WO2019007145A1 - Sfs访问控制方法及系统、sfs及终端设备 - Google Patents

Sfs访问控制方法及系统、sfs及终端设备 Download PDF

Info

Publication number
WO2019007145A1
WO2019007145A1 PCT/CN2018/086098 CN2018086098W WO2019007145A1 WO 2019007145 A1 WO2019007145 A1 WO 2019007145A1 CN 2018086098 W CN2018086098 W CN 2018086098W WO 2019007145 A1 WO2019007145 A1 WO 2019007145A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
sfs
access
request message
sfs service
Prior art date
Application number
PCT/CN2018/086098
Other languages
English (en)
French (fr)
Inventor
温海龙
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP18828420.2A priority Critical patent/EP3651048A4/en
Priority to US16/628,652 priority patent/US20200218819A1/en
Publication of WO2019007145A1 publication Critical patent/WO2019007145A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/16—Program or content traceability, e.g. by watermarking
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems

Definitions

  • the present disclosure relates to the field of communications technologies, for example, to a Secure File System (SFS) access control method and system, an SFS, and a terminal device.
  • FSS Secure File System
  • a user ID (UID) or an organization ID (GID) can be used to restrict user or application access control to system sensitive resources.
  • UID user ID
  • GID organization ID
  • the vehicle T-Box requires data security storage based on Secure File System (SFS). Since SFS stores important data of users, it is necessary to restrict access to applications. Only authorized applications are allowed to access SFS, and each authorized application can only access and manipulate its own data.
  • SFS Secure File System
  • the application processor (AP) of the vehicle T-Box runs an embedded Linux system, and all the applications above belong to the root user, that is, all applications have access to the SFS. It is impossible to restrict the access control of the system or sensitive resources of the system by the user or the application through UID or GID.
  • some smart chips support the Trust zone.
  • the Trust zone has two operating environments, one is a secure operating environment and the other is a normal environment. Only trusted applications can run in a secure operating environment. Ordinary applications run in a normal environment, and normal applications cannot access important data in a secure operating environment. In this way, the smart terminal can use the Trust zone to isolate the security application (trusted application) from the normal application.
  • many non-smart chips do not support the Trust Zone at all, and it is impossible to isolate security applications from common applications.
  • some chips can support the Trust zone, but their Trust zone function is very limited. It only supports basic services such as encryption and decryption, secure clock and pseudo-random sequence generator (PRNG), and does not support secure application development. Therefore, it is impossible to isolate the security application and the general application on the terminal device.
  • PRNG pseudo-random sequence generator
  • the embodiment of the present application provides an SFS access control method and system, an SFS, and a terminal device, which can improve the security of SFS access.
  • the embodiment of the present application provides an SFS access control method, which is applied to a terminal device, where the SFS and the SFS client module are included in the SFS, and the SFS includes an SFS client module and an SFS service module.
  • the method includes:
  • the SFS service module authenticates the application according to the first access credential carried in the SFS service request message; after determining that the application authentication is successful, performing an SFS service access operation requested by the application, and The result of the SFS service access operation is returned to the application by the SFS client module.
  • the embodiment of the present application further provides an SFS, including: an SFS client module and an SFS service module;
  • the SFS client module is configured to: receive an SFS service request message of the application, and send the SFS service request message to the SFS service module;
  • the SFS service module is configured to: perform authentication on the application according to the first access credential carried in the SFS service request message; and perform SFS service access requested by the application after determining that the application is successfully authenticated. Operation, and returning the result of the SFS service access operation to the application through the SFS client module.
  • the embodiment of the present application further provides an SFS access control system, including: one or more applications running on a terminal device and any one of the SFSs as described above.
  • the embodiment of the present application further provides a terminal device, including: a memory, a processor, and an SFS access control program stored in the memory and operable on the processor, where the SFS access control program is used by the processor Any one of the SFS access control methods described above is implemented at the time of execution.
  • the embodiment of the present application further provides a machine readable medium storing an SFS access control program, and when the SFS access control program is executed by the processor, implements any one of the SFS access control methods described above.
  • the SFS on the terminal device authenticates one or more applications running on the terminal device by using the SFS client module and the SFS service module to identify an application having access rights to the SFS to prevent malicious application camouflage. Scratching SFS into normal applications increases the security of SFS access.
  • the SFS authenticates the application using the second access credential of the application, and the second access credential of the application includes at least a random password, since each application changes its random password after each boot, thereby ensuring hackers or malicious programs cannot guess random passwords or use brute force methods to crack them.
  • the access path of each application license is set in the application whitelist of the SFS, so that each application can only control access to its own data and cannot access data of other applications.
  • FIG. 1 is a flowchart of an SFS access control method according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of an SFS according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an SFS according to another embodiment of the present disclosure.
  • FIG. 4 is a schematic diagram of an SFS access control system according to an embodiment of the present application.
  • FIG. 5 is a flowchart of an SFS access control method according to another embodiment of the present application.
  • FIG. 6 is a flowchart of an SFS access control method according to another embodiment of the present application.
  • FIG. 7 is a flowchart of an SFS service module for assigning an access credential to an application according to an embodiment of the present disclosure
  • FIG. 8 is a flowchart of an application for authenticating an application by an SFS service module according to an embodiment of the present disclosure
  • FIG. 9 is a flowchart of performing authentication by an SFS authentication unit and an SFS operation unit according to an embodiment of the present application.
  • SFS Secure File System
  • AES Advanced Encryption Standard
  • the hardware key of each device is unique; the device hardware key is stored in the chip, only hardware.
  • the encryption engine or Trust zone can be accessed.
  • the upper layer application and the external interface cannot access the hardware key.
