WO2016107348A1 - 进程的权限配置方法及装置 - Google Patents

进程的权限配置方法及装置 Download PDF

Info

Publication number
WO2016107348A1
WO2016107348A1 PCT/CN2015/095709 CN2015095709W WO2016107348A1 WO 2016107348 A1 WO2016107348 A1 WO 2016107348A1 CN 2015095709 W CN2015095709 W CN 2015095709W WO 2016107348 A1 WO2016107348 A1 WO 2016107348A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
authority
parent
resource manager
permission
Prior art date
Application number
PCT/CN2015/095709
Other languages
English (en)
French (fr)
Inventor
谢京辉
何孟东
张菊元
袁威
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2016107348A1 publication Critical patent/WO2016107348A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems

Definitions

  • the present invention relates to the field of information technology, and in particular, to a method and apparatus for configuring rights of a process.
  • the functions of intelligent terminals are becoming more and more powerful.
  • the operating system has strict requirements on the permissions of the application process, especially the permissions of the third-party application process need to be strictly controlled.
  • a Windows application programming interface (Windows API) is directly called to create a child process, and the created child process inherits the process of the parent process. Permissions.
  • the parent process has higher permissions, the newly created child process will also have high permissions.
  • the newly created child process is a process of an uncontrollable third-party application, the permissions of the process of the third-party application are inherited. The high priority of the parent process, which may cause security risks for the smart terminal used by the user.
  • the embodiment of the present invention provides a method and a device for configuring a permission of a process, and the main purpose is to prevent the newly created child process from inheriting the high authority of the parent process, thereby ensuring the security of the smart terminal used by the user.
  • a method for configuring rights of a process including:
  • the rights of the child process are configured as the rights of the application process.
  • a process authority configuration apparatus including:
  • the determining unit is configured to determine, when the child process needs to be created, whether an application having a lower authority than the parent process exists in the currently running application process;
  • Obtaining a unit configured to obtain the permission of the application process if an application with a lower authority than the parent process exists;
  • the configuration unit is configured to configure, when the parent process creates the child process, the rights of the child process as the rights of the application process.
  • a computer program comprising computer readable code, when said computer readable code is run on a smart terminal, causing said smart terminal to perform a rights configuration of a process as described above method.
  • a computer readable medium storing a computer program as described above.
  • the technical solution provided by the embodiment of the present invention has at least the following advantages:
  • the permission configuration scheme of the process provided by the embodiment of the present invention firstly determines whether an application having a lower authority than the parent process exists in the currently running application process when the child process needs to be created; if yes, the permission of the application process is obtained. Finally, in the process of creating the child process by the parent process, the rights of the child process are configured as the rights of the application process.
  • the embodiment of the present invention prevents the child process from inheriting the high authority of the parent process by configuring the acquired application process authority lower than the parent process as the permission of the child process. After the newly created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thus ensuring the security of the operating system.
  • FIG. 1 is a flow chart showing the steps of a process authority configuration method according to an embodiment of the present invention
  • FIG. 2 is a flow chart showing the steps of a method for configuring rights of another process according to an embodiment of the present invention
  • FIG. 3 is a structural block diagram of a process authority configuration apparatus according to an embodiment of the present invention.
  • FIG. 4 is a structural block diagram of another process rights configuration apparatus according to an embodiment of the present invention.
  • FIG. 5 is a block diagram schematically showing a structural block of a smart terminal for performing a process authority configuration method according to the present invention
  • Fig. 6 schematically shows a storage unit for holding or carrying program code implementing a process rights configuration method according to the present invention.
  • An embodiment of the present invention provides a flow chart of steps of a process for configuring a rights. As shown in FIG. 1 , the method includes:
  • the permissions of the application process can usually be divided into high rights, medium rights and low rights.
  • High Permissions are administrative permissions. Processes with high privileges can install files into the "Program Files" folder and write them to the sensitive registry area; the permissions are user permissions, and the processes with permissions are available to the user.
  • the "Documents" folder creates and modifies files and writes them to the user-specified registry area; low permissions are untrusted. For example, if the permission of the parent process is high, it is determined whether there is an application with the right permission or the low authority in the currently running application process.
  • the application process with the right permission or the low authority in the currently running application is obtained.
  • the new process caused by the child process inheriting the high privilege of the parent process can be avoided.
  • the created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thus ensuring the security of the smart terminal.
  • a method for configuring a permission of a process in the embodiment of the present invention firstly determines whether an application having a lower authority than the parent process exists in the currently running application process when the child process needs to be created; if yes, the permission of the application process is obtained. Finally, in the process of creating the child process by the parent process, the rights of the child process are configured as the rights of the application process.
