WO2016106510A1 - 一种安全防护方法，及装置 - Google Patents

一种安全防护方法，及装置 Download PDF

Info

Publication number
WO2016106510A1
WO2016106510A1 PCT/CN2014/095366 CN2014095366W WO2016106510A1 WO 2016106510 A1 WO2016106510 A1 WO 2016106510A1 CN 2014095366 W CN2014095366 W CN 2014095366W WO 2016106510 A1 WO2016106510 A1 WO 2016106510A1
Authority
WO
WIPO (PCT)
Prior art keywords
operation instruction
command
instruction
operating system
running
Prior art date
Application number
PCT/CN2014/095366
Other languages
English (en)
French (fr)
Inventor
王春生
彭瑞林
吴向阳
颜小亮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2014/095366 priority Critical patent/WO2016106510A1/zh
Priority to CN201480037108.6A priority patent/CN105518693B/zh
Publication of WO2016106510A1 publication Critical patent/WO2016106510A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine

Definitions

  • the present invention relates to the field of storage technologies, and in particular, to a security protection method and device.
  • the sandbox provides an isolated runtime environment for the program, which is designed to restrict the permissions of untrusted applications.
  • Sandbox technology is often used to execute untested or untrusted applications.
  • sandboxing provides virtualized disk, memory, and network resources for untrusted applications that are transparent to the application. Because the resources in the sandbox are virtualized (or indirectly), the malicious behavior of untrusted applications in the sandbox is restricted to the sandbox.
  • the process of adopting the sandbox scheme is as follows: firstly, a simplified virtual file system is created in the system, and a login user is created; when the user logs in, the virtual file system is automatically entered, and any file access of the user is restricted to the virtual file system. .
  • the user management module transfers the user to the Sandbox, and the file system that the user sees is a virtual file system. Users can only send commands to the virtual file system, and commands are only executed by the virtual file system.
  • the application scenario of the sandbox is to isolate the untrusted application in the sandbox to prevent the untrusted application from affecting the operating system (OS) system.
  • the application scenario cannot meet the application scenarios of the cloud management system (Fusion Manager, FM).
  • FM cloud management system
  • the FM system runs on the real OS, and the FM requirement is to further protect the real OS system and require the login system.
  • the user can view the contents of the file of the specified real OS to prevent sensitive information from being leaked; and it is required to execute commands on the real OS and the like.
  • the current sandbox application range is narrow, and it is not applicable to application scenarios such as FM, and provides security protection for programs in these scenarios.
  • the embodiment of the invention provides a security protection method and device, which are used to provide a security protection scheme with a wide range of defense points and a wide range of applications.
  • An embodiment of the present invention provides a security protection method, including:
  • the second process After the second process is executed to receive the operation instruction from the first process, it is determined whether the operation instruction belongs to an executable command, and if so, the operation instruction is executed, otherwise the operation instruction is refused to be executed.
  • the method further includes: running the second process to obtain an executable command set;
  • the determining that the operation instruction belongs to an executable command comprises determining whether the operation instruction belongs to the executable command set.
  • the running the second process to determine the executable command set includes: running the second process to determine and send the a white list corresponding to the user of the operation instruction;
  • the determining that the operation instruction belongs to the executable command set includes:
  • the operation instruction includes: a general call instruction and a command parameter
  • Determining whether the operation instruction belongs to an executable command comprises: running a second process to acquire signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determining to use the public key pair Whether the signature information can be verified and passed;
  • the executing the operation instruction includes: running the second process to execute an operation command specified by a command parameter in the operation instruction.
  • the first, the second, or the third optional implementation is performed on the one hand, and the sending, in the second process, the Operational instruction include:
  • Running the first process sends the operation instruction to a command server corresponding to the second process by a command agent located in the isolated running environment.
  • the operating process is sent to the first process by a command agent located in the isolated operating environment Before the second process corresponds to the command server, it also includes:
  • the communication connection between the command agent and the command server is established in the manner of a loopback internet protocol IP communication of a network communication protocol, a named pipe/file, or an insulation piercing connection IPC call.
  • command proxy and the command server use a named pipe/file or an insulation piercing connection IPC call Way to establish a communication connection;
  • the executing the operation instruction includes: acquiring, during the execution of the operation instruction by the second process, content data required for executing the operation instruction from a shared storage space located in the isolated execution environment.
  • a second aspect of the present invention provides a security protection device, including:
  • a system control unit configured to start a real operating system, create a virtual operating system in the real operating system, and place the virtual operating system in an isolated operating environment;
  • a process starting unit configured to start a first process in the virtual operating system, and start a second process in the real operating system
  • An instruction orientation unit configured to redirect the operation instruction to the first process after receiving an operation instruction from a user
  • a first control unit configured to: after running the first process and determining that the operation instruction is directed to the second process, send the operation instruction to the second process;
  • a second control unit configured to: after the second process receives the operation instruction from the first process, determine whether the operation instruction belongs to an executable command, and if yes, execute the operation instruction, otherwise refuse to execute the operation The operation instructions.
  • the second control unit includes:
  • a command set obtaining unit for acquiring an executable command set
  • An instruction determining unit is configured to determine whether the operation instruction belongs to the executable command set.
  • the command set obtaining unit is specifically configured to determine a white list corresponding to a user who sends the operation instruction
  • the instruction determining unit is specifically configured to determine whether the operation instruction belongs to an instruction that is allowed to be executed specified in the whitelist.
  • the operation instruction includes: a general call instruction and a command parameter
  • the second control unit is specifically configured to: run a second process to obtain signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determine whether the signature information is used by using the public key The verification can pass; running the second process to execute an operation command specified by the command parameter in the operation instruction.
  • the security protection device further includes: located in the isolated operating environment Command agent, and a command server corresponding to the second process outside the isolated running environment;
  • the first control unit is specifically configured to run the first process to send the operation instruction to a command server corresponding to the second process by using a command agent located in the isolated running environment.
  • the command proxy server is configured to establish a communication connection between the command proxy and the command server in a loopback internet protocol IP communication of a network communication protocol, a named pipe/file, or an insulation piercing connection IPC call.
  • command proxy and the command server use a well-known pipe/file or an insulation piercing connection IPC call Way to establish a communication connection;
  • the second control unit is further configured to: when the second process is executed, execute the operation instruction, obtain content data required for executing the operation instruction from a shared storage space located in the isolated running environment.
  • the third aspect of the present invention further provides a security protection device, including: an input device, and processing And memory,
  • the input device is configured to receive an operation instruction from a user
  • the processor is configured to start a real operating system, create a virtual operating system in the real operating system, and place the virtual operating system in an isolated operating environment; start a first process in the virtual operating system, Starting a second process in the real operating system; after the input device receives an operation instruction from a user, redirecting the operation instruction to the first process; running the first process and determining the After the operation instruction is directed to the second process, the operation instruction is sent to the second process; after the second process is executed to receive the operation instruction from the first process, determining whether the operation instruction belongs to Execute the command, if yes, execute the operation instruction, otherwise refuse to execute the operation instruction.
  • the processor is further configured to: after determining whether the operation instruction belongs to an executable command, run the second process to obtain an executable command set; and then determine whether the operation instruction belongs to the executable command set.
  • the processor is specifically configured to run the second process to determine a whitelist corresponding to a user that sends the operation instruction, and determine whether the operation instruction belongs to an instruction that is allowed to be executed specified in the whitelist.
  • the operation instruction includes: a general call instruction and a command parameter
  • the processor is specifically configured to run a second process to obtain signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determine whether the signature information can be verified by using the public key Running the second process to execute an operation command specified by a command parameter in the operation instruction.
  • the processor is specifically configured to run the first process to send the operation instruction to a command server corresponding to the second process by using a command agent located in the isolated running environment.
  • the processor is further configured to use a ring of a network communication protocol before running the first process by sending a command to the command server corresponding to the second process by a command proxy located in the isolated operating environment
  • the communication connection between the command agent and the command server is established by means of an internet protocol IP communication, a named pipe/file, or an insulation piercing connection IPC call.
  • command proxy and the command server use a named pipe/file or an insulation piercing connection IPC call Way to establish a communication connection;
  • the processor is further configured to: when running the second process to execute the operation instruction, acquire content data required to execute the operation instruction from a shared storage space located in the isolated execution environment.
  • the first process in the embodiment of the present invention is a receiver of the operation instruction, and can receive an operation instruction of the user.
  • the first process runs in an isolated operation environment, and the operation instruction is restricted to the isolated operation environment, and can provide a centralized defense function. Since the first process also has the ability to send the operation instruction to the isolation mechanism, and the second process executes the operation instruction after the verification is passed, the execution is refused; therefore, the user can operate the second process through the isolated operating environment.
  • the instruction extends the application scope of the isolated operating environment to conform to application scenarios such as FM. Therefore, the embodiments of the present invention provide a security protection scheme with a wide range of defense points and a wide range of applications.
  • FIG. 1A is a schematic flow chart of an implementation method of the present invention.
  • FIG. 1B is a schematic structural view of an implementation system of the present invention.
  • FIG. 2 is a schematic structural diagram of a system according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a system according to an embodiment of the present invention.
  • Figure 5 is a schematic flow chart of an implementation method of the present invention.
  • Figure 6 is a schematic structural view of a safety protection device according to the present invention.
  • Figure 7 is a schematic structural view of a safety protection device according to the present invention.
  • Figure 8 is a schematic structural view of a safety protection device according to the present invention.
  • Figure 9 is a schematic view showing the structure of a safety protection device according to the present invention.
