WO2017016231A1 - Policy management method, system and computer storage medium - Google Patents

Abstract

An embodiment of the present invention discloses a policy management method, comprising: adopting a security isolation technique and dividing an execution environment into a non-secure execution environment and a secure execution environment; in the non-secure execution environment, dividing various applications into fields, and according to a preset policy file, providing a media access control (MAC) query service for access between each application of the fields; in the secure execution environment, managing the policy file, wherein, the managing comprises at least one of the following: querying, loading, updating, or storing. An embodiment of the present invention also discloses a policy management system and a computer storage medium.

Description

Strategy management method, system and computer storage medium Technical field

The present invention relates to the field of application security technologies, and in particular, to a policy management method, system, and computer storage medium.

Background technique

With the continuous popularization of mobile Internet and various electronic devices, the security of electronic devices of Android (Android) system has become the focus of attention of the industry and users. At present, the main reasons for the frequent occurrence of Android system vulnerabilities are: open development environment, lack of protection mechanism for electronic device data, very limited control and management strategies.

Usually, the Android system controls the permissions through the sandbox mechanism. However, if the superuser (root) permissions of the electronic device are usurped, then all application resources can be accessed by the superuser, and the virus program will also wait for the electronic device. The control of the device seriously affects the security of electronic devices.

In response to the above problems, in order to prevent malicious applications (App) attacks on Android systems or other applications, starting from version 4.3, the Android system introduced a SELinux-based security mechanism called SEAndroid to enhance system security. The central idea of SEAndroid is to establish a security policy through the Mandatory Access Control (MAC) technology. Even if the root privileges are taken over, the access rights are still restricted by the security policy, thus minimizing the security risks brought by the attacks; The existing technology improves the security of the security application of the Android system to a certain extent. However, the following problems still exist: the security policy file of the SEAndroid is installed in the platform/external/sepolicy directory, that is, the deployed security policy files are placed. In a non-secure environment, it is conceivable that once a hacker intercepts the security policy file, the access rules set in the policy are tampered with and malicious code is embedded, so that the security policy cannot guarantee the power. Security of child devices and security applications.

The birth of a processor with secure isolation opens up a new path for the security of electronic devices, integrating protection functions into the core to ensure the security of the Android system, while providing a secure software platform for semiconductor manufacturers, device manufacturers and Operating system partners extend and develop their own security solutions on a shareable framework. For example, the ARM processor's TrustZone technology completely isolates the non-secure execution environment from the secure execution environment and can be converted between a secure mode and a non-secure mode via a security monitor (Monitor).

Therefore, how to improve the security of Android system with security isolation technology has become an urgent problem to be solved.

Summary of the invention

In view of this, embodiments of the present invention are expected to provide a policy management method, system, and computer storage medium, which can improve the security of the Android system.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

The embodiment of the invention provides a policy management method, and the method includes:

The security isolation technology is used to divide the execution environment into a non-secure execution environment and a secure execution environment;

In the non-secure execution environment, domain division is performed for each application; and a mandatory access control MAC query service is provided for access between applications of each domain according to a pre-defined policy file;

In the secure execution environment, the policy file is managed; wherein the management includes at least one or more of the following: query, load, update, and store.

In the foregoing solution, the foregoing provides a MAC query service for access between applications in each domain according to a pre-defined policy file, including:

When the preset condition is met, sending a first instruction to the secure execution environment side;

Receiving a first command response result returned by the secure execution environment side;

Correspondingly, the managing the policy file includes:

Performing a first operation on the policy file according to the first instruction; wherein the first operation is to Less include one or more of the following: query, load, update, store;

Returning the first command response result to the non-secure execution environment side.

In the above solution, when the preset condition is met, the first instruction is sent to the security execution environment side, including:

Obtaining domain information of the first application and the second application when detecting that the first application accesses the second application;

Transmitting, to the security execution environment side, a first instruction, where the first instruction carries at least the domain information of the first application and the second application.

In the above solution, the performing the first operation on the policy file according to the first instruction includes:

Obtaining a query result according to the first application and the domain information query policy library of the second application;

Returning a first command response result to the non-secure execution environment side based on the query result.

In the above solution, the domain division of each application further includes:

Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain.