  • the embodiment of the present invention prevents the child process from inheriting the high authority of the parent process by configuring the acquired application process authority lower than the parent process as the permission of the child process. After the newly created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thereby ensuring the security of the smart terminal.
  • the embodiment of the present invention provides a flow chart of steps of a process for configuring a rights of another process. As shown in FIG. 2, the method includes:
  • the operating system environment that meets the preset conditions may be an operating system of a later version of the Microsoft Windows Vista operating system, such as a Windows 7, a Windows 8 operating system, etc., and these versions of the operating system have control over process management and process rights compared to previous versions of Windows Vista.
  • the operating system is more strict, and the level of authority of the process is clearly divided, thus ensuring The feasibility of the permission configuration method of the process provided by the embodiment of the present invention is demonstrated.
  • the permissions of the application process can usually be divided into high rights, medium rights and low rights.
  • High privilege is administrative privilege.
  • a process with high privilege can install the file into the "Program Files" folder and write it to the sensitive registry area; the privilege is the user privilege, and the process with the privilege can be in the user's
  • the Documents folder creates and modifies files and writes them to the user-specified registry area; low permissions are untrusted. For example, if the permission of the parent process is high, it is determined whether there is an application with the right permission or the low authority in the currently running application process.
  • the step 202 may specifically include: when the child process needs to be created, determining whether the authority of the resource manager process is lower than the authority of the parent process. Since the permission of the parent process is usually a high-privilege, and the resource manager is an application running in real time, it is possible to directly determine whether the authority of the resource manager process is lower than the authority of the parent process, thereby further improving the authority configuration efficiency of the process.
  • the step 203 may include: if yes, acquiring the process Token information of the application, that is, the tag information, and then acquiring the permission of the application process according to the process Token information of the application.
  • the process token information is used to identify the privileges owned by the process, and the privileges owned by the process can reflect the permissions of the process.
  • obtaining the process Token information of the application may be: if the authority of the parent process is lower than, the process Token information of the resource manager is obtained; according to the process Token information of the application, The obtaining the permission of the application process may be: obtaining the permission of the resource manager process according to the process token information of the resource manager.
  • the process of acquiring the Token information of the resource manager may be: if the permission of the parent process is lower than, the first preset interface function is invoked.
  • the first preset interface function may be a replication resource manager token DuplicateExplorerToken function.
  • the obtaining the permission of the resource manager process may be: according to the process token information of the resource manager, by calling the second preset connection according to the process token information of the resource manager.
  • the port function obtains the permissions of the resource manager process.
  • the second preset interface function may be a complete token GetTokenlntegrityLevel function.
  • the DuplicateExplorerToken function and the GetTokenIntegrityLevel function are the functions of the LowCreateProcess created by the embodiment of the present invention, that is, the sub-functions included in the low-privilege process creation function, and the function is created by setting the parameter format of the function LowCreateProcess to the standard Windows API function CreateProcess.
  • the parameter format is the same, so that the subfunction DuplicateExplorerToken and GetTokenIntegrityLevel of the function LowCreateProcess can meet the parameter format requirements of the standard Windows API function, so that the CreateProcess can be directly changed to LowCreateProcess when necessary to solve the permission configuration problem of the subprocess. Therefore, the rights configuration method of the process provided by the embodiment of the present invention can be ensured to have good compatibility and achievability with the existing operating system.
  • the new process caused by the child process inheriting the high privilege of the parent process can be avoided.
  • the created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thus ensuring the security of the smart terminal.
  • the privilege configuration method of another process provided by the embodiment of the present invention firstly determines whether an application having a lower authority than the parent process exists in the currently running application process when the child process needs to be created; if yes, acquiring the application process Permission; finally, in the process of creating the child process by the parent process, configuring the rights of the child process as the rights of the application process.
  • the embodiment of the present invention prevents the child process from inheriting the high authority of the parent process by configuring the acquired application process authority lower than the parent process as the permission of the child process. After the newly created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thereby ensuring the security of the smart terminal.
  • an embodiment of the present invention provides a process for configuring a rights.
  • the device may include: a determining unit 31, an obtaining unit 32, and a configuration unit 33. .