  • An embodiment of the present invention provides a security protection method, as shown in FIG. 1A and FIG. 1B, including:
  • a virtual operating system is run in the operating system (OS) system, and the virtual operating system runs in the isolated operating environment, and the virtual operating system in the isolated operating environment runs the first process.
  • the second process runs in the OS.
  • the first process is started in the virtual operating system, and the second process is started in the real operating system; after receiving the operation instruction from the user, the operation instruction is redirected to the first process;
  • the redirection is to send all the operation instructions input by the user to the virtual operating system side first, so that the operation instruction is sent to the corresponding process in the virtual operating system.
  • Determining the operation instruction is directed to the second process, which may be determined by the operation object of the operation instruction, or may be determined according to the identification information used in the operation instruction for indicating that it needs to be sent to the isolated operation environment, and how to determine the operation instruction
  • the second process may be determined by the operation object of the operation instruction, or may be determined according to the identification information used in the operation instruction for indicating that it needs to be sent to the isolated operation environment, and how to determine the operation instruction
  • the first process in the embodiment of the present invention is a receiver of the operation instruction, and can receive an operation instruction of the user.
  • the first process runs in an isolated operation environment, and the operation instruction is restricted to the isolated operation environment, and can provide a centralized defense function. Since the first process also has the ability to send the operation instruction to the isolation mechanism, and the second process executes the operation instruction after the verification is passed, the execution is refused; therefore, the user can operate the second process through the isolated operating environment.
  • the instruction extends the application scope of the isolated operating environment to conform to application scenarios such as FM. Therefore, the embodiments of the present invention provide a security protection scheme with a wide range of defense points and a wide range of applications.
  • the executable command can be centrally managed in the form of a command set, as follows: Before the foregoing determining whether the operation instruction is an executable command, the method further includes: running the second process to obtain an executable command set;
  • the determining that the operation instruction is an executable command includes: determining whether the operation instruction belongs to the executable command set.
  • the executable command set may be related to the user, or may be related to the type of the user, such as a visitor, a normal, an administrator, etc., or may be related to the type of the operation instruction, for example, An operation instruction that causes damage to the system, such as a normal read operation instruction.
  • the executable command set can be stored on the real operating system side in a preset manner.
  • the centralized management of the command set may be performed by using a whitelist in the form of a whitelist.
  • the specific implementation scheme is as follows: the foregoing running the foregoing second process to determine the executable command set includes: running the foregoing second process to determine a white list corresponding to the user who sent the above operation instruction;
  • the foregoing determining that the foregoing operation instruction belongs to the executable command set includes:
  • the operation instruction may be used to install a software or the like.
  • the embodiment of the present invention further provides a specific operation instruction format and a corresponding authentication mode, as follows: : general call instructions and command parameters;
  • the determining whether the operation instruction belongs to the executable command includes: running a second process to acquire signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determining whether the signature information can be verified by using the public key. by;
  • the executing the above operation instruction includes: running the second process to execute the life command in the operation instruction The operation command specified by the parameter.
  • the first process side may determine that the operation instruction needs to be sent outside the isolated operating environment by using a keyword of the general call instruction.
  • the first process and the second process need to penetrate the isolated operating environment.
  • This embodiment provides an implementation solution of the optional transparent isolated operating environment, as follows: the foregoing sending the foregoing operation instruction to the second process includes: :
  • the first process is executed to send the operation instruction to the command server corresponding to the second process by using a command agent located in the isolated running environment.
  • the operation command is transmitted by using the command agent and the command server, so there is a communication connection between the command server and the command agent.
  • the embodiment further provides a specific optional communication connection solution, which is as follows: Before the first process is sent to the command server corresponding to the second process by using the command agent located in the isolated operating environment, the first process includes:
  • IP Internet Protocol
  • IPC Insulation Piercing connection
  • an optional implementation scheme in which a communication connection exists between the command server and the command proxy is provided, wherein in the latter two communication modes, the shared storage space is used, and in the embodiment, the storage space is preferably used.
  • the executing the foregoing operation instruction includes: acquiring the content data required for executing the operation instruction from the shared storage space located in the isolated running environment during the execution of the second process to execute the operation instruction.
  • the sandbox provides a more common isolated operating environment.
  • the sandbox is taken as an example to illustrate the embodiment of the present invention.
  • the first process corresponds to a program and a function module on a virtual file system (VRF) side
  • the second process corresponds to a real file system (Real).
  • the embodiment of the present invention needs to start a sandbox service on a real operating system (OS), and all logins to the real OS are redirected to the sandbox.
  • OS real operating system
  • an operation command directed to the real OS is passed through the sandbox by means of a proxy.
  • Files required by the file system can be mapped to the sandbox through the file mapping mechanism.
  • the sandbox refers to an application having an isolation characteristic, and provides an isolated operating environment.
  • the sandbox creation process in the embodiment of the present invention may be as follows: First, create a small virtual OS on the real file system, including the OS. The underlying directory and files; then, redirect all logged in users to the virtual OS system. Similar applications with isolation features include Docker, Linux NameSpace, etc., and the solution of the present invention can be implemented by using the Sanbox as an example to introduce the solution of the present invention.
  • the system shown in Figure 2 and Figure 3 below provides a shell command and shared storage space for the user to execute in the sandbox.
  • the shared storage space can store shared data when logging in to the sandbox.
  • the shell command is received by the first program and transferred to the command agent (Cmd-Agent), and sent to the real OS through the Cmd-Agent.
  • the user views the shared storage.
  • Shell commands can include, but are not limited to, ps, df, upgrade.
  • the second program receives the command forwarded by the Cmd-Agent, and the second program judges whether the command sent by the command agent can be used by the command recorded in the Customer Cmd-list. carried out.
  • the command server (Cmd-Server) on the real OS side first receives the command sent by the Cmd-Agent, and the command server passes the command recorded in the user command list (Customer Cmd-list). To determine whether the command sent by the command agent can be executed, if it can be executed, the Cmd-Server forwards the received command to the second program.
  • the shared storage space in FIG. 2 and FIG. 3 above is optional. If the command proxy and the command server are implemented by using a TCP connection, there may be no shared storage space.
  • the following embodiments will illustrate the command proxy mechanism, whitelist control, and software security protection in the sandbox, respectively.
  • the command agent mainly involves the Cmd-Agent built in the sandbox and runs in the RRF.
  • Cmd-Server the sandbox is in the VRF environment, so the Cmd-Agent is built in the VRF environment; the Cmd-Agent and the Cmd-Server can establish a communication connection through the Transmission Control Protocol (TCP); the user is in the sandbox.
  • TCP Transmission Control Protocol
  • the command issued in the Cmd-Server is sent to the Cmd-Server, and the agent is executed in the RRF.
  • the execution result message is sent to the Cmd-Agent through the Cmd-Server to return to the sandbox.
  • the specific flow chart 4 shows:
  • the user requests execution of cmd-xxx in a sandbox on the VRF side, for example, executing a ps command, which is obtained by the first program.
  • the first program forwards the obtained PS command to a command agent (Cmd-Agent).
  • the Cmd-Agent forwards the PS command to the command server (Cmd-Server) on the RRF.
  • Cmd-Server preloads the whitelist, and Cmd-Server determines whether the PS command exists in the whitelist. If it does not exist, it may prompt “The command does not exist”; if it exists, forward the PS command to the second program;
  • the second program executes the corresponding command in the RRF according to the configuration in the whitelist to obtain an execution result, and then returns the execution result to the first program on the user side.
  • the communication mode of the Cmd-Agent and the Cmd-server is a communication connection established by the TCP protocol.
  • the communication manner between the Cmd-Agent and the Cmd-server may be:
  • IP Internet Protocol
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • SCTP Stream Control Transmission Protocol
  • pipes / files such as: Cmd-server and Cmd_Agent message exchange through a pipe / file named 127001_input / out, where the pipe / file of 127001_input / out is shared for Sanbox or real OS.
  • IPC Insulation Piercing Connection
  • the whitelist control is preset configuration information for determining whether the operation instruction sent by the VRF side belongs to the executable command on the RRF side.
  • the above configuration indicates that the /var/log directory on the RRF is mapped to the /var/log directory in the sandbox, and the mapping authority is 755.
  • the configuration of the RRF is shared with the sandbox.
  • # ⁇ VRF generally used to ensure that the sandbox command execution experience is consistent with RRF.
  • the above configuration means that the vsftpd command in the sandbox is the proxy for the #/opt/goku/service/ha/module/harm/plugin/script/vsftpd.sh command in the RRF, that is, the final execution of the vsftpd command is #RFF .
  • the root root indicates that the #/opt/goku/service/ha/module/harm/plugin/script/vsftpd.sh command is executed as the root user and root group in the RRF. If it is "--" (for example, the #passwd command in the above list), it means that the corresponding command is executed in the RRF as the login sandbox user and user group.
  • the user needs to install software on the OS (RRF side).
  • This embodiment satisfies this requirement, and provides a universal Anycmd command to prevent illegal users from installing malware or executing malicious scripts.
  • the user can use this command to execute commands in any RRF in the sandbox, but signature verification is required before executing the commands in the RRF.
  • the administrator can use a tool such as Openssl to generate a public-private key pair.
  • the public key can be uploaded to the real OS through the updateCA command.
  • User custody The detailed process of the user executing any command is as shown in Figure 5, taking the install command as an example, the install command and the command that the user will be executed.
  • the signature file is uploaded to the specified location in the system (shared data area).
  • the user needs to send the Anycmd command to the RRF, the user will use the private key held by the user to sign the command to be executed.
  • the specific process is as follows:
  • Anycmd install command to the command agent (Cmd-Agent) through the first program running in the sandbox on the VRF side; wherein Anycmd is an arbitrary command keyword, and install is an Anycmd parameter.
  • the Cmd-Agent penetrates the sandbox to forward the Anycmd install to the Cmd-Server.
  • the Cmd-Server preloads the whitelist and determines whether the user has the right of Anycmd install through the whitelist. If so, the Cmd-Server calls the Anycmd command to send the parameter install to the second program. Understandably, if not, you can refuse to execute Anycmd install.
  • the second program reads the signature information in the command directory corresponding to the install parameter, and uses the public key preset by the user to perform signature verification. If the verification fails, the “illegal command” is prompted. If the verification succeeds, the install parameter is executed. Operational commands.