In the above solution, the managing the policy file further includes:

Determining, according to a preset rule, a policy file about the new application based on the first information of the new application, where the first information includes at least domain information and a user identifier;

Updating the policy library based on the policy file of the new application.

In the above solution, the preset rule includes at least one or more of the following:

The first rule for non-secure domain applications to access non-secure domain applications,

The second rule for non-secure domain applications to access security domain applications,

The third rule for the security domain application to access the non-secure domain application,

The fourth rule of the security domain application accessing the security domain application,

The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain.

The embodiment of the present invention further provides a policy management system, which uses a security isolation technology to divide the execution environment into a non-secure execution environment and a security execution environment; the system includes: a non-secure operating system and a security operating system;

The non-secure operating system is configured to perform domain division for each application according to a pre-defined policy file; and provide a MAC query service for access between applications of each domain according to a pre-defined policy file;

The security operating system is located in a secure execution environment and is configured to manage a policy file. The management includes at least one or more of the following: query, load, update, and store.

In the above solution, the non-secure operating system includes a first policy management module and a first communication proxy module;

The first policy management module is configured to perform domain division on each application; when the preset condition is met, the first communication proxy module sends a first instruction to the security execution environment side;

The first communication proxy module is configured to send a first instruction to the secure execution environment, receive a first command response result returned by the secure execution environment side, and send the first command response result to the first a policy management module;

Correspondingly, the security operating system includes a second policy management module and a second communication proxy module;

The second policy management module is configured to perform a first operation on the policy file according to the first instruction, where the first operation includes at least one or more of the following: query, load, update, and store Transmitting, by the second communication proxy module, a first command response result to the non-secure execution environment side;

The second communication proxy module is configured to receive the first instruction sent by the first communication proxy module, and send the first instruction to the second policy management module; and receive the return of the second policy module The first command responds to the result and sends the first command response result to the first communication agent module.

In the foregoing solution, the first policy management module includes: a domain division unit and a MAC management unit; wherein

The domain dividing unit is configured to perform domain partitioning on each application; when detecting that the first application accesses the second application, acquiring domain information of the first application and the second application; and the first application And sending the domain information of the second application to the MAC management unit;

The MAC management unit is configured to send a first instruction to the security execution environment side, where the first instruction carries at least the domain information of the first application and the second application.

In the above solution, the second policy management module includes:

The policy query unit is configured as:

Obtaining a query result according to the first application and the domain information query policy library of the second application;

Sending a first command response result to the non-secure execution environment side based on the query result.

In the above solution, the domain dividing unit is further configured to:

Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain.

In the above solution, the second policy management module further includes:

a policy update unit, configured to formulate a policy file for the new application based on the first information of the new application according to a preset rule, where the first information includes at least domain information, a user identifier, and based on the new application Policy file update policy library;

a secure storage unit configured to store policy files to a non-volatile secure storage space;

a policy loading unit configured to read a policy file from the non-volatile secure storage space and load the policy file into a policy library located in a secure operating system kernel, so that the policy update unit updates the policy library .

In the above solution, the preset rule includes at least one or more of the following:

The first rule for non-secure domain applications to access non-secure domain applications,

The second rule for non-secure domain applications to access security domain applications,

The third rule for the security domain application to access the non-secure domain application,

The fourth rule of the security domain application accessing the security domain application,

The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain.

The embodiment of the invention provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to execute the policy management method described above.

The policy management method, the system, and the computer storage medium provided by the embodiments of the present invention use the security isolation technology to divide the execution environment into a non-secure execution environment and a security execution environment; in the non-secure execution environment, domain division is performed on each application; Providing a MAC query service for access between applications of each domain according to a pre-defined policy file; in the secure execution environment, managing a policy file; wherein the management includes at least one or more of the following: Query, load, update, store. As such, the technical solution in the embodiment of the present invention can improve the security of the Android system and greatly improve the user experience.

DRAWINGS

FIG. 1 is a schematic flowchart of a policy management method according to an embodiment of the present invention;

2 is a schematic diagram of a framework of a policy management system according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a process flow of a policy in a new application installation process according to an embodiment of the present invention:

4 is a process flow of a non-secure domain application accessing a security domain application according to an embodiment of the present invention schematic diagram;

FIG. 5 is a schematic diagram of a process flow of a security domain application accessing a security domain application according to an embodiment of the present invention.

detailed description

The technical solutions of the present invention are further elaborated below in conjunction with the accompanying drawings and specific embodiments.