  • the determining unit 31 is configured to determine, when the child process needs to be created, whether an application with a lower authority than the parent process exists in the currently running application process.
  • the obtaining unit 32 is configured to acquire the permission of the application process if an application with a lower authority than the parent process exists.
  • the configuration unit 33 is configured to configure, when the parent process creates the child process, the rights of the child process as the rights of the application process acquired by the obtaining unit 32.
  • the privilege configuration device of the process provided by the embodiment of the present invention firstly determines whether an application having a lower authority than the parent process exists in the currently running application process when the child process needs to be created; if yes, the permission of the application process is obtained. Finally, in the process of creating the child process by the parent process, the rights of the child process are configured as the rights of the application process.
  • the embodiment of the present invention prevents the child process from inheriting the high authority of the parent process by configuring the acquired application process authority lower than the parent process as the permission of the child process. After the newly created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thereby ensuring the security of the smart terminal.
  • the embodiment of the present invention provides another process privilege configuration device.
  • the device may include: a determining unit 41, and an obtaining unit 42. , configuration unit 43.
  • the determining unit 41 is configured to determine, when the child process needs to be created, whether an application having a lower authority than the parent process exists in the currently running application process.
  • the obtaining unit 42 is configured to acquire the permission of the application process if there is an application whose authority is lower than the parent process.
  • the configuration unit 43 is configured to configure, when the parent process creates the child process, the rights of the child process as the rights of the application process acquired by the obtaining unit 42.
  • the obtaining unit 42 includes:
  • the first obtaining module 4201 is configured to acquire process Token information of the application if an application with a lower authority than the parent process exists;
  • the second obtaining module 4202 is configured to acquire the authority of the application process according to the process Token information of the application acquired by the first obtaining module 4201.
  • the determining unit 41 is specifically configured to determine, when the process needs to be created, whether the authority of the resource manager process is lower than the authority of the parent process.
  • the first obtaining module 4201 is configured to acquire process Token information of the resource manager if the authority of the parent process is lower than the priority of the parent process.
  • the second obtaining module 4202 is configured to acquire the authority of the resource manager process according to the process Token information of the resource manager acquired by the first acquiring module 4201.
  • the first obtaining module 4201 is further configured to acquire process Token information of the resource manager by calling a first preset interface function;
  • the second obtaining module 4202 is further configured to acquire the authority of the resource manager process by calling a second preset interface function according to the process Token information of the resource manager acquired by the first obtaining module 4201.
  • the parameter formats of the first preset interface function and the second preset interface function are the same as the parameter format in the interface function Windows API.
  • the determining unit 41 is further configured to determine whether the operating system environment currently created by the sub-process meets the preset condition.
  • the privilege configuration device of the process provided by the embodiment of the present invention firstly determines whether an application having a lower authority than the parent process exists in the currently running application process when the child process needs to be created; if yes, the permission of the application process is obtained. Finally, in the process of creating the child process by the parent process, the rights of the child process are configured as the rights of the application process.
  • the embodiment of the present invention prevents the child process from inheriting the high authority of the parent process by configuring the acquired application process authority lower than the parent process as the permission of the child process. After the newly created child process inherits the high authority of the parent process, it poses a security threat to the smart terminal used by the user, thereby ensuring the security of the smart terminal.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the descriptions may be employed All the features disclosed in the book (including the accompanying claims, abstract and drawings) and all processes or units of any method or device disclosed herein are combined.
  • Each feature disclosed in this specification including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the process in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 5 illustrates a smart terminal that can implement a rights configuration method for a process in accordance with the present invention.
  • the smart terminal conventionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520.
  • the memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 520 has a storage space 530 that stores program code 531 for performing any of the method steps described above.
  • storage space 530 storing program code may include various program code 531 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit such as that shown in FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 520 in the computing device of FIG.
  • the program code can be pressed, for example, in an appropriate form Shrink.
  • the storage unit includes computer readable code 531', ie, code that can be read by a processor, such as 510, which when executed by the smart terminal causes the smart terminal to perform various steps in the methods described above .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Abstract

