WO2017004918A1

WO2017004918A1 - Security control method and device, and computer storage medium

Info

Publication number: WO2017004918A1
Application number: PCT/CN2015/094227
Authority: WO
Inventors: 薛明星
Original assignee: 深圳市中兴微电子技术有限公司
Priority date: 2015-07-06
Filing date: 2015-11-10
Publication date: 2017-01-12
Also published as: CN106341369A

Abstract

Disclosed in an embodiment of the present invention are a security control method and device, the method comprising: determining a security domain to which an application belongs, wherein the security domain comprises a first security domain and a second security domain, and a security level of the first security domain is higher than a security level of the second security domain; and denying an application of the second security domain access to an application of the first security domain according to the security domain to which the application belongs. An embodiment of the present invention further provides a computer storage medium.

Description

Safety control method, device and computer storage medium

Technical field

The present invention relates to security control technologies in the field of communications, and in particular, to a security control method, apparatus, and computer storage medium.

Background technique

With the development of various communication technologies and electronic technologies, the functions of electronic devices are becoming more and more powerful. Specifically, there are a variety of intelligent mobile terminals with powerful functions. The smart mobile terminal may include an electronic device such as a mobile phone or a tablet computer. However, when the smart mobile terminal is used for office work, the office security problem is involved. If the office information is lost, information security and application security problems such as leakage of the company's business secrets may be caused.

However, many smart mobile terminals use systems with lower security levels, such as open Android systems. These systems are vulnerable to malicious code embedding, public-private data mixing, and information leakage due to their openness. These systems also have specific operating systems that are vulnerable to attacks, lack of protection against data breaches, and very limited control and management strategies.

In view of the above problems, virtualization technology is currently used for security isolation. However, virtual machine technology is equivalent to running two systems on the same mobile terminal. This will increase the load on the system and increase the load. Moreover, due to the increased load, a large amount of electric energy is consumed, and the application is applied to the smart mobile terminal, which may cause problems such as standby time of the smart mobile terminal, shortened battery life, and large system resource consumption.

Summary of the invention

In view of this, embodiments of the present invention are directed to providing a security control method, apparatus, and computer storage medium to at least partially solve the problem of large load and high energy consumption of the security control system in the prior art. The problem of the length of standby.

The technical solution of the embodiment of the present invention is implemented as follows:

A first aspect of the embodiments of the present invention provides a security control method, where the method includes:

Determining a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; a security level of the first security domain is higher than a security level of the second security domain;

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs.

Based on the foregoing solution, the application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs, including:

Generating a security identifier according to the security domain to which the application belongs;

And the application of the second security domain is prohibited from accessing the application of the first security domain according to the security identifier.

Based on the foregoing solution, the determining the security domain to which the application belongs includes:

Obtaining an installation certificate for the application;

Determining, according to the installation certificate, a security domain to which the application belongs.

Verifying the installation certificate to form a verification result;

Determining, according to the installation certificate, a security domain to which the application belongs, including:

Based on the verification result, the security domain to which the application belongs is determined.

Based on the foregoing solution, the generating a security identifier according to the security level of the application includes:

Generating a security identifier for the kernel resource corresponding to the application according to the security domain to which the application belongs.

Based on the foregoing solution, the application of the second security domain is prohibited from accessing the application of the first security domain according to the security identifier, including:

According to the security identifier, the application of the second security domain is prohibited from passing interprocess communication or text. The system accesses the application of the first security domain;

And the application of the second security domain is prohibited from accessing the application of the first security domain by using a socket according to the total identifier.

Based on the foregoing solution, the method further includes:

Dividing, according to the security domain to which the application belongs, the internal communication component of the application to the security domain in which the application is located;

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs, including:

The application of the second security domain is prohibited from accessing the application of the first security domain through an internal communication component.

Based on the foregoing solution, the method further includes:

The application of the first security level is allowed to access the application of the second security level according to the security domain to which the application belongs.

Based on the foregoing solution, the method further includes:

Installing the application of the first security level in the first security domain;

The application of the second security level is installed in the second security domain.

A second aspect of the embodiments of the present invention further provides a security control apparatus, where the apparatus includes:

a determining unit, configured to determine a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; and the security level of the first security domain is higher than a security level of the second security domain;

The access control unit is configured to prohibit the application of the second security domain from accessing the application of the first security domain according to the security domain to which the application belongs.