FIG. 1 is a schematic flowchart of a policy management method according to an embodiment of the present invention, which is applied to an electronic device. As shown in FIG. 1 , the policy management method mainly includes the following steps:

Step 101: The security isolation technology is used to divide the execution environment into a non-secure execution environment and a security execution environment.

In an embodiment, the policy management deployed in the Android system can be divided into a secure part and a non-secure part by using a processor with security isolation function.

Here, the processor may be an ARM processor with security isolation.

Step 102: Perform domain division on each application in the non-secure execution environment, and provide a mandatory access control MAC query service for access between applications of each domain according to a pre-defined policy file.

Step 103: In the security execution environment, manage the policy file; wherein the management includes at least one or more of the following: query, load, update, and store.

That is to say, in this embodiment, the security management technology is introduced, and the policy management is divided into the security side and the non-secure side, and the non-secure side only sends the command, and the real policy storage and operation are performed in the security execution environment (trusted environment). Improves the security of the policy storage and operations (query, update, load, etc.), thus improving the security of the Android system.

In the foregoing solution, in an embodiment, the providing the MAC query service for the access between the applications of the respective domains according to the pre-defined policy file may include:

When the preset condition is met, sending a first instruction to the secure execution environment side;

Receiving a first command response result returned by the secure execution environment side;

Correspondingly, the managing the policy file may include:

Performing a first operation on the policy file according to the first instruction; where the first operation includes at least one or more of the following: query, load, update, and store;

Returning the first command response result to the non-secure execution environment side.

In the foregoing solution, in an embodiment, when the preset condition is met, sending the first instruction to the security execution environment side, including:

Obtaining domain information of the first application and the second application when detecting that the first application accesses the second application;

Transmitting, to the security execution environment side, a first instruction, where the first instruction carries at least the domain information of the first application and the second application.

Here, the first application is equivalent to an access subject, and the file or socket resource in the second application is equivalent to an access object. The first application may be an application of a security domain or an application of a non-security domain. The second application may be an application of a security domain, an application of a non-security domain, or an application of a system domain. It is worth noting that: applications are generally processes, all belong to the main body, while resources in the application such as files and sockets belong to the object.

In the foregoing solution, in an embodiment, the performing the first operation on the policy file according to the first instruction may include:

Obtaining a query result according to the first application and the domain information query policy library of the second application;

Returning a first command response result to the non-secure execution environment side based on the query result.

In the above solution, preferably, the domain division of each application may further include:

Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain.

In the above solution, in an embodiment, the managing the policy file further includes:

Determining, according to a preset rule, a policy file about the new application based on the first information of the new application, where the first information includes at least domain information and a user identifier;

Updating the policy library based on the policy file of the new application.

In this way, strategies can be developed for newly installed applications in a timely manner to ensure the security of the secure environment of electronic devices.

The preset rule includes at least one or more of the following:

The first rule for non-secure domain applications to access non-secure domain applications,

The second rule for non-secure domain applications to access security domain applications,

The third rule for the security domain application to access the non-secure domain application,

The fourth rule of the security domain application accessing the security domain application,

The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain.

Here, the first rule is: allowing a non-secure domain application to access the non-secure domain application; the second rule is: not allowing the non-secure domain application to access the security domain application; the third rule is: disallowing the security domain application Accessing the non-secure domain application; the fourth rule is: allowing the security domain application to access the security domain application; the fifth rule is: allowing the non-secure domain application and the security domain application to access the system domain application.

The application in the system domain is an application pre-installed by an electronic device of the Android system, such as a calculator application, a flashlight application, and the like.

In this embodiment, the policy management of the Android deployment is divided into non-secure and security parts by using a processor with security isolation function, wherein the non-secure part is responsible for domain division and MAC control management functions, and the security part is responsible for secure storage of policies and policies. Load, query, and update features. In this way, the policy can be saved and operated completely from the non-secure environment. Without changing the existing Android technology architecture, the security policy can be deployed on the smart terminal and the policy can be managed securely. Slightly document. For example: in MAC mode: The objects and permissions that the web server process can operate are clearly listed in the security policy (only access to the network and access to specific files, etc.). Even if the web server is injected with a malicious virus, it is still impossible to do whatever it wants by the web server process, because the unauthorized behavior of all security policies is still not allowed. More importantly, the policy is stored in a secure environment and cannot be tampered with or Malicious code is implanted.