一种进程的权限配置方法及装置，涉及信息技术领域，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证智能终端的安全性。所述方法包括：首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用(101)；若存在，则获取所述应用进程的权限(102)；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限(103)。适用于配置进程的权限。

Description

进程的权限配置方法及装置 技术领域
本发明涉及信息技术领域，特别是涉及一种进程的权限配置方法及装置。
背景技术
随着信息技术的发展，智能终端的功能也越来越强大。为了保证智能终端的安全，操作系统对应用进程的权限有着严格的要求，尤其对第三方应用进程的权限更需要严格控制。
目前，按照现有的进程创建方式进行子进程的创建时，通常直接调用Windows应用程序接口函数(Windows Application Programming Interface，Windows API)进行子进程的创建，创建的子进程会继承调父进程的进程权限。然而当父进程具有较高权限时，新创建的子进程也会具有高权限，对于新创建的子进程为不可控的第三方应用程序的进程时，由于第三方应用程序的进程的权限继承了父进程的高权限，从而会导致用户使用的智能终端存在安全隐患。
发明内容
有鉴于此，本发明实施例提供一种进程的权限配置方法及装置，主要目的在于避免新创建的子进程继承父进程的高权限，从而保证用户使用的智能终端的安全性。
依据本发明一个方面，提供了一种进程的权限配置方法，包括：
当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；
若存在，则获取所述应用进程的权限；
在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
依据本发明另一个方面，还提供了一种进程的权限配置装置，包括：
判断单元，配置为当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；
获取单元，配置为若存在权限低于父进程的应用，则获取所述应用进程的权限；
配置单元，配置为在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
依据本发明又一方面，还提供了一种计算机程序，包括计算机可读代码，当所述计算机可读代码在智能终端上运行时，导致所述智能终端执行如上文所述的进程的权限配置方法。
根据本发明的再一方面，提供了一种计算机可读介质，其中存储了如上文所述的计算机程序。
借由上述技术方案，本发明实施例提供的技术方案至少具有下列优点：
本发明实施例提供的一种进程的权限配置方案，首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；若存在，则获取所述应用进程的权限；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。与目前直接调用Windows API函数进行进程的权限配置相比，本发明实施例通过将获取的低于父进程的应用进程权限配置为子进程的权限，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户使用的智能终端造成安全威胁，从而保证操作系统的安全性。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了本发明实施例提供的一种进程的权限配置方法的步骤流程图；
图2示出了本发明实施例提供的另一种进程的权限配置方法的步骤流程图；
图3示出了本发明实施例提供的一种进程的权限配置装置的结构框图；
图4示出了本发明实施例提供的另一种进程的权限配置装置的结构框图；
图5示意性地示出了用于执行根据本发明的进程权限配置方法的智能终端的结构框图；以及
图6示意性地示出了用于保持或者携带实现根据本发明的进程权限配置方法的程序代码的存储单元。
具体实施方式
下面将参照附图更详细地描述本发明公开的示例性实施例。虽然附图中显示了本发明公开的示例性实施例，然而应当理解，可以以各种形式实现本发明公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
本发明实施例提供一种进程的权限配置方法的步骤流程图，如图1所示，所述方法包括：
101、当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用。
其中，应用进程的权限通常可以划分为高权限、中权限及低权限。高 权限为管理权限，具有高权限的进程可以将文件安装到“程序文件(Program Files)”文件夹，并写入敏感注册表区域；中权限为用户权限，具有中权限的进程可在用户的“文档”文件夹创建和修改文件，并写入用户指定的注册表区域；低权限为不受信任权限。例如，父进程的权限为高权限，则判断当前运行的应用进程中是否存在权限为中权限或者为低权限的应用。
102、若存在，则获取所述应用进程的权限。
例如，父进程的权限为高权限，则获取当前运行的应用中权限为中权限或者为低权限的应用进程。
103、在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
对于本发明实施例，通过将所述子进程的权限配置为权限级别低于父权限的应用进程的权限，而不是直接沿用父进程的权限，可以避免子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证了智能终端的安全性。