Based on the above solution, the device further includes:

Generating a unit, configured to generate a security identifier according to the security domain to which the application belongs;

The access control unit is configured to prohibit the second security domain according to the security identifier The application accesses the application of the first security domain.

Based on the above solution, the determining unit includes:

Obtaining a module, configured to obtain an installation certificate of the application;

The determining module is configured to determine a security domain to which the application belongs according to the installation certificate.

Based on the above solution, the device further includes:

a verification unit configured to verify the installation certificate to form a verification result;

The determining unit is specifically configured to determine, according to the verification result, a security domain to which the application belongs.

Based on the above solution, the generating unit is configured to generate a security identifier for the kernel resource corresponding to the application according to the security domain to which the application belongs.

Based on the foregoing solution, the access control unit includes:

The first access control module is configured to prohibit, according to the security identifier, an application of the second security domain from accessing an application of the first security domain by using an inter-process communication or a file system;

The second access control module is configured to prohibit the application of the second security domain from accessing the application of the first security domain by using a socket according to the total identifier.

Based on the above solution, the device further includes:

a component unit, configured to divide an internal communication component of the application into a security domain in which the application is located according to a security domain to which the application belongs;

The access control unit is configured to prohibit an application of the second security domain from accessing an application of the first security domain by using an internal communication component.

Based on the foregoing solution, the access control unit is further configured to allow an application of the first security domain to access an application of the second security domain according to a security domain to which the application belongs.

Based on the above solution, the device further includes:

And an installation unit configured to install the application of the first security level in a first security domain; and install the application of the second security level in a second security domain.

The embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to perform at least one of the foregoing methods.

An embodiment of the present invention provides a security control method, apparatus, and computer storage medium, which are applied to a security domain of different security levels, and prohibit applications of a security domain with a low security level from accessing applications in a security domain with a high security level. This also achieves the purpose of isolation application, ensuring the application security and information security, and the system does not need to run two systems, thereby reducing the load of security control, reducing the power consumption of the terminal, and prolonging the standby time of the terminal.

DRAWINGS

1 is a schematic flowchart of a security control method according to an embodiment of the present invention;

2 is a schematic flowchart of determining a security domain to which an application belongs according to an embodiment of the present invention;

3 is a second schematic flowchart of a security control method according to an embodiment of the present invention;

4 is a schematic structural diagram of a security control apparatus according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a safety control apparatus according to an example of the present invention; FIG.

6 is a schematic flow chart of a security control method according to an example of the present invention;

FIG. 7 is a second schematic structural diagram of a safety control device according to an example of the present invention.

detailed description

The present invention is further described in detail with reference to the accompanying drawings and specific embodiments.

Method embodiment:

As shown in FIG. 1 , this embodiment provides a security control method, where the method includes:

Step S110: determining a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; and the security level of the first security domain is higher than a security level of the second security domain;

Step S120: The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs.

The security control method described in this embodiment can be applied to various terminals, and is particularly suitable for use in a mobile terminal, such as an electronic device such as a mobile phone or a tablet computer.

The system adopted by the electronic device in this embodiment may be various types of systems, such as an Android system. In a specific implementation process, the system of the electronic device may be divided into three domains, namely a system domain, a first security level domain, and a second security level domain. The system domain is a system-level application that is self-contained for the system installation, and the applications installed in the first security level domain and the second security level domain are applications installed after the system is installed.

In this embodiment, the security level of the first security domain is higher than the security level of the second security domain, and the security factor in the first security domain is higher. The enterprise application is typically installed into the first secure domain and the personal application is installed into a second secure domain. In short, an application with high information security requirements or high application security requirements involved in the application process is generally installed in the first security domain, otherwise it is installed in the second security domain.

In step S120, in order to access the application in the first security domain for the application in the second security domain, causing information leakage and low application security, the application access installation in the second security domain is restricted in step S120. In the first security domain, this is a good way to achieve application security isolation.