  • the embodiment of the invention further provides a security protection device, as shown in FIG. 6, comprising:
  • the system control unit 601 is configured to start a real operating system, create a virtual operating system in the real operating system, and place the virtual operating system in an isolated operating environment;
  • the process startup unit 602 is configured to start a first process in the virtual operating system, and start a second process in the real operating system.
  • the instruction orientation unit 603 is configured to redirect the operation instruction to the first process after receiving an operation instruction from the user;
  • the first control unit 604 is configured to: run the foregoing first process and determine that the operation instruction is directed to the second process, and send the operation instruction to the second process;
  • the second control unit 605 is configured to: after the foregoing second process receives the operation instruction from the first process, determine whether the operation instruction belongs to an executable command, and if yes, execute the operation instruction, otherwise refuse to execute the operation instruction.
  • the redirection is to send all the operation instructions input by the user to the virtual operating system side first, so that the operation instruction is sent to the corresponding process in the virtual operating system.
  • Determining that the operation instruction points to the second process which may be determined by the operation object of the operation instruction, It may be determined according to the identification information used in the operation instruction to indicate that it needs to be sent to the isolated operating environment. How to determine the operation instruction needs to be sent to the isolated operating environment is not limited in this embodiment.
  • the first process in the embodiment of the present invention is a receiver of the operation instruction, and can receive an operation instruction of the user.
  • the first process runs in an isolated operation environment, and the operation instruction is restricted to the isolated operation environment, and can provide a centralized defense function. Since the first process also has the ability to send the operation instruction to the isolation mechanism, and the second process executes the operation instruction after the verification is passed, the execution is refused; therefore, the user can operate the second process through the isolated operating environment.
  • the instruction extends the application scope of the isolated operating environment to conform to application scenarios such as FM. Therefore, the embodiments of the present invention provide a security protection scheme with a wide range of defense points and a wide range of applications.
  • the executable command can be centrally managed in the form of a command set, as follows:
  • the second control unit 605 includes:
  • a command set obtaining unit 701, configured to acquire an executable command set
  • the instruction determining unit 702 is configured to determine whether the above operation instruction belongs to the executable command set.
  • the executable command set may be related to the user, or may be related to the type of the user, such as a visitor, a normal, an administrator, etc., or may be related to the type of the operation instruction, for example, An operation instruction that causes damage to the system, such as a normal read operation instruction.
  • the executable command set can be stored on the real operating system side in a preset manner.
  • the rights management may be performed on each user in the form of a whitelist.
  • the specific implementation is as follows: the command set obtaining unit 701 is specifically configured to determine a user corresponding to the user that sends the operation instruction. whitelist;
  • the above-mentioned instruction determining unit 702 is specifically configured to determine whether the operation instruction belongs to an instruction that is allowed to be executed specified in the white list.
  • the operation instruction may be used to install a software or the like.
  • the embodiment of the present invention further provides a specific operation instruction format and a corresponding authentication mode, as follows: : general call instructions and command parameters;
  • the second control unit 605 is specifically configured to: run a second process to obtain signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determine whether the signature information can be verified by using the public key; Running the above second process to execute the above operation instructions The operation command specified by the parameter.
  • the first process side may determine that the operation instruction needs to be sent outside the isolated operating environment by using a keyword of the general call instruction.
  • the first process and the second process need to penetrate the isolated operating environment.
  • This embodiment provides an implementation solution of the optional transparent isolated operating environment, as follows: as shown in FIG. 8, the foregoing security protection device further The command agent 801 is located in the above-mentioned isolated operating environment, and the command server 802 corresponding to the second process is located outside the isolated operating environment;
  • the first control unit 604 is configured to send the operation command to the command server 802 corresponding to the second process by using the command agent 801 located in the isolated operating environment.
  • the operation command is transmitted by using the command agent and the command server, so there is a communication connection between the command server and the command agent.
  • the embodiment further provides a specific optional communication connection scheme, as follows:
  • the proxy server 501 is configured to establish a communication connection between the command proxy and the command server 802 by means of a loopback internet protocol IP communication of a network communication protocol, a named pipe/file, or an insulation piercing connection IPC call.
  • an optional implementation scheme in which a communication connection exists between the command server and the command proxy is provided, wherein in the latter two communication modes, the shared storage space is used, and in the embodiment, the storage space is preferably used.
  • the second control unit 605 is further configured to: when the second process is executed to execute the operation instruction, obtain content data required for executing the operation instruction from a shared storage space located in the isolated operating environment.
  • the embodiment of the present invention further provides a security protection device, as shown in FIG. 9, including: an input device 901, a processor 902, and a memory 903, wherein the memory 903 can be used for data buffering in the data processing process of the processor 902.
  • the storage space required by the processor 902 to call the process during data processing may also be provided;
  • the input device 901 is configured to receive an operation instruction from a user.
  • the processor 902 is configured to start a real operating system and create a virtual object in the real operating system.
  • the operating system is prepared, and the virtual operating system is placed in an isolated running environment; the first process is started in the virtual operating system, and the second process is started in the real operating system; and the input device 901 receives the operation from the user.
  • the instruction redirecting the operation instruction to the first process; after running the first process and determining that the operation instruction is directed to the second process, sending the operation instruction to the second process; running the second process receiving from the above
  • the redirection is to send all the operation instructions input by the user to the virtual operating system side first, so that the operation instruction is sent to the corresponding process in the virtual operating system.
  • Determining the operation instruction is directed to the second process, which may be determined by the operation object of the operation instruction, or may be determined according to the identification information used in the operation instruction for indicating that it needs to be sent to the isolated operation environment, and how to determine the operation instruction
  • the second process may be determined by the operation object of the operation instruction, or may be determined according to the identification information used in the operation instruction for indicating that it needs to be sent to the isolated operation environment, and how to determine the operation instruction
  • the first process in the embodiment of the present invention is a receiver of the operation instruction, and can receive an operation instruction of the user.
  • the first process runs in an isolated operation environment, and the operation instruction is restricted to the isolated operation environment, and can provide a centralized defense function. Since the first process also has the ability to send the operation instruction to the isolation mechanism, and the second process executes the operation instruction after the verification is passed, the execution is refused; therefore, the user can operate the second process through the isolated operating environment.
  • the instruction extends the application scope of the isolated operating environment to conform to application scenarios such as FM. Therefore, the embodiments of the present invention provide a security protection scheme with a wide range of defense points and a wide range of applications.
  • the executable command can be centrally managed in the form of a command set, as follows:
  • the processor 902 is further configured to run the foregoing second process to obtain an executable command before determining whether the operation instruction belongs to the executable command. Set; then, determine if the above operation instruction belongs to the above executable command set.
  • the executable command set may be related to the user, or may be related to the type of the user, such as a visitor, a normal, an administrator, etc., or may be related to the type of the operation instruction, for example, An operation instruction that causes damage to the system, such as a normal read operation instruction.
  • the executable command set can be stored on the real operating system side in a preset manner.
  • the way to centrally manage the command set can be done for each user in the form of a white list.
  • the privilege management is as follows: the processor 902 is configured to: run the foregoing second process to determine a whitelist corresponding to the user that sends the operation instruction; and determine whether the operation instruction belongs to the allowed execution specified in the whitelist. instruction.
  • the operation instruction may be used to install a software or the like.
  • the embodiment of the present invention further provides a specific operation instruction format and a corresponding authentication mode, as follows: : general call instructions and command parameters;
  • the processor 902 is specifically configured to: run a second process to obtain signature information corresponding to the command parameter, and a public key corresponding to the universal call instruction, and then determine whether the signature information can be verified by using the public key; The second process executes the operation command specified by the command parameter in the above operation instruction.
  • the first process side may determine that the operation instruction needs to be sent outside the isolated operating environment by using a keyword of the general call instruction.
  • the first process and the second process need to penetrate the isolated operating environment.
  • This embodiment provides an implementation solution of the optional transparent isolated operating environment, as follows:
  • the processor 902 is specifically configured to run the foregoing A process sends the operation instruction to the command server corresponding to the second process by using a command agent located in the isolated running environment.
  • the operation command is transmitted by using the command agent and the command server. Therefore, there is a communication connection between the command server and the command agent.
  • This embodiment further provides a specific optional communication connection solution, as follows: The device 902 is further configured to: before running the first process, send the operation command to the command server corresponding to the second process by using a command agent located in the isolated operating environment, and use the network communication protocol to perform loopback internet protocol IP communication, A well-known pipe/file, or an insulated piercing connection IPC call establishes a communication connection between the above command agent and the above command server.
  • an optional implementation scheme in which a communication connection exists between the command server and the command proxy is provided, wherein in the latter two communication modes, the shared storage space is used, and in the embodiment, the storage space is preferably used.
  • the processor 902 is further configured to run the foregoing second process to execute the foregoing operation instruction,
  • the content data required to execute the above operation instruction is obtained in the shared storage space located in the above-mentioned isolated running environment.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Read Only Memory (ROM), Random Access Memory (RAM), disk or optical disk.
  • ROM Read Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种安全防护方法，及装置，其中方法的实现包括：启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；在接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。本发明实施例提供了防御点集中，并且应用范围广泛的安全防护方案。