本发明实施例提供的一种进程的权限配置方法，首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；若存在，则获取所述应用进程的权限；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。与目前直接调用Windows API函数进行进程的权限配置相比，本发明实施例通过将获取的低于父进程的应用进程权限配置为子进程的权限，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证智能终端的安全性。
进一步地，本发明实施例提供另一种进程的权限配置方法的步骤流程图，如图2所示，所述方法包括：
201、判断当前进行子进程创建的操作系统环境是否符合预置条件。
其中，符合预置条件的操作系统环境可以为微软Windows Vista操作系统之后版本的操作系统，如Windows7、Windows8操作系统等，这些版本的操作系统对进程的管理及进程权限的控制较Windows Vista之前版本的操作系统更加严格，并且对进程的权限等级进行了明确划分，从而保 证了本发明实施例提供的进程的权限配置方法的可行性。
202、若当前进行子进程创建的操作系统环境符合预置条件，当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用。
其中，应用进程的权限通常可以划分为高权限、中权限及低权限。高权限为管理权限，具有高权限的进程可以将文件安装到“程序文件(Program Files)”文件夹，并写入敏感注册表区域；中权限为用户权限，具有中权限的进程可在用户的“文档”文件夹创建和修改文件，并写入用户指定的注册表区域；低权限为不受信任权限。例如，父进程的权限为高权限，则判断当前运行的应用进程中是否存在权限为中权限或者为低权限的应用。
对于本发明实施例，步骤202具体可以包括：当需要创建子进程时，判断资源管理器进程的权限是否低于所述父进程的权限。由于父进程的权限通常为高权限，而资源管理器为实时运行的应用，因此直接判断资源管理器进程的权限是否低于所述父进程的权限，可以进一步提高进程的权限配置效率。
203、若存在，则获取所述应用进程的权限。
对于本发明实施例，步骤203具体可以包括：若存在，则获取所述应用的进程Token信息即标记信息，然后根据所述应用的进程Token信息，获取所述应用进程的权限。其中，进程Token信息用于标识进程所拥有特权，通过进程拥有的特权可以反映该进程的权限。
进一步地，若存在，则获取所述应用的进程Token信息具体可以为：若低于所述父进程的权限，则获取所述资源管理器的进程Token信息；根据所述应用的进程Token信息，获取所述应用进程的权限具体可以为：根据所述资源管理器的进程Token信息，获取所述资源管理器进程的权限。
对于本发明实施例，若低于所述父进程的权限，则获取所述资源管理器的进程Token信息具体可以为：若低于所述父进程的权限，则通过调用第一预置接口函数获取所述资源管理器的进程Token信息。其中，第一预置接口函数可以为复制资源管理器令牌DuplicateExplorerToken函数。根据所述资源管理器的进程Token信息，获取所述资源管理器进程的权限具体可以为：根据所述资源管理器的进程Token信息，通过调用第二预置接 口函数获取所述资源管理器进程的权限。其中，第二预置接口函数可以为获取令牌完整级别GetTokenlntegrityLevel函数。
其中，所述DuplicateExplorerToken函数和所述GetTokenIntegrityLevel函数为本发明实施例创建的函数LowCreateProcess即低权限进程创建函数包含的子函数，通过将函数LowCreateProcess的参数格式设置为与标准Windows API函数CreateProcess即进行创建函数的参数格式一致，从而可以使得函数LowCreateProcess的子函数DuplicateExplorerToken和所述GetTokenIntegrityLevel符合标准Windows API函数的参数格式要求，这样，只需在必要时将CreateProcess直接更改为LowCreateProcess即可解决子进程的权限配置问题，从而可以保证本发明实施例提供的进程的权限配置方法与现有操作系统具有良好的兼容性和可实现性。
204、在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
对于本发明实施例，通过将所述子进程的权限配置为权限级别低于父权限的应用进程的权限，而不是直接沿用父进程的权限，可以避免子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证了智能终端的安全性。
本发明实施例提供的另一种进程的权限配置方法，首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；若存在，则获取所述应用进程的权限；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。与目前直接调用Windows API函数进行进程的权限配置相比，本发明实施例通过将获取的低于父进程的应用进程权限配置为子进程的权限，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证智能终端的安全性。
作为本发明实施例图1所示方法的具体实现，本发明实施例提供一种进程的权限配置装置，如图3所示，所述装置可以包括：判断单元31，获取单元32，配置单元33。
判断单元31，配置为当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用。
获取单元32，配置为于若存在权限低于父进程的应用，则获取所述应用进程的权限。
