user information (207).

6 shows a process security attribute table 108. The process security attribute table 108 includes four fields, such as a security role status field 501, a control field 502, a security level field 503, and a security category field 504.

The security role status field 501 expresses a security role based on user status information of a process.

The control field 502 stores control information used for process control.

The security level and security category fields 503 and 504 store security category information configured under a user security level and a security role.

The security role status of the security role status field 501 is shown in FIG.

The security role state of the process is to convert the security role among the user security attributes into the process security role state and re-express it as the security attributes of the subject.

That is, the four security roles according to the user's security role and process owner status are security management-root status (601), system management-root status (602), security management-user status (603), system management-user status ( 604), security use-user state 605, general use-user state 606, and general use-root state 607.

If the subject's security role is security manager 301 and the owner of the subject is root, it is expressed as security management-root state (601). If the subject's security role is system administrator 302 and the owner of the subject is root, the system Expressed as admin-root state 602.

If the subject's security role is security manager 301 and the subject's owner is in user state, it is expressed as security management-user state (603). If the subject's security role is system administrator 302 and the subject's owner is in user state, the system Expressed as admin-user state 604.

When the principal's security role is the security user 303 and the owner of the subject is in the user state, the security role is represented by the security use-user state 605. If the principal is the root user, the security user 303 is not allowed.

When the principal's security role is the general user 304 and the subject's owner is in the user state. The user's security role is the general user 304 and the subject's owner is in the user state. Expressed as general use-root state (607).

If the security attribute of the parent process is inherited or the security attribute is set to a new process, the kernel collects information about the process and the file system as the object (208).

Information about a process system and a file system, which are objects, is collected from the process security attribute table and the file system security attribute table.

(e) The security role access control unit 105 compares the security role state of the process with the security role of the file system to determine only one of permission, denial, and comparison, and delivers only the event determined by the comparison to the forced access control unit.

First, allow, deny, compare, etc. are determined according to the security role state of the subject process and the security role of the object (209).

As shown in FIG. 8, when the security role state of the subject is a general use-user state and a general use-root state (801), access is allowed only when the security role of the object is a general user role, and the object of the remaining security roles is accessed. Access is denied.

If the security role status of the subject is security-user status (802), access is allowed if the security role of the object is a general user role, and access is denied if the security role of the object is a security administrator or system administrator role. If the role is a security user role, the compulsory access control unit 106 compares the security attributes.

If the security role status of the subject is system management-user status and system management-root status (803), access is allowed if the security role of the object is a general user role, and access is granted if the security role of the object is a security user role and a security administrator role. If it is denied and the security role of the object is a system administrator role, the security attributes are compared in the mandatory access control unit 106.

If the security role status of the subject is security management-user status and security management-root status (804), if the security role of the object is the role of security administrator, the compulsory access control unit 106 compares the security attributes to the objects of the remaining security roles. Access is granted.

If it is determined to be allowed, it calls the original system call, and if it is determined to be denied, it performs defined actions such as process stop and warning.

(f) The mandatory access control unit 106 applies the mandatory access control policy using the security level and security category information of the remaining security roles of the subject and the object and calls the original system call.

Here, what is called the remaining security roles of the subject and the object?

In the mandatory access control, it applies only when the security roles of the subject and the object are the same, and the MLS policy is applied to the security level and the security category (210).

In FIG. 8, when the security role state of the subject is a security use-user state and the security role of the object is a security user role (802), the security role state of the subject is a system management-user state or a system management-root state, If the security role is a system administrator role (803), the mandatory access control policy is applied using the security attribute security level and security category information.

In addition, if the security role state of the subject is security management-user state or security management-root state and the security role of the object is the security manager role (804), the mandatory access control policy is applied using only the security level information among the security attributes. .

If it is determined to be allowed by the MLS policy, it calls the original system call, and if it is determined to be denied, it performs defined actions such as process stop and warning.