Embodiment 2

2 is a schematic diagram of a framework of a policy management system according to an embodiment of the present invention. As shown in FIG. 2, the policy management system uses a security isolation technology to divide an execution environment into a non-secure execution environment and a security execution environment, where the system mainly includes : non-secure operating system 10, secure operating system 20; wherein

The non-secure operating system 10 is located in a non-secure execution environment, and is configured to perform domain division on each application; and provide a MAC query service for access between applications of each domain according to a pre-defined policy file;

The security operating system 20 is located in a secure execution environment and configured to manage policy files. The management includes at least one or more of the following: query, load, update, and store.

In an embodiment, the non-secure operating system 10 runs in a non-secure execution environment of a processor with a security isolation function, and may be a commonly used operating system on an electronic device, such as a Linux operating system, on which Android can be run. Various applications of the system.

In an embodiment, the security operating system 20 runs in the secure execution environment of the processor with the security isolation function, and is responsible for performing secure storage and related operations on the policy file. The operation includes at least: query, Load, update.

In an embodiment, the system mainly comprises:

The security monitor 30 is an operation mode of the ARM processor, that is, a monitor mode, which is responsible for switching the execution environment; wherein the execution environment includes a non-secure execution environment and security The full execution environment; here, it is worth noting that the security monitor is not a hardware unit, but a working mode of the central processing unit (CPU), with the user (User) mode, management (Supervisor, referred to as Svc The mode is a parallel relationship. The CPU must be in one of several execution modes at any time. When the first communication agent module receives the upper layer query command, it is in Svc mode, and the second communication agent module calls system management in Svc mode. The controller (SMC, System Management Controller) command changes the CPU to monitor mode to convert between a secure execution environment and a non-secure execution environment.

A non-volatile secure storage space 40 is responsible for storing security policy files.

Here, the non-volatile secure storage space 40 is an exclusive area of the second policy management module 21 and is not accessed by an application in a non-secure execution environment or other security applications in a secure execution environment.

Since the security policy file is stored in the non-volatile secure storage space 40, since the access to all files, directories, and ports in the Android system is based on policies, the security side only needs to formulate a fine-grained and high-security policy. It is possible to isolate communication between applications through inter-process communication (IPC, Internet Process Connection), file system, socket (socket) and the like.

In an embodiment, the non-secure operating system 10 includes a first policy management module 11 and a first communication proxy module 12;

The first policy management module 11 is configured to perform domain division on each application; when the preset condition is met, the first communication proxy module 12 sends a first instruction to the security execution environment side;

The first communication proxy module 12 is configured to send a first instruction to the secure execution environment, receive a first command response result returned by the secure execution environment side, and send the first command response result to the The first policy management module 11;

Correspondingly, the security operating system 20 includes a second policy management module 21 and a second communication proxy module 22;

The second policy management module 21 is configured to perform a policy file according to the first instruction. a first operation; wherein the first operation includes at least one or more of the following: querying, loading, updating, and storing; sending, by the second communication proxy module 22, the non-secure execution environment side An instruction response result;

The second communication proxy module 22 is configured to receive the first instruction sent by the first communication proxy module 12, and send the first instruction to the second policy management module 21; receive the second policy The first instruction response result returned by the module 21 is sent to the first communication proxy module 12.

That is, the first policy management module 11 and the second policy management module 21 perform operations such as updating, querying, and storing security policies by sending commands to control communication between applications; and the first The policy management module 11 communicates with the second policy management module 21 through the first communication proxy module 12; the second policy management module 21 communicates with the first policy management module 11 through the second communication proxy module 22.

The first policy management module 11 is responsible for marking various applications as different domains (security levels), where the various applications include: applications published with the system, or applications published by third parties.