Description

一种安全防护方法，及装置 技术领域
本发明涉及存储技术领域，具体涉及一种安全防护方法，及装置。
背景技术
沙箱(Sandbox)提供了程序的隔离运行环境，其目的是限制不可信任的应用程序的权限。沙箱技术经常被用于执行未经测试的或不可信任的应用程序。为了避免不可信任的应用程序破坏其它程序的运行，沙箱技术通过为不可信任的应用程序提供虚拟化的磁盘、内存以及网络资源，而这种虚拟化手段对应用程序来说是透明的。由于沙箱里的资源被虚拟化(或称为被间接化)，所以沙箱里的不可信任的应用程序的恶意行为会被限制在沙箱中。
采用沙箱方案的流程如下：首先在系统中建立一个简化的虚拟文件系统，并创建登录用户；当用户登录时，自动进入虚拟文件系统中，用户的任何文件访问都被限制在虚拟文件系统中。
在沙箱创建完毕后，用户登录后，用户管理模块将用户转移到Sandbox中，用户看到的文件系统是虚拟文件系统。用户只能对虚拟文件系统发送命令，命令也只会被虚拟文件系统执行。
基于以上介绍，沙箱的应用场景是将不可信任的应用程序隔离在沙箱中运行，防止不可信任的应用影响真实操作系统(Operating System，OS)系统。该应用场景无法满足云管理系统(Fusion Manager，FM)等的应用场景，如：FM系统是运行在真实的OS之上，而FM的需求是对真实的OS系统做进一步保护，要求登录系统的用户可查看指定的真实OS的文件内容，防止敏感信息泄露；并且要求可执行真实OS上的命令等。然而目前的沙箱应用范围较窄，不适用FM等应用场景，为这些场景下的程序提供安全防护。
发明内容
本发明实施例提供一种安全防护方法，及装置，用于提供防御点集中，应用范围广泛的安全防护方案。
本发明实施例一方面提供了一种安全防护方法， 包括：
启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；
在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；在接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；
运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；
运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
结合一方面的实现方式，在第一种可选的实现方式中，所述确定所述操作指令是否属于可执行命令之前，所述方法还包括：运行所述第二进程获取可执行命令集；
所述确定所述操作指令属于可执行命令包括：确定所述操作指令是否属于所述可执行命令集。
结合一方面的第一种可选的实现方式，在第二种可选的实现方式中，所述运行所述第二进程确定可执行命令集包括：运行所述第二进程确定与发送所述操作指令的用户对应的白名单；
所述确定所述操作指令属于所述可执行命令集包括：
确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
结合一方面的实现方式，在第三种可选的实现方式中，所述操作指令包括：通用调用指令和命令参数；
所述确定所述操作指令是否属于可执行命令包括：运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；
所述执行所述操作指令包括：运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
结合一方面、一方面的第一种、第二种或者第三种可选的实现方式，在第四种可选的实现方式中，其特征在于，所述向所述第二进程发送所述操作指令 包括：
运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
结合一方面的第四种可能的实现方式，在第五种可选的实现方式中，在运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器之前，还包括：
以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
结合一方面的第五种可能的实现方式，在第六种可选的实现方式中，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
所述执行所述操作指令包括：运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
本发明实施例二方面提供了一种安全防护装置，包括：
系统控制单元，用于启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；
进程启动单元，用于在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；
指令定向单元，用于在接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；
第一控制单元，用于运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；
第二控制单元，用于运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
结合二方面的实现方式，在第一种可选的实现方式中，所述第二控制单元，包括：
命令集获取单元，用于获取可执行命令集；
指令确定单元，用于确定所述操作指令是否属于所述可执行命令集。
结合二方面的第一种可选的实现方式，在第二种可选的实现方式中，
所述命令集获取单元，具体用于确定与发送所述操作指令的用户对应的白名单；
所述指令确定单元，具体用于确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
结合二方面的实现方式，在第三种可选的实现方式中，所述操作指令包括：通用调用指令和命令参数；
所述第二控制单元，具体用于运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
结合二方面、二方面的第一种、第二种或者第三种可选的实现方式，在第四种可选的实现方式中，所述安全防护装置还包括：位于所述隔离运行环境内的命令代理，以及位于所述隔离运行环境外与所述第二进程对应的命令服务器；
所述第一控制单元，具体用于运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
结合二方面的第四种可能的实现方式，在第五种可选的实现方式中，
所述命令代理服务器，用于以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
结合二方面的第五种可能的实现方式，在第六种可选的实现方式中，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
所述第二控制单元，还用于运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
本发明实施例三方面还提供了一种安全防护装置，包括：输入设备，处理 器和存储器，
所述输入设备，用于接收来自用户的操作指令；
所述处理器，用于启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；在所述输入设备接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
结合三方面的实现方式，在第一种可选的实现方式中，
所述处理器，还用于在确定所述操作指令是否属于可执行命令之前，运行所述第二进程获取可执行命令集；然后，确定所述操作指令是否属于所述可执行命令集。
结合三方面的第一种可选的实现方式，在第二种可选的实现方式中，
所述处理器，具体用于运行所述第二进程确定与发送所述操作指令的用户对应的白名单；确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
结合三方面的实现方式，在第三种可选的实现方式中，所述操作指令包括：通用调用指令和命令参数；
所述处理器，具体用于运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
结合三方面、三方面的第一种、第二种或者第三种可选的实现方式，在第四种可选的实现方式中，
所述处理器，具体用于运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
结合三方面的第四种可能的实现方式，在第五种可选的实现方式中，
所述处理器，还用于在运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器之前，以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
结合三方面的第五种可能的实现方式，在第六种可选的实现方式中，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
所述处理器，还用于运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
本发明实施例中的第一进程是操作指令的接收方，可以接收用户的操作指令，第一进程运行在隔离运行环境下，操作指令被限制在隔离运行环境下，可以提供集中防御的功能。由于第一进程还具备了将操作指令发送到隔离机制之外的能力，并且第二进程在验证通过后执行操作指令，否则拒绝执行；因此，用户可以透过隔离运行环境对第二进程下操作指令，扩展了隔离运行环境的应用范围，使之符合FM等应用场景。因此本发明实施例提供了防御点集中，并且应用范围广泛的安全防护方案。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1A是本发明实施方法流程示意图；
图1B是本发明实施系统结构示意图；
图2为本发明实施例系统结构示意图；
图3为本发明实施例系统结构示意图；
图4是本发明实施方法流程示意图；
图5是本发明实施方法流程示意图；
图6是本发明实施安全防护装置结构示意图；
图7是本发明实施安全防护装置结构示意图；
图8是本发明实施安全防护装置结构示意图；
图9是本发明实施安全防护装置结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例提供一种安全防护方法，如图1A和图1B所示，包括：
101：启动真实操作系统，在上述真实操作系统中创建虚拟操作系统，并将上述虚拟操作系统置于隔离运行环境中；
在图1B所示的系统结构中，真实操作系统(Operating System，OS)系统内运行了虚拟操作系统，虚拟操作系统在隔离运行环境中，隔离运行环境中的虚拟操作系统运行了第一进程，OS中运行了第二进程。
102：在上述虚拟操作系统中启动第一进程，在上述真实操作系统中启动第二进程；在接收到来自用户的操作指令后，将上述操作指令重定向到上述第一进程；
重定向是将用户输入的所有操作指令，首先发往虚拟操作系统一侧，使操作指令发往虚拟操作系统中对应的进程。