As described in detail above, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Unix / Linux system of the present invention sets security attributes such as security role, security level, and security category for the user and file system. By applying the modified Multi-Level Security (MLS) policy to enforce the access control at the kernel level, the system can be protected from hacking and system misuse in UNIX / Linux system.

In addition, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Unix / Linux system of the present invention expresses the user's security role as the security role state based on the process owner state and defines the security role state transition model. By allowing only the authorized authority to move, the system can be protected by preventing the exploitation of illegal root authority due to hacking.

In addition, the illegal authority movement blocking and mandatory access control method using the security role state transition model of the Unix / Linux system of the present invention performs an access control function according to the security role state to filter out unnecessary policy comparisons in advance and to perform an authorized process. The rest of the information can be used to enforce the access control function to reduce the system load.

In the above description, the technical concept of the illegal permission movement blocking and the compulsory access control method using the security role state transition model of the Unix / Linux system of the present invention has been described with the accompanying drawings. It does not limit the invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

Claims (16)

In the method of maintaining security using a security kernel of a computer operating system, (a) setting, changing, and deleting the security attributes of the user by the user security attribute setting unit 101 and storing the set security attributes in the user security attributes DB 107 of the kernel; (b) the file system security attribute setting unit 102 setting, changing, and deleting a file system security attribute, and constructing and storing a file system security attribute table 109 configured as the file system security attribute in a kernel; (c) if an application event is performed in the system to generate a system call, the system call controller 103 intercepts only the access control related system call and bypasses the remaining system call; (d) The security role state transition setting and control unit 104 generates a process security attribute table including the process security role state by using the user security attribute DB 107 according to the occurrence of a process that is the subject of the intercepted system call. Constructing; (e) The security role access control unit 105 compares the security role status in the process security attribute table with the security role in the file system security attribute table to determine only one of permission, denial, and comparison, and to determine the event. Delivering only to the mandatory access control unit; (f) the compulsory access control unit 106 applies the compulsory access control policy using the security level and security category information of the remaining security roles of the subject and the object, and calls the original system call. The kernel converts normal process state transitions into a security role state transition model and performs access control functions according to the security role state to filter out unnecessary policy comparisons in advance, and forcibly accesses the authorized process using security level and security category information. Blocking of illegal rights movement and mandatory access control using security role state transition model of Unix / Linux system that performs control function. The method of claim 1, The user security attribute defined in step (a) is composed of user information, security role, security level, and security category. Illegal rights movement blocking and enforcement using the security role state transition model of Unix / Linux system Access Control Method. The method of claim 1, The file system security attribute table defined in step (b) is illegal including a security role field, a control field, a security level field, and a security category field. Privilege Movement Blocking and Mandatory Access Control Method. The method according to claim 2 and 3, The security role and file system security role fields of the user are divided into a security administrator, a system administrator, a security user, and a general user according to system administration duties and root authority needs, respectively. Illegal Rights Movement Blocking and Mandatory Access Control Using State Transition Model. The method of claim 4, wherein The security manager is a user who performs the highest root role among several users who have obtained the root authority. The system administrator is an authorized system administrator who requires root authority for service and system administration. The security user is a user who is granted security attributes to handle sensitive data and does not require root authority. The general user is a general UNIX / Linux user who does not require root authority without granting security attributes, and thus illegal authority movement blocking and mandatory access control method using a security role state transition model of a Unix / Linux system. The method of claim 1, In step (c), the system call control unit 103 performs a function by replacing a system call related to access control among system calls of an operating system and then calls a system call of an operating system. Blocking illegal rights movement and mandatory access control using state transition model. The method of claim 6, The system call control unit 103 further includes a control system call to set a security policy and a security function environment, and the illegal authority movement blocking and mandatory access control using the security role state transition model of the Unix / Linux system. Way . The method of claim 1, The step (d) may include a step (202) of checking whether a process that is a subject of a system call intercepted by the kernel is a newly created process; If it is a newly created process, checking the owner authority of the existing parent process and the newly created child process to give the subject security attributes to the process (203); If the owner authority of the parent process and the owner authority