配置单元33，配置为在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述获取单元32获取的应用进程的权限。
需要说明的是，本发明实施例提供的一种进程的权限配置装置所涉及各功能单元的其他相应描述，可以参考图1所示方法中的对应描述，在此不再赘述。
本发明实施例提供的一种进程的权限配置装置，首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；若存在，则获取所述应用进程的权限；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。与目前直接调用Windows API函数进行进程的权限配置相比，本发明实施例通过将获取的低于父进程的应用进程权限配置为子进程的权限，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证智能终端的安全性。
进一步地，作为本发明实施例图2所示方法的具体实现，本发明实施例提供另一种进程的权限配置装置，如图4所示，所述装置可以包括：判断单元41，获取单元42，配置单元43。
判断单元41，配置为当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用。
获取单元42，配置为若存在权限低于父进程的应用，则获取所述应用进程的权限。
配置单元43，配置为在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述获取单元42获取的应用进程的权限。
所述获取单元42包括：
第一获取模块4201，配置为若存在权限低于父进程的应用，则获取所述应用的进程Token信息；
第二获取模块4202，配置为根据所述第一获取模块4201获取的应用的进程Token信息，获取所述应用进程的权限。
所述判断单元41，具体配置为当需要创建进程时，判断资源管理器进程的权限是否低于所述父进程的权限。
所述第一获取模块4201，具体配置为若低于所述父进程的权限，则获取所述资源管理器的进程Token信息。
所述第二获取模块4202，具体配置为根据所述第一获取模块4201获取的资源管理器的进程Token信息，获取所述资源管理器进程的权限。
所述第一获取模块4201，具体还配置为通过调用第一预置接口函数获取所述资源管理器的进程Token信息；
所述第二获取模块4202，具体还配置为根据所述第一获取模块4201获取的资源管理器的进程Token信息，通过调用第二预置接口函数获取所述资源管理器进程的权限。
对于本发明实施例，所述第一预置接口函数和所述第二预置接口函数的参数格式与接口函数Windows API中的参数格式相同。
所述判断单元41，还配置为判断当前进行子进程创建的操作系统环境是否符合预置条件。
需要说明的是，本发明实施例提供的另一种进程的权限配置装置所涉及各功能单元的其他相应描述，可以参考图2所示方法中的对应描述，在此不再赘述。
本发明实施例提供的一种进程的权限配置装置，首先当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；若存在，则获取所述应用进程的权限；最后在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。与目前直接调用Windows API函数进行进程的权限配置相比，本发明实施例通过将获取的低于父进程的应用进程权限配置为子进程的权限，避免了子进程继承父进程的高权限导致的新创建的子进程继承父进程的高权限后，对用户所使用的智能终端造成安全威胁，从而保证智能终端的安全性。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没 有详述的部分，可以参见其他实施例的相关描述。
可以理解的是，上述方法及装置中的相关特征可以相互参考。另外，上述实施例中的“第一”、“第二”等是用于区分各实施例，而并不代表各实施例的优劣。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明 书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的进程的权限配置方法及装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图5示出了可以实现根据本发明的进程的权限配置方法的智能终端。该智能终端传统上包括处理器510和以存储器520形式的计算机程序产品或者计算机可读介质。存储器520可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器520具有存储用于执行上述方法中的任何方法步骤的程序代码531的存储空间530。例如，存储程序代码的存储空间530可以包括分别用于实现上面的方法中的各种步骤的各个程序代码531。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD）、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为例如图6所示的便携式或者固定存储单元。该存储单元可以具有与图5的计算设备中的存储器520类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压 缩。通常，存储单元包括计算机可读代码531’，即可以由诸如510之类的处理器读取的代码，当这些代码由智能终端运行时，导致该智能终端执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下被实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。