The application of the second security domain is prohibited from accessing the application in the first security domain in step S120. In this embodiment, the application is divided into security domains of different security levels, and mutual access between applications is controlled according to the security domain in which the application is located, so that two systems are operated by running as in the prior art. To achieve access security control, the system burden will be reduced, energy consumption will be saved, and the standby time of the mobile terminal will be prolonged.

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs; but in a specific implementation, the method may further depend on the security of the application attribution. The domain may allow applications in the first security domain to access each other; applications in the second security domain access each other, and applications of the first security domain are allowed to access applications of the second security domain. In this way, the terminal can satisfy the requirement of the user to access the application in the second security domain without exiting the first security domain. For example, applications installed in the first security domain include: enterprise mailboxes, virtual private networks (VPNs), enterprise contacts, and other applications. Applications installed in the second security and installation include personal applications such as WeChat and QQ. If the user uses the Android phone to log in to the enterprise mailbox server using the enterprise mailbox in the VPN in the first security domain. In the process of checking the mail, there is a link in the mail sent by the enterprise mailbox from its personal QQ mailbox. If the first security domain cannot access the application of the second security domain, then it is necessary to enter the second security domain to open the QQ mailbox. However, if the application of the first security domain can access the application of the second security domain, the user can use the QQ mailbox link in the enterprise mailbox to check the personal QQ mailbox, and use the security control method described in this embodiment. When the control electronic device exits the first security domain, the WeChat application can be opened, and the application security is ensured, and the application of the first security domain can be conveniently and quickly controlled to access the application of the second security domain.

The step S120 may include: generating a security identifier according to the security domain to which the application belongs; and prohibiting the application of the second security domain from accessing the application of the first security domain according to the security identifier.

Once the application is installed, the corresponding process is established at runtime, the corresponding memory resources are allocated, corresponding sockets are generated, and communication between applications is implemented by using a pipeline.

In order to control access more conveniently, a corresponding security identifier will be generated in this embodiment. The security identifier of the application corresponding kernel resource is determined by the security domain to which the application belongs. If the application belongs to the first security domain, the security identifier of the corresponding kernel resource is also corresponding to the first security domain. If the application belongs to the second security domain, the security identifier of the corresponding kernel resource is also corresponding to the second security domain.

Controlling the application's previous visit based on the security identifier when performing access control between applications ask. If the security identifiers of the kernel resources of the two applications that need to access each other indicate that the two applications belong to the same security domain, mutual access is allowed. If the security identifiers of the kernel resources of the two applications that need to access each other indicate that the two applications belong to different security domains, the application of the security domain of the high security level is allowed to access the application of the security domain of the low security level, and the low security level is prohibited. The application of the security domain accesses the application of the security domain with a high security level.

As shown in FIG. 2, the step S110 may include:

Step S111: Acquire an installation certificate of the application.

Step S112: Determine, according to the installation certificate, a security domain to which the application belongs.

When an application is installed, it usually corresponds to the installation certificate of the installation package. The installation certificate is a standard issued by the issuing organization and can be used to provide reference for security. The installation certificate may include an enterprise publishing certificate and a general certificate. In general, if the installation certificate of the application is a certificate issued by the enterprise, it indicates that the application requires high application security level and information security level. If the installation certificate of the application is a normal certificate, it indicates that the application requires a relatively low application security level and information security level. In this embodiment, according to this feature, the security domain to which the application belongs is determined according to the installation certificate of the application.

In a specific implementation process, the security domain to which the application belongs may also be determined according to an indication input by the user. For example, when the electronic device installs the application, a corresponding dialog box is popped up, asking whether the application being installed by the user is installed to the first security domain or the second security domain, receiving an indication input by the user, and installing the application according to the indication to the corresponding The process of the security domain not only realizes the division of the security domain to which the application belongs, but also implements the installation of the application. For example, when the application is installed, the method may include: installing the application of the first security level in a first security domain; and installing the application of the second security level in a second security domain.

The step S110 further includes: verifying the installation certificate to form a verification result. The step S112 includes: determining, according to the verification result, a security domain to which the application belongs.

In this embodiment, in order to further improve the security of the application of the first security domain, some are avoided. The installation certificate of the application is maliciously falsified, so that the application that should be installed in the first security domain is incorrectly installed in the second security domain, and the application that is incorrectly installed to the first security domain accesses the other application in the first security domain. The problem.