In an embodiment, the first policy management module 11 includes: a domain dividing unit 111 and a MAC management unit 112;

The domain dividing unit 111 is configured to perform domain partitioning on each application; when detecting that the first application accesses the second application, acquiring domain information of the first application and the second application; and the first The application and the domain information of the second application are sent to the MAC management unit 112;

The MAC management unit 112 is configured to send a first instruction to the security execution environment side, where the first instruction carries at least the domain information of the first application and the second application.

Here, the domain can be divided into three categories: one is a system domain, one is a security domain, and the other is a non-security domain.

In an embodiment, the second policy management module 21 includes:

The policy query unit 211 is configured to:

Obtaining a query result according to the first application and the domain information query policy library of the second application;

Sending a first command response result to the non-secure execution environment side based on the query result.

The result of the query is to allow access or to deny access.

In an embodiment, the domain dividing unit 111 is further configured to:

Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain.

For example, in FIG. 2, domain A represents a non-secure domain, domain B represents a security domain, and domain C represents a system domain;

For example, the application 1 is an application running on the non-secure operating system 10, and if it is not verified at the time of installation, it is in a non-secure domain, that is, domain A; the application 2 is running on the non-secure operating system 10 The application, verified by the publisher's signature at the time of installation, is in the security domain, domain B.

In an embodiment, the MAC management unit 112 is responsible for managing access rights between applications.

In an embodiment, when a subject (an Android application) accesses an object (a file or socket of another Android application), first, the first policy management module 11 performs basic autonomous access control (DAC, Discretionary Access Control), if the check fails, directly returns to reject the access; if the check passes, the second communication proxy module 12 is called to switch to the policy query unit 212 of the second side policy management module 21 of the security side, The policy query unit 212 queries whether the subject has access rights; and returns a check to the subject Ask for results. In this way, non-secure applications (such as Application 1) and Secure Side Applications (Application 2) can be prevented from communicating using components.

In an embodiment, the second policy management module 21 further includes:

The policy update unit 212 is configured to formulate, according to the preset rule, a policy file about the new application based on the first information of the new application, where the first information includes at least domain information, a user identifier, based on the new The applied policy file update policy library;

The secure storage unit 213 is configured to store the policy file in a non-volatile secure storage space;

a policy loading unit 214 configured to read a policy file from the non-volatile secure storage space 40 and load the policy file into a policy library located in a secure operating system kernel to facilitate the policy update unit update Policy library.

Here, the non-volatile secure storage space 40 is an exclusive area of the second policy management module 21 and is not accessed by an application in a non-secure execution environment or other security applications in a secure execution environment.

Since the security policy file is stored in the non-volatile secure storage space 40, since the access to all files, directories, and ports in the Android system is based on policies, the security side only needs to formulate a fine-grained and high-security policy. , you can isolate the communication between applications through IPC, file system, sockets, etc.

In this embodiment, the policy file may be represented in a binary form.

In an embodiment, the preset rule includes at least one or more of the following:

The first rule for non-secure domain applications to access non-secure domain applications,

The second rule for non-secure domain applications to access security domain applications,

The third rule for the security domain application to access the non-secure domain application,

The fourth rule of the security domain application accessing the security domain application,

The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain.

Here, the first rule is: allowing a non-secure domain application to access the non-secure domain application; the second rule is: not allowing the non-secure domain application to access the security domain application; the third rule is: disallowing the security domain application Accessing the non-secure domain application; the fourth rule is: allowing the security domain application to access the security domain application; the fifth rule is: allowing the non-secure domain application and the security domain application to access the system domain application.

In an embodiment, the policy update unit 212 is responsible for performing security update of the policy file and the policy library according to the instruction of the MAC management module 112 located on the non-secure side when the application is installed or uninstalled.

In an embodiment, the policy loading unit 211 is responsible for reading a policy file from a non-volatile secure storage space exclusive to the second policy management module 21, and loading the policy file to be located in a secure manner. In the policy library of the operating system kernel; it is also responsible for responding to the instructions of the policy update unit 212, and when a new application installs or uninstalls an application, the loading process is started.

Embodiment 3

FIG. 3 is a schematic diagram of a process flow of a policy in a new application installation process according to an embodiment of the present invention. As shown in FIG. 3, the process mainly includes the following steps:

Step 301: Install a new application in a non-secure execution environment.