Claims (14)

  1. 一种进程的权限配置方法，包括：
    当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；
    若存在，则获取所述应用进程的权限；
    在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
  2. 根据权利要求1所述的进程权限配置方法，其中，所述若存在，则获取所述应用进程的权限包括：
    若存在，则获取所述应用的进程Token信息；
    根据所述应用的进程Token信息，获取所述应用进程的权限。
  3. 根据权利要求1或2所述的进程的权限配置方法，其中，当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于所述父进程的应用包括：
    当需要创建子进程时，判断资源管理器进程的权限是否低于所述父进程的权限；
    所述若存在，则获取所述应用进程的权限包括：
    若低于所述父进程的权限，则获取所述资源管理器的进程Token信息；
    根据所述资源管理器的进程Token信息，获取所述资源管理器进程的权限。
  4. 根据权利要求3所述的进程的权限配置方法，其中，所述若低于所述父进程的权限，则获取所述资源管理器的进程Token信息包括：
    若低于所述父进程的权限，则通过调用第一预置接口函数获取所述资源管理器的进程Token信息；
    所述根据所述资源管理器的进程Token信息，获取所述资源管理器进程的权限包括：
    根据所述资源管理器的进程Token信息，通过调用第二预置接口函数获取所述资源管理器进程的权限。
  5. 根据权利要求4所述的进程的权限配置方法，其中，第一预置接口函数和所述第二预置接口函数的参数格式与接口函数Windows API中的参数格式相同。
  6. 根据权利要求1-5任一项所述的进程的权限配置方法，其中，所述当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于所述父进程的应用之前，还包括：
    判断当前进行子进程创建的操作系统环境是否符合预置条件。
  7. 一种进程的权限配置装置，包括：
    判断单元，配置为当需要创建子进程时，判断当前运行的应用进程中是否存在权限低于父进程的应用；
    获取单元，配置为若存在权限低于父进程的应用，则获取所述应用进程的权限；
    配置单元，配置为在所述父进程创建所述子进程的过程中，将所述子进程的权限配置为所述应用进程的权限。
  8. 根据权利要求7所述的进程的权限配置装置，其中，所述获取单元，包括：
    第一获取模块，配置为若存在权限低于父进程的应用，则获取所述应用的进程Token信息；
    第二获取模块，配置为根据所述应用的进程Token信息，获取所述应用进程的权限。
  9. 根据权利要求7或8所述的进程的权限配置装置，其中，
    所述判断单元，具体配置为当需要创建进程时，判断资源管理器进程的权限是否低于所述父进程的权限；
    所述第一获取模块，具体配置为若低于所述父进程的权限，则获取所述资源管理器的进程Token信息；
    所述第二获取模块，具体配置为根据所述资源管理器的进程Token信息，获取所述资源管理器进程的权限。
  10. 根据权利要求9所述的进程的权限配置装置，其中，
    所述第一获取模块，具体还配置为若低于所述父进程的权限，则通过 调用第一预置接口函数获取所述资源管理器的进程Token信息；
    所述第二获取模块，具体还配置为根据所述资源管理器的进程Token信息，通过调用第二预置接口函数获取所述资源管理器进程的权限。
  11. 根据权利要求10所述的进程的权限配置装置，其中，所述第一预置接口函数和所述第二预置接口函数的参数格式与接口函数Windows API中的参数格式相同。
  12. 根据权利要求7-11任一项所述的进程的权限配置装置，其中，所述判断单元，还配置为判断当前进行子进程创建的操作系统环境是否符合预置条件。
  13. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在智能终端上运行时，导致所述智能终端执行根据权利要求1-6中的任一项所述的进程的权限配置方法。
  14. 一种计算机可读介质，其中存储了如权利要求13所述的计算机程序。
PCT/CN2015/095709 2014-12-29 2015-11-26 进程的权限配置方法及装置 WO2016107348A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410838120.9A CN105809026B (zh) 2014-12-29 2014-12-29 进程的权限配置方法及装置
CN201410838120.9 2014-12-29

Publications (1)

Publication Number Publication Date
WO2016107348A1 true WO2016107348A1 (zh) 2016-07-07

Family

ID=56284186

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095709 WO2016107348A1 (zh) 2014-12-29 2015-11-26 进程的权限配置方法及装置

Country Status (2)