The verifying the installation certificate herein may include transmitting the installation certificate to the verification platform via the network for verification, and receiving the verification result from the verification platform. There are of course many methods for verification. See the prior art, and we will not describe them one by one here.

The generating the security identifier according to the security level of the application includes: generating a security identifier for the kernel resource corresponding to the application according to the security domain to which the application belongs.

The kernel resources may include shared resources such as pipes, sockets, message queues, and shared memory that are available for inter-application access.

The pipeline: in Linux is a very frequent communication mechanism. In essence, a pipe is also a file that corresponds to a buffer with a fixed capacity.

The combination of the source IP address and the destination IP address and the source port number and the destination port number is called a socket. It is used to identify the servers and services requested by the client. The IP is an abbreviation of Internet Protocol, and the corresponding Chinese is a network protocol.

The message queue is a container that holds messages during the transmission of a message.

These kernel resources provide a way and means for applications to access each other.

In this embodiment, a security identifier is generated for the kernel resource corresponding to the application, and the application of the second security domain is prohibited from accessing the application of the first security domain according to the security identifier.

Mutual access between applications can include utilization

The step S120 may specifically include:

According to the security identifier, the application of the second security domain is prohibited from accessing the application of the first security domain by using an inter-process communication or a file system;

In this case, the application of the second security domain is prohibited from accessing the application of the first security domain through inter-process communication.

In the meantime, in order to prevent the application from being accessed by the sockets, in the embodiment, the firewall can be used to securely filter the socket according to the security identifier of the socket, so as to prevent the application of the second security domain from accessing the socket through the socket. The application of the security domain.

In addition, as shown in FIG. 3, the method further includes:

Step S111: According to the security domain to which the application belongs, the internal communication component of the application is divided into the security domain where the application is located;

The step S120 may include:

The access between the applications can also be accessed through the internal communication component of the system. In this embodiment, in order to prevent the application of the first security domain from being accessed by the application of the second security domain by using the internal communication component, step S111 in this embodiment is performed. The middleware divides the components into different security domains, and the lower security domain internal communication components cannot access applications in the higher security domain. That is, the internal communication component in the second security domain cannot access the application in the first security domain; of course, the application of the second security domain cannot access the internal communication component in the first security domain.

It is obvious that the method in this embodiment prohibits the application of the second security domain from using the inter-process communication, the internal communication component, and the socket to access the application of the first security domain, thereby ensuring the security of the application of the first security domain. Information security, and avoids the problem of high energy consumption and short standby time caused by the simultaneous operation of two sets of electronic devices.

In addition, in order to further enhance the usage security and information security of the application of the first security domain, the method in this embodiment further includes:

Record information such as the security domain to which the application belongs, the security domain to which the component belongs, and the security identity of the kernel resource.

Regularly detecting whether the security identifier of the kernel resource has been tampered with, the system kernel code has been tampered with, the security domain to which the component belongs, and the security domain to which the application belongs are illegally tampered to prevent security identification and The kernel code was tampered with the use of security and information security risks.

Equipment embodiment:

As shown in FIG. 4, this embodiment provides a security control apparatus, where the apparatus includes:

The determining unit 110 is configured to determine a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; and the security level of the first security domain is higher than a security level of the second security domain;

The access control unit 120 is configured to prohibit an application of the second security domain from accessing an application of the first security domain according to a security domain to which the application belongs.

The security control device in this embodiment may be part of the terminal itself or in the terminal. The terminal may include an electronic device such as a mobile phone or a tablet computer. The system of the terminal may include an Android system.

The specific structure of the determining unit 110 and the access control unit 120 may correspond to a processor or processing circuit having an information processing function in the terminal. The processor may include a processor having an information processing function, such as an application processor, a central processing unit, a microprocessor, a digital signal processing, or a programmable array. The processing circuit can include a dedicated integrated control circuit ASIC. The processor can perform the corresponding function by performing execution of the specified code.

The device also includes:

The access control unit 120 is configured to prohibit an application of the second security domain from accessing an application of the first security domain according to the security identifier.

The generating unit may include a processor or a processing circuit capable of generating the security identifier, and may further include a storage medium storing the security identifier. The security identifier is stored by the storage medium, and the application of the second security domain is prohibited from accessing the application of the first security domain in subsequent use.