103：运行上述第一进程并确定上述操作指令指向上述第二进程后，向上述第二进程发送上述操作指令；
确定操作指令指向第二进程，可以是通过操作指令的操作对象确定的，也可以是根据通过操作指令中用于指示需要发往隔离运行环境以外执行的标识性信息确定，具体如何确定操作指令需要发往隔离运行环境外，本实施例不作唯一性限定。
104：运行上述第二进程接收来自上述第一进程的上述操作指令后，确定上述操作指令是否属于可执行命令，若是则执行上述操作指令，否则拒绝执行 上述操作指令。
本发明实施例中的第一进程是操作指令的接收方，可以接收用户的操作指令，第一进程运行在隔离运行环境下，操作指令被限制在隔离运行环境下，可以提供集中防御的功能。由于第一进程还具备了将操作指令发送到隔离机制之外的能力，并且第二进程在验证通过后执行操作指令，否则拒绝执行；因此，用户可以透过隔离运行环境对第二进程下操作指令，扩展了隔离运行环境的应用范围，使之符合FM等应用场景。因此本发明实施例提供了防御点集中，并且应用范围广泛的安全防护方案。
在本实施例中，可以通过命令集的形式集中管理可执行命令，具体如下：上述确定上述操作指令是否属于可执行命令之前，上述方法还包括：运行上述第二进程获取可执行命令集；
上述确定上述操作指令属于可执行命令包括：确定上述操作指令是否属于上述可执行命令集。
在本实施例中，可执行命令集可以是与用户相关的，也可以是与用户所属的类型如：访客、普通、管理员等，还可以是与操作指令的类型相关的，例如：不会对系统造成损害类别的操作指令，例如：普通的读取操作指令等。可执行命令集可以采用预置的方式存储在真实操作系统一侧。
可选地，集中管理命令集的方式，可以通过白名单的形式对每一个用户进行权限管理，具体实现方案如下：上述运行上述第二进程确定可执行命令集包括：运行上述第二进程确定与发送上述操作指令的用户对应的白名单；
上述确定上述操作指令属于上述可执行命令集包括：
确定上述操作指令是否属于上述白名单中指定的允许执行的指令。
在本实施例中，操作指令可以用于安装软件等类型的操作，针对此类应用环境，本发明实施例还提供了特定的操作指令格式以及对应的鉴权方式，具体如下：上述操作指令包括：通用调用指令和命令参数；
上述确定上述操作指令是否属于可执行命令包括：运行第二进程获取与上述命令参数对应的签名信息，以及与上述通用调用指令对应的公钥，然后确定使用上述公钥对上述签名信息是否能够验证通过；
上述执行上述操作指令包括：运行上述第二进程执行上述操作指令中的命 令参数指定的操作命令。
在本实施例中，第一进程一侧可以是通过通用调用指令的关键字确定该操作指令需要发往隔离运行环境之外。
在本实施例中，第一进程和第二进程需要穿透隔离运行环境，本实施例提供了可选的穿透隔离运行环境的实现方案，如下：上述向上述第二进程发送上述操作指令包括：
运行上述第一进程通过位于上述隔离运行环境内的命令代理将上述操作指令发送给上述第二进程对应的命令服务器。
在前一实施例中，操作指令采用命令代理以及命令服务器进行传递，因此命令服务器和命令代理之间会存在通信连接，本实施例还提供了具体可选的通信连接方案，具体如下：在运行上述第一进程通过位于上述隔离运行环境内的命令代理将上述操作指令发送给上述第二进程对应的命令服务器之前，还包括：
以网络通讯协议的环回网际协议(Internet Protocol，IP)通讯、有名管道/文件，或者绝缘刺穿连接(Insulation piercing connection，IPC)调用的方式建立上述命令代理与上述命令服务器之间的通信连接。
在前一实施例中提供了命令服务器和命令代理之间会存在通信连接的可选实现方案，其中在后两种通信方式中，会使用到共享存储空间，在本实施例中优选将存储空间设置在隔离运行环境内部，具体如下：若上述命令代理与上述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
上述执行上述操作指令包括：运行上述第二进程执行上述操作指令过程中，从位于上述隔离运行环境内的共享存储空间中获取执行上述操作指令所需要的内容数据。
沙箱提供了一种较为常用的隔离运行环境，在后续实施例中将以沙箱为例对本发明实施例进行举例说明，能够提供隔离运行环境的方案还有很多，例如：Docker，Linux NameSpace等，因此沙箱不应理解为对本发明实施例的唯一性限定。在后续实施例的举例中第一进程对应虚拟文件系统(Virtual Root Filesystem，VRF)一侧的程序和功能模块，第二进程对应真实文件系统(Real  Root Filesystem，RRF)一侧的程序和功能模块。
本发明实施例需要在真实的操作系统(Operating System，OS)上启动一个沙箱服务，所有针对上述真实OS的登录，都重定向到沙箱中。另外，将指向真实OS的操作命令通过代理的方式穿透沙箱。文件系统需要的文件则可以通过文件映射机制映射到沙箱中。
在本实施例中，沙箱是指具有隔离特性的应用，提供了隔离运行环境，本发明实施例中的沙箱的创建过程可以如下：首先在真实文件系统上创建一个小虚拟OS，包含OS的基础目录与文件；然后，将所有登录的用户重定向到虚拟OS系统。类似的具有隔离特性的应用还有Docker，Linux NameSpace等，本发明方案可以采用它们为来实现，下面就以Sanbox为样例，介绍本发明方案。
如下图2和图3所示的系统，在沙箱中提供了可供用户执行的壳(shell)命令以及共享存储空间，在共享存储空间中可以存放共享数据，当登录到沙箱中的用户需要执行shell命令时，shell命令由第一程序接收到转给命令代理(Cmd-Agent)，通过Cmd-Agent发送到真实OS上执行；图2和图3所示的系统中，用户查看共享存储空间中的共享数据时，相当于查看真实OS上的数据。Shell命令可以包括但不限于ps，df，upgrade。
如果采用图2所示的结构，那么第二程序会接收到Cmd-Agent转发的命令，第二程序通过用户命令列表(Customer Cmd-list)中记录的命令来判断命令代理发送的命令是否能够被执行。
如果采用图3所示的结构，那么在真实OS一侧命令服务器(Cmd-Server)会先接收到Cmd-Agent发送的命令，命令服务器会通过用户命令列表(Customer Cmd-list)中记录的命令来判断命令代理发送的命令是否能够被执行，如果能该执行那么Cmd-Server将接收到的命令转发给第二程序。
以上图2和图3中的共享存储空间是可选的，如果命令代理和命令服务器采用TCP连接等方式实现，则可以没有共享存储空间。
以下实施例将分别就沙箱中命令代理机制、白名单控制以及软件安全防护进行举例说明。
一、以下实施例将结合图4对本发明实施例沙箱中命令代理机制进行说明。
命令代理主要涉及的是内置于沙箱中的Cmd-Agent和运行在RRF中的 Cmd-Server；沙箱采用的是VRF环境下，因此Cmd-Agent内置于VRF环境下；Cmd-Agent与Cmd-Server可以通过传输控制协议(Transmission Control Protocol，TCP)建立通信连接；用户在沙箱中发出的命令通过Cmd-Agent发送到Cmd-Server，从而代理到RRF中执行，执行结果报文再通过Cmd-Server发送到Cmd-Agent从而返回到沙箱。具体流程图4所示：
401：用户通过在VRF一侧的沙箱中请求执行cmd-xxx，例如执行执行ps命令，PS命令由第一程序获得。
402：第一程序将获得的PS命令转发给命令代理(Cmd-Agent)。
403：Cmd-Agent将PS命令转发给RRF上的命令服务器(Cmd-Server)。
404：Cmd-Server会预加载白名单，Cmd-Server判断PS命令是否存在于白名单中，如果不存在，可以提示“该命令不存在”；如果存在，则将PS命令转发给第二程序；
405：第二程序则按照白名单中的配置，执行RRF中对应的命令得到执行结果，然后返回执行结果给用户侧的第一程序。
在本实施例中，Cmd-Agent与Cmd-server的通讯方式是采用的是TCP协议建立的通信连接。在本实施例中，Cmd-Agent与Cmd-server的通讯方式可以是：
1、互联网协议(Internet Protocol，IP)、TCP、用户数据报文协议(User Datagram Protocol ，UDP)，或者流控制传送协议(Stream Control Transmission Protocol，SCTP)等网络通讯协议，通过环回IP通讯。如：Cmd-server监听在127.0.0.1:12345端口上，Cmd-Agent与127.0.0.1:12345建立TCP链接并进行通信。
2、有名管道/文件，如：Cmd-server和Cmd_Agent通过名为127001_input/out的管道/文件进行消息交互，其中127001_input/out的管道/文件对于Sanbox或真实OS是共享的。
3、绝缘刺穿连接(Insulation Piercing Connection，IPC)系统调用，如内核消息队列，共享内存。更具体地，例如：Cmd-server和Cmd_Agent通过名为127001_input/out的消息队列/共享内存块进行消息交互，其中127001_input/out的消息队列/共享内存块对于Sanbox或真实OS是共享的。
二、白名单控制，白名单是预置的用于RRF一侧确定VRF一侧发送来的操作指令是否属于可执行命令的配置信息。
下面截取了本发明实施例中的白名单的几个关键部分：共享数据、命令硬链接、命令白名单，详细解释见下表所示：
#bind directory
bind /var/log /var/log 0755 0 0 nodev,noexec
#上述配置表示将RRF上的/var/log目录映射到沙箱中的/var/log目录，映射权限为755，通过该配置#实现了RRF的数据与沙箱的共享。
#hard link or copy file
hlink /bin/ls /bin/ls 0755 0 0
#上述配置表示将RRF上的/bin/ls命令链接到沙箱中，使沙箱中也具备了ls命令，但是该命令的执
#行空间为VRF，一般用于保证沙箱的命令执行体验与RRF一致。
#command list
cmd root root vsftpd /opt/goku/service/ha/module/harm/plugin/script/vsftpd.sh
cmd - - passwd /usr/bin/passwd
#上述配置表示沙箱中的vsftpd命令是RRF中#/opt/goku/service/ha/module/harm/plugin/script/vsftpd.sh命令的代理，也即vsftpd命令的最终执行空#间为RRF。其中“root root”表示在RRF中以root用户、root组的身份执行#/opt/goku/service/ha/module/harm/plugin/script/vsftpd.sh命令。如果为“--”(举例：上述列表中#passwd命令)则表示以登录沙箱用户、用户组的身份在RRF中来执行相应命令。
三、软件安装防护