Here, the new application refers to an application that is not installed in the electronic device, wherein the system of the electronic device is an Android system.

Step 302: The domain dividing unit in the first policy management module performs domain division on the new application.

In an embodiment, the domain dividing unit verifies the new application according to the digital certificate signature of the new application, and if the verification passes, marking the new application as a security domain; if the verification fails, marking the new application Is a non-secure domain.

That is to say, whenever an application is newly installed in the electronic device, the newly installed application is divided into domains, and a policy file is prepared for the newly installed application in real time, and the policy is updated. Library.

Step 303: The domain dividing unit sends information such as domain information and user name of the new application to the MAC management unit in the first policy management module.

Step 304: The MAC management unit sends a policy update instruction to the policy update unit by using the first communication proxy module.

That is, when the MAC management unit receives the domain information, the user name, and the like of the new application, the first communication proxy module is started to notify the security side update policy.

In an embodiment, the step 304 may include:

Step 304a: The first communication proxy module executes the first instruction to cause the processor to be in a security monitor mode, in which the non-secure side context is saved;

Step 304b: The security monitor switches to the secure execution environment and restores the security side context.

Here, the secure execution environment may also be referred to as a trusted execution environment.

It should be noted that the following steps 305 to 314 are operations performed in a secure execution environment.

Step 305: The policy update unit in the second management module formulates a policy for the new application, and issues an update policy library instruction.

In this embodiment, it is assumed that the policy defined by the policy update unit for the new application is referred to as a first policy file.

Step 306 to step 307: The policy update unit invokes the secure storage unit to store the first policy file to the non-volatile secure storage space exclusive to the second policy management module.

Step 308: After completing the storage of the first policy file, the secure storage unit returns a storage success response to the policy update unit.

Step 309: The second management module invokes a policy loading unit to start a policy loading process.

Step 310 to step 312: The policy loading unit reads the first policy file and reads After the completion is completed, the first policy file is loaded into the policy library.

Here, the policy library is located in the kernel of the secure operating system.

Step 313: The policy loading unit returns an update policy library success response to the policy update unit.

Step 314: The policy update unit returns a policy update complete message to the MAC management unit.

In an embodiment, the step 314 can include:

Step 314a: The second communication proxy module executes the second instruction to place the processor in a security monitor mode, in which the secure side context is saved;

Step 314b: The security monitor switches to the non-secure execution environment and restores the non-secure side context.

Step 315: The MAC management unit parses the execution result returned by the security side. At this point, the new application policy is loaded, and the new application completes the installation.

Embodiment 4

FIG. 4 is a schematic flowchart of a process for a non-secure domain application to access a security domain application according to an embodiment of the present invention. As shown in FIG. 4, the process mainly includes the following steps:

Step 401: The non-secure domain application accesses the security domain application.

In an embodiment, the access of the application between the domains may be detected by a domain partitioning unit in the first policy management module.

In this embodiment, the non-secure domain application is application 1, and the security domain application is application 2.

Step 402: The first policy management module invokes a MAC management unit to perform a permission query.

Step 403: The MAC management unit in the first policy management module sends a query request to a policy query unit in a second policy management module located on the security side.

The query request includes at least: domain information of the application 1 and the application 2.

In an embodiment, the step 403 may include:

Step 403a: The second communication proxy module saves the non-secure side context, and executes the first instruction to keep the processor in the secure mode;

Step 403b: The security monitor (monitor) switches to the secure execution environment and restores the security side context.

Here, the secure execution environment may also be referred to as a trusted execution environment.

It should be noted that the following steps 404 to 405 are operations performed in a secure execution environment.

Step 404: The policy query unit obtains the domain information of the application 1 and the application 2, and matches the policy in the policy database of the kernel of the security operating system, and the result is that the access is denied.

In other words, non-secure applications are not allowed to access secure domain applications.

Step 405: The policy query unit returns a query result to the MAC management unit.

In an embodiment, the step 405 can include:

Step 405a: The second communication agent module executes the second instruction to place the processor in a security monitor mode in which the secure side context is saved.

Step 405b: The security monitor switches to the non-secure execution environment and restores the non-secure side context.

Step 406: The MAC management unit returns the query result to the access subject (ie, the non-secure domain application), and prohibits the access.