The determining unit includes:

And a determining module, configured to determine, according to the installation certificate, a security domain to which the application belongs.

The obtaining module may include a parser for obtaining the installation certificate by parsing an installation package or an installation file of the application.

The determining module may include a processor or processing circuit to determine a security domain to which the application belongs according to the installation certificate.

The device also includes:

The determining unit 110 is configured to determine, according to the verification result, a security domain to which the application belongs.

The structure of the verification unit is different depending on the manner of verification. If the verification is performed by the verification platform, the verification unit includes a communication interface, and the communication interface may be a wired or wireless communication interface, and can communicate with the verification platform. And obtaining the verification result. If the terminal self-verifies the installation certificate, the verification unit may include a processor or processing circuit with verification processing. The structure of the processor and the processing circuit can be referred to the foregoing part and will not be repeated here.

The generating unit is configured to generate a security identifier for the kernel resource corresponding to the application according to the security domain to which the application belongs.

In this embodiment, the kernel resource of the application is marked, and the identifier is the security identifier, and then the security identifier is used to allow or prohibit communication between applications according to the security identifier. . In the embodiment, the communication between the applications is prohibited, and the application of the second security domain is prohibited from accessing the application of the first security domain.

The access control unit 120 includes:

In this embodiment, the access control unit 120 is divided into a first access control module and a second access. The control module controls different access modes between applications. The first access control module is configured to prevent the application of the second security domain from accessing the application of the first security domain by using the inter-process communication, for example, the application of the second security domain is prohibited from accessing the first security domain by using an IPC process. Applications. The IPC process is performed based on an IPC object. An IPC object is a tool that communicates between processes at the kernel level. The IPC object can be any type of message queue or semaphore or shared memory.

As a further improvement of the embodiment, the device further includes:

The access control unit 120 is configured to prohibit an application of the second security domain from accessing an application of the first security domain by using an internal communication component.

The internal communication component is also a communication mode for the mutual access between the applications. In this embodiment, the component unit divides the component into a corresponding security domain according to the security domain to which the application belongs; and according to the security of the internal communication component attribution. The domain accesses the corresponding application.

The access control unit 120 is further configured to allow an application of the first security domain to access an application of the second security domain according to a security domain to which the application belongs.

Of course, in order to achieve convenient operation, improve the intelligence of the terminal and the satisfaction of the user, the access control unit 120 allows the application of the first security domain without reducing the use security and information security of the application of the first security domain. Access to the application of the second security domain.

The device also includes:

The specific structure of the installation unit may include the foregoing processor or processing circuit, which is not repeated here. In general, the application with different application security and information security requirements is installed in the corresponding security domain in this embodiment, which improves. Application security and information security; and can reduce power consumption, Extend the standby time of the terminal.

Several specific examples are provided below in conjunction with the above embodiments:

Example 1:

This example provides a security control method based on SELinux. The SELinux is an abbreviation of Security-Enhance Linux, and the corresponding Chinese is enhanced Linux. And use this SELinux with Android to provide application security and information security.

The application and data are divided into two parts: a second security domain and a security domain, wherein the second security domain manages private data and applications, including applications such as browsers and WeChat. The first security domain manages enterprise data and applications, and employees manage their own address books, send and receive emails, manage corporate data, participate in phone calls, and video conferencing in a secure domain. The application between the first security domain and the second security domain cannot communicate, or at least does not allow the second security domain to access the first security domain. In addition, because the kernel uses SELinux, even if the system is flashed, it cannot access the resources protected by the policy control.

The second security domain in this embodiment is equivalent to the second security domain in the foregoing embodiment; the security domain is equivalent to the first security domain in the foregoing embodiment.

As shown in FIG. 5, the system of the terminal is divided into a kernel layer, a middleware layer, and an application layer.

The applications of the application layer are divided into personal applications and enterprise applications. The enterprise application installation runs in the first security domain; the personal application installation runs in the second security domain.

The personal application may include an application such as WeChat, browser, QQ, and the like. The enterprise application may include a mailbox, a contact book, and the like.