在实际应用场景下，用户存在在OS(RRF一侧)上安装软件的需求，本实施例为满足这一需求，同时为了防止非法用户安装恶意软件或执行恶意脚本提供了一个通用的Anycmd命令，用户可以通过该命令在沙箱中执行任意RRF中的命令，但是在RRF中执行命令之前需要做签名验证。
本实施例执行之前需要预置一些信息，具体如下：在真实的OS安装完成之后，管理员可以使用Openssl等工具生成公私钥对，公钥可以通过updateCA命令上传到真实的OS中，私钥由用户保管。用户在执行任意命令的详细流程如下图5所示，以执行install命令为例，用户将要被执行的install命令及该命令 的签名文件上传到系统中指定位置(共享数据区)。用户需要向RRF发送Anycmd类的命令时，使用用户自己保管的私钥对将要执行的命令进行签名。具体流程如下：
501：用户通过在VRF一侧的沙箱中运行的第一程序向命令代理(Cmd-Agent)发送Anycmd install命令；其中Anycmd为执行任意命令关键字，install是Anycmd的参数。
502：Cmd-Agent穿透沙箱将Anycmd install转发给Cmd-Server。
503：Cmd-Server会预加载白名单，并通过白名单确定上述用户是否具有Anycmd install的权限，如果有，Cmd-Server调用Anycmd命令将参数install传入第二程序。可以理解的是，如果没有，则可以拒绝执行Anycmd install。
504：第二程序在install参数对应的命令目录读取签名信息，并使用用户预置的公钥进行签名验证，如果验证失败，则提示“非法命令”，如果验证成功，则执行install参数对应的操作命令。
505：逐级返回Anycmd install的执行结果报文给用户。
本发明实施例还提供了一种安全防护装置，如图6所示，包括：
系统控制单元601，用于启动真实操作系统，在上述真实操作系统中创建虚拟操作系统，并将上述虚拟操作系统置于隔离运行环境中；
进程启动单元602，用于在上述虚拟操作系统中启动第一进程，在上述真实操作系统中启动第二进程；
指令定向单元603，用于在接收到来自用户的操作指令后，将上述操作指令重定向到上述第一进程；
第一控制单元604，用于运行上述第一进程并确定上述操作指令指向上述第二进程后，向上述第二进程发送上述操作指令；
第二控制单元605，用于运行上述第二进程接收来自上述第一进程的上述操作指令后，确定上述操作指令是否属于可执行命令，若是则执行上述操作指令，否则拒绝执行上述操作指令。
重定向是将用户输入的所有操作指令，首先发往虚拟操作系统一侧，使操作指令发往虚拟操作系统中对应的进程。
确定操作指令指向第二进程，可以是通过操作指令的操作对象确定的，也 可以是根据通过操作指令中用于指示需要发往隔离运行环境以外执行的标识性信息确定，具体如何确定操作指令需要发往隔离运行环境外，本实施例不作唯一性限定。
本发明实施例中的第一进程是操作指令的接收方，可以接收用户的操作指令，第一进程运行在隔离运行环境下，操作指令被限制在隔离运行环境下，可以提供集中防御的功能。由于第一进程还具备了将操作指令发送到隔离机制之外的能力，并且第二进程在验证通过后执行操作指令，否则拒绝执行；因此，用户可以透过隔离运行环境对第二进程下操作指令，扩展了隔离运行环境的应用范围，使之符合FM等应用场景。因此本发明实施例提供了防御点集中，并且应用范围广泛的安全防护方案。
在本实施例中，可以通过命令集的形式集中管理可执行命令，具体如下：如图7所示，上述第二控制单元605，包括：
命令集获取单元701，用于获取可执行命令集；
指令确定单元702，用于确定上述操作指令是否属于上述可执行命令集。
在本实施例中，可执行命令集可以是与用户相关的，也可以是与用户所属的类型如：访客、普通、管理员等，还可以是与操作指令的类型相关的，例如：不会对系统造成损害类别的操作指令，例如：普通的读取操作指令等。可执行命令集可以采用预置的方式存储在真实操作系统一侧。
可选地，集中管理命令集的方式，可以通过白名单的形式对每一个用户进行权限管理，具体实现方案如下：上述命令集获取单元701，具体用于确定与发送上述操作指令的用户对应的白名单；
上述指令确定单元702，具体用于确定上述操作指令是否属于上述白名单中指定的允许执行的指令。
在本实施例中，操作指令可以用于安装软件等类型的操作，针对此类应用环境，本发明实施例还提供了特定的操作指令格式以及对应的鉴权方式，具体如下：上述操作指令包括：通用调用指令和命令参数；
上述第二控制单元605，具体用于运行第二进程获取与上述命令参数对应的签名信息，以及与上述通用调用指令对应的公钥，然后确定使用上述公钥对上述签名信息是否能够验证通过；运行上述第二进程执行上述操作指令中的命 令参数指定的操作命令。
在本实施例中，第一进程一侧可以是通过通用调用指令的关键字确定该操作指令需要发往隔离运行环境之外。
在本实施例中，第一进程和第二进程需要穿透隔离运行环境，本实施例提供了可选的穿透隔离运行环境的实现方案，如下：如图8所示，上述安全防护装置还包括：位于上述隔离运行环境内的命令代理801，以及位于上述隔离运行环境外与上述第二进程对应的命令服务器802；
上述第一控制单元604，具体用于运行上述第一进程通过位于上述隔离运行环境内的命令代理801将上述操作指令发送给上述第二进程对应的命令服务器802。
在前一实施例中，操作指令采用命令代理以及命令服务器进行传递，因此命令服务器和命令代理之间会存在通信连接，本实施例还提供了具体可选的通信连接方案，具体如下：上述命令代理服务器501，用于以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立上述命令代理与上述命令服务器802之间的通信连接。
在前一实施例中提供了命令服务器和命令代理之间会存在通信连接的可选实现方案，其中在后两种通信方式中，会使用到共享存储空间，在本实施例中优选将存储空间设置在隔离运行环境内部，具体如下：若上述命令代理与上述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
上述第二控制单元605，还用于运行上述第二进程执行上述操作指令过程中，从位于上述隔离运行环境内的共享存储空间中获取执行上述操作指令所需要的内容数据。
本发明实施例还提供了一种安全防护装置，如图9所示，包括：输入设备901，处理器902和存储器903，其中存储器903可以用于处理器902的数据处理过程中的数据缓存，也可以提供处理器902在数据处理过程中调用进程需要占用的存储空间；
其中，上述输入设备901，用于接收来自用户的操作指令；
上述处理器902，用于启动真实操作系统，在上述真实操作系统中创建虚 拟操作系统，并将上述虚拟操作系统置于隔离运行环境中；在上述虚拟操作系统中启动第一进程，在上述真实操作系统中启动第二进程；在上述输入设备901接收到来自用户的操作指令后，将上述操作指令重定向到上述第一进程；运行上述第一进程并确定上述操作指令指向上述第二进程后，向上述第二进程发送上述操作指令；运行上述第二进程接收来自上述第一进程的上述操作指令后，确定上述操作指令是否属于可执行命令，若是则执行上述操作指令，否则拒绝执行上述操作指令。
重定向是将用户输入的所有操作指令，首先发往虚拟操作系统一侧，使操作指令发往虚拟操作系统中对应的进程。
确定操作指令指向第二进程，可以是通过操作指令的操作对象确定的，也可以是根据通过操作指令中用于指示需要发往隔离运行环境以外执行的标识性信息确定，具体如何确定操作指令需要发往隔离运行环境外，本实施例不作唯一性限定。
本发明实施例中的第一进程是操作指令的接收方，可以接收用户的操作指令，第一进程运行在隔离运行环境下，操作指令被限制在隔离运行环境下，可以提供集中防御的功能。由于第一进程还具备了将操作指令发送到隔离机制之外的能力，并且第二进程在验证通过后执行操作指令，否则拒绝执行；因此，用户可以透过隔离运行环境对第二进程下操作指令，扩展了隔离运行环境的应用范围，使之符合FM等应用场景。因此本发明实施例提供了防御点集中，并且应用范围广泛的安全防护方案。
在本实施例中，可以通过命令集的形式集中管理可执行命令，具体如下：上述处理器902，还用于在确定上述操作指令是否属于可执行命令之前，运行上述第二进程获取可执行命令集；然后，确定上述操作指令是否属于上述可执行命令集。
在本实施例中，可执行命令集可以是与用户相关的，也可以是与用户所属的类型如：访客、普通、管理员等，还可以是与操作指令的类型相关的，例如：不会对系统造成损害类别的操作指令，例如：普通的读取操作指令等。可执行命令集可以采用预置的方式存储在真实操作系统一侧。
可选地，集中管理命令集的方式，可以通过白名单的形式对每一个用户进 行权限管理，具体实现方案如下：上述处理器902，具体用于运行上述第二进程确定与发送上述操作指令的用户对应的白名单；确定上述操作指令是否属于上述白名单中指定的允许执行的指令。
在本实施例中，操作指令可以用于安装软件等类型的操作，针对此类应用环境，本发明实施例还提供了特定的操作指令格式以及对应的鉴权方式，具体如下：上述操作指令包括：通用调用指令和命令参数；
上述处理器902，具体用于运行第二进程获取与上述命令参数对应的签名信息，以及与上述通用调用指令对应的公钥，然后确定使用上述公钥对上述签名信息是否能够验证通过；运行上述第二进程执行上述操作指令中的命令参数指定的操作命令。
在本实施例中，第一进程一侧可以是通过通用调用指令的关键字确定该操作指令需要发往隔离运行环境之外。
在本实施例中，第一进程和第二进程需要穿透隔离运行环境，本实施例提供了可选的穿透隔离运行环境的实现方案，如下：上述处理器902，具体用于运行上述第一进程通过位于上述隔离运行环境内的命令代理将上述操作指令发送给上述第二进程对应的命令服务器。
在前一实施例中，操作指令采用命令代理以及命令服务器进行传递，因此命令服务器和命令代理之间会存在通信连接，本实施例还提供了具体可选的通信连接方案，具体如下：上述处理器902，还用于在运行上述第一进程通过位于上述隔离运行环境内的命令代理将上述操作指令发送给上述第二进程对应的命令服务器之前，以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立上述命令代理与上述命令服务器之间的通信连接。
在前一实施例中提供了命令服务器和命令代理之间会存在通信连接的可选实现方案，其中在后两种通信方式中，会使用到共享存储空间，在本实施例中优选将存储空间设置在隔离运行环境内部，具体如下：若上述命令代理与上述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
上述处理器902，还用于运行上述第二进程执行上述操作指令过程中，从 位于上述隔离运行环境内的共享存储空间中获取执行上述操作指令所需要的内容数据。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：只读存储器(ROM，Read Only Memory)、随机存取记忆体(RAM，Random Access Memory)、磁盘或光盘等。
以上对本发明实施例所提供的一种移动性管理方法、装置和系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (21)