of the child process are the same, inheriting the security attributes of the parent process to the child process (204); Collecting user information if the owner authority of the upper process and the lower process is different (205); Verifying whether the change of the owner is caused by a legitimate transfer of authority by applying a security role state transition model based on the collected user information and the security attributes (step?); If there is an illegal transfer of rights, perform the defined response action for the process, and if the owner changes due to legitimate transfer of rights, use the user security attributes DB and user information to create a process security attribute table that contains the process security role status information. Constructing step 207; If inheriting the security attributes of the parent process (204), or if the security attributes are set in the new process (207), the step of collecting information about the file system that is the subject process and the object in the kernel (208) Blocking the illegal rights movement and mandatory access control using the security role state transition model of the Unix / Linux system. The method of claim 8, If the owner authority of the parent process and the child process is different, in the step of collecting user information (205), the collection of user information is collected including the user's login or permission movement path, system information about the user, and user security attributes. Blocking the illegal rights movement and mandatory access control using the security role state transition model of the Unix / Linux system. The method of claim 8, The process security attribute table includes a security role status field 501, a control field 502, a security level field 503, and a security category field 504. The security role status field 501 represents a security role based on user status information of a process. The control field 502 stores control information used for process control, The security level and security category fields 503 and 504 block illegal authority movement using a security role state transition model of a Unix / Linux system, wherein the security category information consisting of user security level and security role is stored. And mandatory access control method. The method of claim 10, The process security role status field may include security management-root status 601, system management-root status 602, security management-user status 603, system management-user status according to the security role and process owner status of the user. 604), illegal use using security role state transition model of Unix / Linux system, characterized by security use-user state (605), general use-user state (606), and general use-root state (607). Movement blocking and mandatory access control method. The method of claim 8, In the step 206 of verifying whether the change of the owner is caused by a legitimate authority movement by applying the security role state transition model, the authority-moving user is limited to the users of the security administrator 301 role and the system administrator 302 role and trusted. Unauthorized program transfer is not allowed, and illegal authority movement blocking and mandatory access control method using security role state transition model of Unix / Linux system is not allowed. The method according to claim 1 or 11, Step (e) is based on the process security role status and the security role of the object, In normal-user status and general-root status, access is allowed only if the security role of the object is a general user role, and access to objects in the remaining security roles is denied. If the security role status of the subject is security-user status, access is allowed if the security role of the object is a normal user role, access is denied if the security role of the object is a security administrator role and a system administrator role, and the security role of the object is If it is a security user role, security attributes are compared in the compulsory access control department. In the system-user state and the system-root state, access is allowed if the security role of the object is a general user role, access is denied if the security role of the object is a security user role or a security administrator role, and the security role of the object is If the administrator role, security attributes are compared in the compulsory access control unit 106, In case of security management-user status and security management-root status (804), if the security role of the object is the role of security manager, the compulsory access control unit 106 compares the security attributes and grants access to the objects of the remaining security roles. Blocking the illegal rights movement and mandatory access control using the security role state transition model of Unix / Linux system. The method of claim 13, Blocking the illegal authority movement and mandatory access control using the security role state transition model of the Unix / Linux system, characterized in that the call is made to the original system call if it is determined to be allowed and the corresponding action is defined in the process if it is determined to be denial. . The method of claim 1, In step (f), if the security role state of the subject is a security use-user state and the security role of the object is a security user role (802), the security role state of the subject is system management-user state or system management-root state. If the security role of the object is the system administrator role (803), the mandatory access control policy is applied using the security attributes and the security category information. If the security role of the subject is security management-user or security management-root and the security role of the object is the security manager role (804), the mandatory access control policy is applied using only the security level information among the security attributes. Blocking of illegal rights movement and mandatory access control method using security role state transition model of Unix / Linux system. The method of claim 15, Blocking illegal permission movement using the security role state transition model of Unix / Linux system, which calls the original system call if it is determined to be allowed in the mandatory access control policy and performs the defined action in the process if it is determined to be denial. Mandatory access control method.

Images