The enterprise application runs in the first security domain and is controlled by the enterprise network management equipment. After the employee accesses the company network through the VPN through the terminal, he can log in to the company mailbox in the first security domain to send and receive emails, participate in telephone and video conferences. The data of the enterprise application cannot be accessed by the second security domain. Data between enterprise applications in the first security domain is achievable.

The middleware layer includes a middleware layer control module and a policy control module.

The middleware layer control module is the security control part of the middleware layer on the Android system. If you control the communication between different components.

The policy control module divides the system into three domains, namely a system domain, a second security domain, and a first security domain. The system domain is a pre-installed application. The system domain can be accessed by the first security domain and the second security domain. The first security domain and the second security domain may not access each other; or the first security domain may access the second security domain, but the second security domain cannot access the first security domain. Each component also belongs to one of the domains, and mandatory access control is performed according to the established policy.

The policy control module also belongs to the middleware layer. The policy control module further includes a policy management module, a firewall management module, and a kernel MAC management module.

The policy control module is responsible for dividing the newly installed application into access control between the first security domain and the second security domain and between different security domains according to the relevant certificate.

The policy control module guides the access control of the middleware layer control module and the kernel layer control module. The middleware layer control module and the kernel layer control module prohibit communication between the first security domain and the second security domain according to policy rules of the policy control module, or allow communication between the first security domain and the second security domain.

The policy control module herein is equivalent to the determination unit 110 in the foregoing embodiment. The middleware layer control module and the kernel layer control module may be components of the access control unit 120 in the foregoing embodiment. The kernel layer control module is equivalent to the first access control module and the second access control module in the access control unit 120, and prohibits applications of the second security domain from accessing the first security domain by controlling interprocess communication and sockets. Applications.

The middleware layer control module is specifically configured to prohibit an application of the second security domain from accessing the application of the first security domain according to the policy of the policy management module.

The kernel layer control module belongs to the kernel layer. The kernel layer control module is based on SELinux security control, and SELinux is a mandatory access control MAC system provided in the Linux kernel. Adding mandatory access control to the kernel can improve the security of the kernel.

The kernel control module can be divided into a firewall module and a kernel MAC module. The firewall Modules are managed and controlled by the firewall management module. The kernel MAC module is managed and controlled by the kernel MAC management module. The firewall management module is specifically configured to prohibit an application of the second security domain from accessing the application of the first security domain through the socket according to the instruction and the record of the firewall management module. The kernel MAC module is specifically configured to prohibit an application of the second security domain from accessing an application of the first security domain by using a file system or inter-process communication according to the instruction and record of the kernel MAC module.

The policy control module instructs the kernel layer control module to manage the communication security control, that is, assigns different security labels to the kernel resources of the kernel according to the domain division of the policy control module, and divides them into different domains to ensure the first security domain and the second security domain. Secure communication between.

Inter-application communication methods based on kernel resources include: communication methods based on pipes, message queues, sockets, shared memory, and file systems. The access control of the SELinux kernel relies on the security policy file, which specifies the access rules between access entities.

In order to further enhance the security of communication at the kernel layer, the kernel layer control module is also used to periodically check whether the kernel layer has been modified to prevent tampering within the kernel. The kernel layer control module also includes a firewall mechanism to prevent network entities between different domains from using local address communication.

Example two:

Secure control with SELinux, including:

Step S1: New application APK installation. APK is the abbreviation of Android Package, which is the Android installation package. The installation of a new app APK on Android is done by the installation package management module. When the installation package management module installs a new application APK, it will notify the policy management module that the new application is to be installed.

Step S2: The policy management module extracts a certificate from the APK. The certificate here is equivalent to the installation package certificate in the previous embodiment. The policy management module extracts the certificate of the new application APK in step S1, and the certificate indicates that the certificate is issued by the enterprise or a common certificate. The issuing authority of the certificate serves as the standard for isolation. The certificate issued by the enterprise, then the application is installed in the first security domain, if not Installed in the second security domain.

Step S3: The policy management module passes the certificate extracted in step 2 to the verification module to request verification.

Step S4: Performing verification, specifically: the verification module verifies whether the certificate of step 3 is an enterprise application or a personal application according to the verification rule, and generates a verification result to step 5. These verification rules are pre-stored in the verification module.