  1. 一种安全防护方法，其特征在于，包括：
    启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；
    在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；在接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；
    运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；
    运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
  2. 根据权利要求1所述方法，其特征在于，所述确定所述操作指令是否属于可执行命令之前，所述方法还包括：运行所述第二进程获取可执行命令集；
    所述确定所述操作指令属于可执行命令包括：确定所述操作指令是否属于所述可执行命令集。
  3. 根据权利要求2所述方法，其特征在于，所述运行所述第二进程确定可执行命令集包括：运行所述第二进程确定与发送所述操作指令的用户对应的白名单；
    所述确定所述操作指令属于所述可执行命令集包括：
    确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
  4. 根据权利要求1所述方法，其特征在于，所述操作指令包括：通用调用指令和命令参数；
    所述确定所述操作指令是否属于可执行命令包括：运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；
    所述执行所述操作指令包括：运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
  5. 根据权利要求1至4任意一项所述方法，其特征在于，所述向所述第二进程发送所述操作指令包括：
    运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
  6. 根据权利要求5所述方法，其特征在于，在运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器之前，还包括：
    以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
  7. 根据权利要求6所述方法，其特征在于，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
    所述执行所述操作指令包括：运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
  8. 一种安全防护装置，其特征在于，包括：
    系统控制单元，用于启动真实操作系统，在所述真实操作系统中创建虚拟操作系统，并将所述虚拟操作系统置于隔离运行环境中；
    进程启动单元，用于在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；
    指令定向单元，用于在接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；
    第一控制单元，用于运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；
    第二控制单元，用于运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
  9. 根据权利要求8所述安全防护装置，其特征在于，所述第二控制单元，包括：
    命令集获取单元，用于获取可执行命令集；
    指令确定单元，用于确定所述操作指令是否属于所述可执行命令集。
  10. 根据权利要求9所述安全防护装置，其特征在于，
    所述命令集获取单元，具体用于确定与发送所述操作指令的用户对应的白名单；
    所述指令确定单元，具体用于确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
  11. 根据权利要求8所述安全防护装置，其特征在于，所述操作指令包括：通用调用指令和命令参数；
    所述第二控制单元，具体用于运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
  12. 根据权利要求8至11任意一项所述安全防护装置，其特征在于，所述安全防护装置还包括：位于所述隔离运行环境内的命令代理，以及位于所述隔离运行环境外与所述第二进程对应的命令服务器；
    所述第一控制单元，具体用于运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
  13. 根据权利要求12所述安全防护装置，其特征在于，
    所述命令代理服务器，用于以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
  14. 根据权利要求13所述安全防护装置，其特征在于，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
    所述第二控制单元，还用于运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
  15. 一种安全防护装置，包括：输入设备，处理器和存储器，其特征在于，
    所述输入设备，用于接收来自用户的操作指令；
    所述处理器，用于启动真实操作系统，在所述真实操作系统中创建虚拟操 作系统，并将所述虚拟操作系统置于隔离运行环境中；在所述虚拟操作系统中启动第一进程，在所述真实操作系统中启动第二进程；在所述输入设备接收到来自用户的操作指令后，将所述操作指令重定向到所述第一进程；运行所述第一进程并确定所述操作指令指向所述第二进程后，向所述第二进程发送所述操作指令；运行所述第二进程接收来自所述第一进程的所述操作指令后，确定所述操作指令是否属于可执行命令，若是则执行所述操作指令，否则拒绝执行所述操作指令。
  16. 根据权利要求15所述安全防护装置，其特征在于，
    所述处理器，还用于在确定所述操作指令是否属于可执行命令之前，运行所述第二进程获取可执行命令集；然后，确定所述操作指令是否属于所述可执行命令集。
  17. 根据权利要求16所述安全防护装置，其特征在于，
    所述处理器，具体用于运行所述第二进程确定与发送所述操作指令的用户对应的白名单；确定所述操作指令是否属于所述白名单中指定的允许执行的指令。
  18. 根据权利要求15所述安全防护装置，其特征在于，所述操作指令包括：通用调用指令和命令参数；
    所述处理器，具体用于运行第二进程获取与所述命令参数对应的签名信息，以及与所述通用调用指令对应的公钥，然后确定使用所述公钥对所述签名信息是否能够验证通过；运行所述第二进程执行所述操作指令中的命令参数指定的操作命令。
  19. 根据权利要求15至18任意一项所述安全防护装置，其特征在于，
    所述处理器，具体用于运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器。
  20. 根据权利要求19所述安全防护装置，其特征在于，
    所述处理器，还用于在运行所述第一进程通过位于所述隔离运行环境内的命令代理将所述操作指令发送给所述第二进程对应的命令服务器之前，以网络通讯协议的环回网际协议IP通讯、有名管道/文件，或者绝缘刺穿连接IPC调用的方式建立所述命令代理与所述命令服务器之间的通信连接。
  21. 根据权利要求20所述安全防护装置，其特征在于，若所述命令代理与所述命令服务器之间之间采用有名管道/文件或者绝缘刺穿连接IPC调用的方式建立通信连接；
    所述处理器，还用于运行所述第二进程执行所述操作指令过程中，从位于所述隔离运行环境内的共享存储空间中获取执行所述操作指令所需要的内容数据。
PCT/CN2014/095366 2014-12-29 2014-12-29 一种安全防护方法，及装置 WO2016106510A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2014/095366 WO2016106510A1 (zh) 2014-12-29 2014-12-29 一种安全防护方法，及装置
CN201480037108.6A CN105518693B (zh) 2014-12-29 2014-12-29 一种安全防护方法，及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/095366 WO2016106510A1 (zh) 2014-12-29 2014-12-29 一种安全防护方法，及装置