That is, when it is detected that the non-secure domain application attempts to access a certain file or a certain socket in the security domain application, the MAC management unit in the first policy management module sends a message through the first communication proxy module, and switches to The secure execution environment is queried by the second policy management module located in the secure execution environment. Since the policy library is located in the secure execution environment, the security of the Android system is improved.

Embodiment 5

FIG. 5 is a flowchart of processing a security domain application accessing a security domain application according to an embodiment of the present invention; Intention, as shown in Figure 5, the process mainly includes the following steps:

Step 501: The security domain application accesses the security domain application.

In an embodiment, the access of the application between the domains may be detected by a domain partitioning unit in the first policy management module.

Step 502: The first policy management module invokes a MAC management unit to perform a permission query.

Step 503: The MAC management unit in the first policy management module sends a query request to a policy query unit in a second policy management module located on the security side.

The query request includes at least: domain information of the access subject and the access object.

In an embodiment, the step 503 can include:

Step 503a: The second communication proxy module executes the first instruction, so that the processor is in a security monitor mode, in which the non-secure side context is saved;

Step 503b: The security monitor switches to the secure execution environment and restores the security side context.

Here, the secure execution environment may also be referred to as a trusted execution environment.

It should be noted that the following steps 504 to 505 are operations performed in a secure execution environment.

Step 504: The policy query unit obtains the domain information of the access subject and the access object, and matches the policy in the policy database of the kernel of the security operating system, and the result is allowed access.

That is, allowing secure applications to access secure domain applications.

Step 505: The policy query unit returns a query result to the MAC management unit.

In an embodiment, the step 505 can include:

Step 505a: The second communication proxy module saves the security side context, and executes the second instruction to keep the processor in the non-secure mode.

Step 505b: The security monitor switches to the non-secure execution environment and restores the non-secure side context.

Step 506: The MAC management unit returns the query result to the access subject, allowing the access.

In other words, security domain applications are allowed to access each other, that is, data between security applications can be shared.

The embodiment of the invention further describes a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the policy management method described in the foregoing embodiments.

In summary, compared with the prior art, the technical solution of the present invention divides the policy management into a security side and a non-secure side by introducing a processor with a security isolation function, and has a security side and a non-secure side. Each module cooperates. The non-secure side is only responsible for sending policy access commands and policy update commands to the security side, but only the command level. The real policy file storage, policy file loading, policy rule calculation, and policy file update are performed. The technical solution of the present invention will greatly improve the security of the Android system, compared with the security-related operation of the existing SEAndroid.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.

The units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; The unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage device includes the following steps: The foregoing storage medium includes: a removable storage device, a read-only memory (ROM), a magnetic disk, or an optical disk, and the like, which can store program codes.

Alternatively, the above-described integrated unit of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a magnetic disk, or an optical disk.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Industrial applicability

In the embodiment of the present invention, the execution environment is divided into a non-secure execution environment and a security execution environment by using a security isolation technology; in the non-secure execution environment, each application is domain-divided; according to a pre-defined policy file for each domain Providing a MAC query service by access between applications; in the secure execution environment, managing a policy file; wherein the management includes at least the following One or several of: query, load, update, store; thus, can improve the security of the Android system.

Claims (15)