Step S5: The verification module of step 4 returns the verification result to the policy management module, and the policy management module performs security isolation and guides the kernel MAC management module and the firewall module to perform security isolation.

Step S6: Verification By adding the application to the first security domain, the verification does not pass the application to the second security domain.

Step S7: Notifying the kernel MAC management module. In this case, the kernel resources such as kernel processes, sockets, and file systems generated by the application belong to the first security domain or the second security domain. The kernel MAC management module securely identifies the kernel-level resources, and prohibits applications of the second security domain based on the kernel resources from accessing applications of the second security domain. The kernel resources include: pipes, message queues, sockets, and the like.

Step S8: Notifying the firewall management module. In addition to socket communication with remote hosts, local applications can also communicate over network sockets. Therefore, in addition to securely isolating the remote network socket, the local network socket is also isolated. The policy management module instructs the firewall management module to add a security token to the socket of the application according to the verification result of step S4. The firewall management module records which application establishes which socket, whether the application is the first security domain or the second security domain.

Step S9: The policy management module notifies the installation package management module that the verification does not pass the installation in the second security domain by installing the application in the first security domain. The policy management module notifies the installation package management module whether the application is an enterprise application or a personal application according to the verification result of step S4, and the installation package management module installs the application on the corresponding side according to the information, that is, the enterprise application security Installed in the first security domain, the personal application is installed in the second security domain. The installation package management module herein is an integral part of the installation unit in the foregoing embodiment.

Step S10: Application installation is implemented by an installation package management module.

Example three:

As shown in Figure 6, this example is based on a device that implements security control in SELinux. The device is divided into a kernel layer, a middleware layer, and an application layer. The application layer includes: an application A101 and an application B102.

The middleware layer includes a middleware layer control module 103, a policy management module 104, a firewall management module 105, and a MAC management module 106.

The kernel layer includes a kernel MAC layer 107 and a firewall module 108.

Application A101, an application running in a second security domain on the ordinary Android system. Generally belong to personal applications.

The application B102 runs an application of the first security domain on the ordinary Android system. Generally belong to enterprise-level applications.

The middleware layer control module 103 is a forced access control on the middleware layer of the Android system, and aims to prevent the non-secure application A101 from using the component to access the secure domain application B102. Applications running inside the first security domain can access each other, that is, information within the enterprise can be shared. Applications running inside the second security domain follow the permissions mechanism of the Android system itself, and can access each other upon applying for permission.

The policy management module 104 is a module belonging to the middleware layer, and is mainly responsible for controlling the middleware layer control module 103, the firewall management module 105, and the kernel MAC management module 106, and directs communication of each layer, that is, the first security domain and the second security domain. Can not communicate, or control the second security domain can not access the security domain.

The firewall management module 105 is a module belonging to the middleware layer, which is used to record which application's security identifier, the established socket of the application, and the IP address of the socket according to the instruction of the policy management module 104, so that the purpose is to let The firewall module 108 filters the application of the security domain and the second security domain. Applications use a local connection established by a socket to access each other.

The kernel MAC management module 106 is a module belonging to the middleware layer for converting to the security identifier of the kernel layer according to the instruction of the policy management module 104, and the kernel MAC module 107 prohibits the application A101 from accessing the application B 102 through the file system and inter-process communication.

The kernel MAC module 107 belongs to the kernel layer. The kernel layer's mandatory access control is dependent on SELinux support, and based on the security indication of the kernel MAC management module 106, controls process-based communication between different security domains. In addition, the file system-based communication is also controlled for different security applications. The attribute of the identification file is the first security domain or the second security domain, and different domains cannot communicate with each other; or at least a security domain with a low security level. Applications cannot access applications with high security level security domains.

The firewall module 108 belongs to the kernel layer. The firewall module 108 is configured to allow the application creation sockets between the security domains to communicate using the local address according to the records of the firewall management module 105, and to prohibit the application between the foreign domains from creating the network sockets to use the local address communication. The local address here may include the IP address of the terminal and the like.

An embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, where the computer executable instructions are used to perform at least one of the foregoing methods; specifically, as shown in FIG. 1 to FIG. Any of the methods shown. The computer storage medium in this embodiment may include various types of storage media such as a hard disk, an optical disk, a flash disk or a USB disk, and optionally a non-transitory storage medium.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be through some connection. The indirect coupling or communication connection of a port, device or unit may be electrical, mechanical or other form.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; the above integration The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. A medium that can store program code.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and modifications made in accordance with the principles of the present invention should be understood as falling within the scope of the present invention.