Publications (1)

Publication Number Publication Date
WO2016106510A1 true WO2016106510A1 (zh) 2016-07-07

Family

ID=55725020

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095366 WO2016106510A1 (zh) 2014-12-29 2014-12-29 一种安全防护方法，及装置

Country Status (2)

Country Link
CN (1) CN105518693B (zh)
WO (1) WO2016106510A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110909349A (zh) * 2019-11-14 2020-03-24 上海携程商务有限公司 docker容器内反弹shell的检测方法和系统
CN112073421A (zh) * 2020-09-14 2020-12-11 深圳市腾讯计算机系统有限公司 通信处理方法、装置、终端及存储介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106844460B (zh) * 2016-12-21 2020-06-16 浪潮集团有限公司 一种利用Docker容器实现虚拟文件系统的方法
CN108289080B (zh) * 2017-01-09 2021-02-05 阿里巴巴集团控股有限公司 一种访问文件系统的方法、装置和系统
CN111008041B (zh) * 2019-12-04 2022-03-11 北京百度网讯科技有限公司 用于主机的命令处理方法、装置、电子设备和存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110289513A1 (en) * 2010-04-17 2011-11-24 Code Systems Corporation Method of hosting a first application in a second application
CN102436508A (zh) * 2011-12-28 2012-05-02 奇智软件（北京）有限公司 基于沙箱技术浏览网页的方法及装置
CN104135475A (zh) * 2014-07-18 2014-11-05 国家电网公司 一种面向移动互联网的电力信息安全防护方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7574709B2 (en) * 2004-04-30 2009-08-11 Microsoft Corporation VEX-virtual extension framework
US8745361B2 (en) * 2008-12-02 2014-06-03 Microsoft Corporation Sandboxed execution of plug-ins
CN102436507B (zh) * 2011-12-28 2014-07-16 奇智软件（北京）有限公司 一种浏览网页的方法及装置
CN103970601B (zh) * 2013-02-06 2019-03-05 北京壹人壹本信息科技有限公司 执行操作指令方法和装置
CN103345604A (zh) * 2013-07-16 2013-10-09 湘潭大学 基于轻量虚拟机监控器的沙盒系统及用其监控os的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110289513A1 (en) * 2010-04-17 2011-11-24 Code Systems Corporation Method of hosting a first application in a second application
CN102436508A (zh) * 2011-12-28 2012-05-02 奇智软件（北京）有限公司 基于沙箱技术浏览网页的方法及装置
CN104135475A (zh) * 2014-07-18 2014-11-05 国家电网公司 一种面向移动互联网的电力信息安全防护方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110909349A (zh) * 2019-11-14 2020-03-24 上海携程商务有限公司 docker容器内反弹shell的检测方法和系统
CN110909349B (zh) * 2019-11-14 2024-03-22 上海携程商务有限公司 docker容器内反弹shell的检测方法和系统
CN112073421A (zh) * 2020-09-14 2020-12-11 深圳市腾讯计算机系统有限公司 通信处理方法、装置、终端及存储介质

Also Published As

Publication number Publication date
CN105518693B (zh) 2018-12-07
CN105518693A (zh) 2016-04-20

Similar Documents

Publication Publication Date Title
JP6982006B2 (ja) ハードウェア・ベースの仮想化セキュリティ分離
US10305903B2 (en) Bypassing certificate pinning
US10375111B2 (en) Anonymous containers
US9942251B1 (en) Malware detection based on traffic analysis
US9240977B2 (en) Techniques for protecting mobile applications
JP6222592B2 (ja) モバイルアプリケーション管理のためのモバイルアプリケーションのアイデンティティの検証
US9674173B2 (en) Automatic certificate enrollment in a special-purpose appliance
US10699005B2 (en) Techniques for controlling and regulating network access on air-gapped endpoints
WO2016106510A1 (zh) 一种安全防护方法，及装置
JP2016530814A (ja) 大量のｖｐｎ接続を遮断するためのゲートウェイデバイス
US20210377224A1 (en) Secure and auditable proxy technology using trusted execution environments
US10032027B2 (en) Information processing apparatus and program for executing an electronic data in an execution environment
WO2019037521A1 (zh) 安全检测的方法、装置、系统以及服务器
US10924481B2 (en) Processing system for providing console access to a cyber range virtual environment
US8583788B2 (en) Techniques for auditing and controlling network services
Zhao et al. Svgrid: a secure virtual environment for untrusted grid applications
US10009318B2 (en) Connecting to a cloud service for secure access
Benzidane et al. Secured architecture for inter-VM traffic in a Cloud environment
CN115623013A (zh) 一种策略信息同步方法、系统及相关产品
Adam et al. Partially Trusting the Service Mesh Control Plane
CN114629683B (zh) 管理服务器的接入方法、装置、设备及存储介质
US20210385234A1 (en) Dynamic remote browsing
Foster " Why does MPTCP have to make things so complicated?": cross-path NIDS evasion and countermeasures
Engström Ericsson Security Auditing and Testing of two Android Client-Server Applications
CN116954693A (zh) 状态协同方法、装置、计算机设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14909323

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14909323

Country of ref document: EP

Kind code of ref document: A1