Country Link
CN (2) CN105809026B (zh)
WO (1) WO2016107348A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112395611B (zh) * 2019-08-15 2024-01-30 奇安信安全技术(珠海)有限公司 进程链的处理方法、装置及设备
CN113407940A (zh) * 2021-06-21 2021-09-17 成都欧珀通信科技有限公司 脚本检测方法、装置、存储介质以及计算机设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7490072B1 (en) * 2005-02-16 2009-02-10 Novell, Inc. Providing access controls
CN102663321A (zh) * 2012-04-24 2012-09-12 百度在线网络技术（北京）有限公司 用于软件的安全性增强系统及方法
EP2704004A2 (en) * 2011-04-28 2014-03-05 Fasoo. Com Co., Ltd Computing device having a dll injection function, and dll injection method
CN103955468A (zh) * 2012-03-06 2014-07-30 北京奇虎科技有限公司 基于浏览器的文档展示方法及装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101751287B (zh) * 2008-12-03 2013-01-09 北京天融信科技有限公司 在Windows下不受用户权限限制执行操作的方法
JP5562143B2 (ja) * 2010-06-28 2014-07-30 キヤノン株式会社 権限委譲システム、権限委譲方法、情報処理装置、及びプログラム
US9209976B2 (en) * 2010-10-29 2015-12-08 Code Systems Corporation Method and system for restricting execution of virtual applications to a managed process environment
CN102663318B (zh) * 2012-03-22 2015-04-08 百度在线网络技术（北京）有限公司 一种浏览器进程权限的控制方法
CN102722559B (zh) * 2012-05-31 2015-09-16 北京奇虎科技有限公司 一种异常页面的进程控制方法、装置和系统
CN103530547A (zh) * 2012-07-02 2014-01-22 爱思爱(天津)高科技有限公司 基于Windows操作系统的集成验证功能登陆第三方应用程序的方法
CN103020512B (zh) * 2012-11-26 2015-03-04 清华大学 一种系统的安全控制流的实现方法及其控制系统
CN103886249B (zh) * 2012-12-20 2018-03-27 腾讯科技（深圳）有限公司 系统超级用户权限下执行进程的方法及装置
CN103544447B (zh) * 2013-05-30 2016-10-12 Tcl集团股份有限公司 一种基于安卓系统的防止机密信息泄露的方法和终端
CN103605920B (zh) * 2013-11-10 2016-03-30 电子科技大学 一种基于SEAndroid平台的应用程序动态安全管理方法及系统
CN104156662B (zh) * 2014-08-28 2017-10-27 北京奇虎科技有限公司 进程监控的方法、装置和智能终端
CN104199711B (zh) * 2014-09-29 2018-02-13 北京奇虎科技有限公司 建立root权限的方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7490072B1 (en) * 2005-02-16 2009-02-10 Novell, Inc. Providing access controls
EP2704004A2 (en) * 2011-04-28 2014-03-05 Fasoo. Com Co., Ltd Computing device having a dll injection function, and dll injection method
CN103955468A (zh) * 2012-03-06 2014-07-30 北京奇虎科技有限公司 基于浏览器的文档展示方法及装置
CN102663321A (zh) * 2012-04-24 2012-09-12 百度在线网络技术（北京）有限公司 用于软件的安全性增强系统及方法

Also Published As

Publication number Publication date
CN105809026A (zh) 2016-07-27
CN109684824A (zh) 2019-04-26
CN109684824B (zh) 2021-09-03
CN105809026B (zh) 2019-02-01

Similar Documents

Publication Publication Date Title
US9852289B1 (en) Systems and methods for protecting files from malicious encryption attempts
US9773102B2 (en) Selective file access for applications
US11409884B2 (en) Security profiling of system firmware and applications from an OOB appliance at a differentiated trust boundary
US8812983B2 (en) Automatic magnification and selection confirmation
WO2015062389A1 (zh) 一种终端设备卸载系统应用的方法和装置
US9172724B1 (en) Licensing and authentication with virtual desktop manager
US20160314082A1 (en) Application access control method and electronic apparatus implementing the same
US9219611B1 (en) Systems and methods for automating cloud-based code-signing services
US8271995B1 (en) System services for native code modules
MX2014007792A (es) Acceso a sistemas de archivos para una o mas aplicaciones en aislamiento de procesos.
US9984087B2 (en) Performing actions on objects as a result of applying tags to the objects
WO2017088135A1 (zh) 一种安全指示信息的配置方法及设备
US8407757B2 (en) Specifying and enforcing run-time policies for application processes being executed on a computer
WO2015058574A1 (zh) 实现扩展应用程序的推送通知的方法及装置
US20170286081A1 (en) Silent Installation of Software with Dependencies
CN109997138B (zh) 用于检测计算设备上的恶意进程的系统和方法
US9411974B2 (en) Managing document revisions
US10805802B1 (en) NFC-enhanced firmware security
WO2016107348A1 (zh) 进程的权限配置方法及装置
US20190034382A1 (en) System and method for a host application to access and verify contents within non-volatile storage of an information handling system
WO2018233549A1 (zh) 支付类应用程序管理方法、装置及移动终端
WO2016095671A1 (zh) 一种应用程序的消息处理方法和装置
JP6798669B2 (ja) アプリケーションに含まれるユーザ情報を隠すための方法及びデバイス
US10409981B2 (en) In-process stack memory protection
US8788785B1 (en) Systems and methods for preventing heap-spray attacks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15875027

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15875027

Country of ref document: EP

Kind code of ref document: A1