Claims

A security control method, the method comprising:

Determining a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; a security level of the first security domain is higher than a security level of the second security domain;

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs.
The method of claim 1 wherein

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs, including:

Generating a security identifier according to the security domain to which the application belongs;

And the application of the second security domain is prohibited from accessing the application of the first security domain according to the security identifier.
The method of claim 2, wherein

The determining the security domain to which the application belongs includes:

Obtaining an installation certificate for the application;

Determining, according to the installation certificate, a security domain to which the application belongs.
The method of claim 3, wherein

The determining the security domain to which the application belongs includes:

Verifying the installation certificate to form a verification result;

Determining, according to the installation certificate, a security domain to which the application belongs, including:

Based on the verification result, the security domain to which the application belongs is determined.
The method of claim 2, wherein

Generating a security identifier according to the security level of the application, including:

Generating a security standard for the kernel resource corresponding to the application according to the security domain to which the application belongs knowledge.
The method of claim 5, wherein

The forbidding, by the security identifier, the application of the second security domain to access the application of the first security domain, including:

According to the security identifier, the application of the second security domain is prohibited from accessing the application of the first security domain by using an inter-process communication or a file system;

And the application of the second security domain is prohibited from accessing the application of the first security domain by using a socket according to the total identifier.
The method of claim 1 wherein

The method further includes:

Dividing, according to the security domain to which the application belongs, the internal communication component of the application to the security domain in which the application is located;

The application of the second security domain is prohibited from accessing the application of the first security domain according to the security domain to which the application belongs, including:

The application of the second security domain is prohibited from accessing the application of the first security domain through an internal communication component.
The method of claim 1 wherein

The method further includes:

The application of the first security level is allowed to access the application of the second security level according to the security domain to which the application belongs.
The method of claim 1 wherein

The method further includes:

Installing the application of the first security level in the first security domain;

The application of the second security level is installed in the second security domain.
A safety control device, the device comprising:

a determining unit, configured to determine a security domain to which the application belongs; the security domain includes a first security domain and a second security domain; and the security level of the first security domain is higher than a security level of the second security domain;

The access control unit is configured to prohibit the application of the second security domain from accessing the application of the first security domain according to the security domain to which the application belongs.
The device according to claim 10, wherein

The device also includes:

Generating a unit, configured to generate a security identifier according to the security domain to which the application belongs;

The access control unit is configured to prohibit an application of the second security domain from accessing an application of the first security domain according to the security identifier.
The apparatus according to claim 11, wherein

The determining unit includes:

Obtaining a module, configured to obtain an installation certificate of the application;

And a determining module, configured to determine, according to the installation certificate, a security domain to which the application belongs.
The device according to claim 12, wherein

The device also includes:

a verification unit configured to verify the installation certificate to form a verification result;

The determining unit is configured to determine a security domain to which the application belongs based on the verification result.
The apparatus according to claim 11, wherein

The generating unit is configured to generate a security identifier for the kernel resource corresponding to the application according to the security domain to which the application belongs.
The device according to claim 14, wherein

The access control unit includes:

The first access control module is configured to prohibit the second security domain according to the security identifier The application accesses the application of the first security domain through an inter-process communication or a file system;

The second access control module is configured to prohibit the application of the second security domain from accessing the application of the first security domain by using a socket according to the total identifier.
The device according to claim 10, wherein

The device also includes:

a component unit, configured to divide an internal communication component of the application into a security domain in which the application is located according to a security domain to which the application belongs;

The access control unit is configured to prohibit an application of the second security domain from accessing an application of the first security domain by using an internal communication component.
The device according to claim 10, wherein

The access control unit is further configured to allow an application of the first security domain to access an application of the second security domain according to a security domain to which the application belongs.
The device according to claim 10, wherein

The device also includes:

And an installation unit configured to install the application of the first security level in a first security domain; and install the application of the second security level in a second security domain.
A computer storage medium having stored therein computer executable instructions for performing at least one of the methods of claims 1-9.