A policy management method, the method comprising: The security isolation technology is used to divide the execution environment into a non-secure execution environment and a secure execution environment; In the non-secure execution environment, domain division is performed for each application; and a mandatory access control MAC query service is provided for access between applications of each domain according to a pre-defined policy file; In the secure execution environment, the policy file is managed; wherein the management includes at least one or more of the following: query, load, update, and store. The method according to claim 1, wherein said providing a MAC query service for access between applications of each domain according to a pre-defined policy file comprises: When the preset condition is met, sending a first instruction to the secure execution environment side; Receiving a first command response result returned by the secure execution environment side; Correspondingly, the managing the policy file includes: Performing a first operation on the policy file according to the first instruction; where the first operation includes at least one or more of the following: query, load, update, and store; Returning the first command response result to the non-secure execution environment side. The method of claim 2, wherein when the predetermined condition is met, sending the first instruction to the secure execution environment side comprises: Obtaining domain information of the first application and the second application when detecting that the first application accesses the second application; Transmitting, to the security execution environment side, a first instruction, where the first instruction carries at least the domain information of the first application and the second application. The method of claim 2, wherein the performing the first operation on the policy file according to the first instruction comprises: Obtaining a query result according to the first application and the domain information query policy library of the second application; Returning a first command response result to the non-secure execution environment side based on the query result. The method according to claim 1, wherein the domain division of each application further comprises: Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain. The method of claim 5, wherein the managing the policy file further comprises: Determining, according to a preset rule, a policy file about the new application based on the first information of the new application, where the first information includes at least domain information and a user identifier; Updating the policy library based on the policy file of the new application. The method of claim 6, wherein the preset rule comprises at least one or more of the following: The first rule for non-secure domain applications to access non-secure domain applications, The second rule for non-secure domain applications to access security domain applications, The third rule for the security domain application to access the non-secure domain application, The fourth rule of the security domain application accessing the security domain application, The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain. A policy management system that uses a security isolation technology to divide an execution environment into a non-secure execution environment and a security execution environment; the system includes: a non-secure operating system and a secure operating system; The non-secure operating system is configured in a non-secure execution environment, configured to perform domain division on each application; and provide MAC query for inter-application access of each domain according to a pre-defined policy file. service; The security operating system is located in a secure execution environment and is configured to manage a policy file. The management includes at least one or more of the following: query, load, update, and store. The system of claim 8, wherein the non-secure operating system comprises a first policy management module and a first communication agent module; The first policy management module is configured to perform domain division on each application; when the preset condition is met, the first communication proxy module sends a first instruction to the security execution environment side; The first communication proxy module is configured to send a first instruction to the secure execution environment, receive a first command response result returned by the secure execution environment side, and send the first command response result to the first a policy management module; Correspondingly, the security operating system includes a second policy management module and a second communication proxy module; The second policy management module is configured to perform a first operation on the policy file according to the first instruction, where the first operation includes at least one or more of the following: query, load, update, and store Transmitting, by the second communication proxy module, a first command response result to the non-secure execution environment side; The second communication proxy module is configured to receive the first instruction sent by the first communication proxy module, and send the first instruction to the second policy management module; and receive the return of the second policy module The first command responds to the result and sends the first command response result to the first communication agent module. The system according to claim 9, wherein the first policy management module comprises: a domain division unit and a MAC management unit; wherein The domain dividing unit is configured to perform domain partitioning on each application; when detecting that the first application accesses the second application, acquiring domain information of the first application and the second application; Transmitting, by the first application, the domain information of the second application to the MAC management unit; The MAC management unit is configured to send a first instruction to the security execution environment side, where the first instruction carries at least the domain information of the first application and the second application. The system of claim 9, wherein the second policy management module comprises: The policy query unit is configured as: Obtaining a query result according to the first application and the domain information query policy library of the second application; Sending a first command response result to the non-secure execution environment side based on the query result. The system of claim 10, wherein the domain dividing unit is further configured to: Marking a pre-installed application in the system as a system domain; when detecting a new application installation, verifying the digital certificate signature of the new application, if the verification is passed, marking the new application as a security domain; if the verification fails or If there is no digital certificate signature, the new application is marked as a non-secure domain. The system of claim 12, wherein the second policy management module further comprises: a policy update unit, configured to formulate a policy file for the new application based on the first information of the new application according to a preset rule, where the first information includes at least domain information, a user identifier, and based on the new application Policy file update policy library; a secure storage unit configured to store policy files to a non-volatile secure storage space; a policy loading unit configured to read a policy file from the non-volatile secure storage space and load the policy file into a policy library located in a secure operating system kernel, so that the policy update unit updates the policy library . The system of claim 13 wherein said predetermined rule comprises at least one or more of the following: The first rule for non-secure domain applications to access non-secure domain applications, The second rule for non-secure domain applications to access security domain applications, The third rule for the security domain application to access the non-secure domain application, The fourth rule of the security domain application accessing the security domain application, The fifth rule of the non-secure domain application and the security domain application accessing the system domain application; wherein the domain is at least divided into: a system domain, a security domain, and a non-security domain. A computer storage medium having stored therein computer executable instructions for performing the method of any one of claims 1 to 7.

Images