  • SFS has an application programming interface (API) similar to the normal file system, such as sfs_open(), sfs_close (), sfs_read(), sfs_write(), and sfs_rm(), the application only needs to call the API to perform one or more operations such as file opening, closing, reading, and writing.
  • Data encryption and decryption is performed by the file system internal encryption engine. of.
  • FIG. 1 is a flowchart of an SFS access control method according to an embodiment of the present application. The embodiment is applied to a terminal device running SFS and one or more applications, and the SFS includes an SFS client module and an SFS service module.
  • the method provided in this embodiment includes the following steps:
  • Step 101 The SFS client module receives the SFS service request message of the application, and sends the SFS service request message to the SFS service module.
  • Step S102 The SFS service module authenticates the application according to the first access credential carried in the SFS service request message. After determining that the application is successfully authenticated, the SFS service access operation requested by the application is performed, and the SFS service is performed. The result of the access operation is returned to the application via the SFS client module.
  • the SFS service module may include: an SFS authentication unit and an SFS operation unit; in an exemplary embodiment, step 102 may include:
  • the SFS authentication unit authenticates the application according to the first access credential carried in the SFS service request message; after determining that the application authentication succeeds, notifying the SFS operation unit to perform the SFS service access operation requested by the application;
  • the SFS operation unit executes the SFS service access operation requested by the application according to the notification of the SFS authentication unit, and returns the result of the SFS service access operation to the SFS authentication unit;
  • the SFS authentication unit returns the result of the SFS service access operation to the application through the SFS client module.
  • the SFS access control method provided in this embodiment separates the SFS into an SFS client module and an SFS service module (similar to the Client/Server architecture), or separates the SFS client module, the SFS authentication unit, and the SFS operation unit to authenticate the application. To distinguish the access rights of different applications to SFS, thus improving the security of SFS access.
  • step 102 the application is authenticated according to the first access credential carried in the SFS service request message, which may include:
  • the second access credential may include only a random password, or may include an application identifier and a random password.
  • application authentication is performed by a random password, instead of access restriction by UID or GID, and thus, the access rights of different applications of the root user level to the SFS can be restricted.
  • the SFS service module may further store an application whitelist; the method of the embodiment may further include: the SFS service module allocates the second access credential to the application according to the application whitelist stored by the SFS service module when the application is started. .
  • the application whitelist may include at least: an application name or identifier, an application startup path, and first fingerprint information of the application;
  • the SFS service module allocates the second access credential to the application according to the application whitelist when the application is started, and may include:
  • the method provided by this embodiment further includes: if the first fingerprint information and the second fingerprint information are inconsistent, the application is denied a random password.
  • the application whitelist may further include: an access path of the application;
  • the method in this embodiment may further include The SFS service module controls the SFS service access operation requested by the application according to the comparison result of the access path carried in the SFS service request message of the application and the access path of the application license included in the application whitelist.
  • the SFS service module controls the SFS service access operation requested by the application according to the comparison result of the access path carried in the SFS service request message of the application and the access path of the application license included in the application whitelist.
  • determining that the application is successfully authenticated comprises: if the first access credential and the SFS service module carried by the SFS service request message of the application are in the application If the second access credential assigned to the application is consistent at the startup, the access path carried in the SFS service request message of the application and the access path of the application license in the application whitelist are compared; if the access path carried by the SFS service request message is included in the In the access path of the application license included in the application whitelist, it is determined that the application authentication is successful.
  • performing an SFS service access operation requested by the application includes:
  • the SFS service access operation requested by the application is performed according to the access path carried in the SFS service request message.
  • the method provided by the embodiment further includes: if the access path carried by the SFS service request message is not included in an access path of the application license in the application whitelist, determining that the application authentication fails.
  • the application whitelist may include an application name or an application identifier, an activation path of the application, first fingerprint information of the application, an access path of the application license, and a fingerprint algorithm.
  • the digital signature technology is used to verify the authenticity and integrity of the application whitelist, and the public key or the root public key for digital signature can be pre-configured. The mode is saved to the SFS, and only the SFS is allowed to read, and modification or deletion is not allowed.
  • the method of this embodiment may further include:
  • the SFS client module After the SFS service module determines that the application authentication fails, the SFS client module returns an access operation rejection message to the application.
  • the foregoing terminal device may include at least one of the following: a telematics device (Teletons BOX, T-Box), a customer terminal device (CPE, Customer Premise Equipment), a mobile hotspot (MiFi, Mobile WiFi). , data card or Internet of Things (IOT) terminal.
  • a telematics device Teletons BOX, T-Box
  • CPE Customer Premise Equipment
  • MiFi Mobile Wireless Fidelity
  • WiFi Mobile WiFi
  • IOT Internet of Things
  • FIG. 2 is a schematic diagram of an SFS according to an embodiment of the present application.
  • the SFS provided in this embodiment includes: an SFS client module 201 and an SFS service module 202;
  • the SFS client module 201 is configured to: receive an SFS service request message of the application, and send the SFS service request message to the SFS service module 202;
  • the SFS service module 202 is configured to: authenticate the application according to the first access credential carried in the SFS service request message; after determining that the application is successfully authenticated, perform the SFS service access operation requested by the application, and perform the SFS service.
  • the result of the access operation is returned to the application via the SFS client module 201.
  • the SFS service module 202 may be further configured to: after determining that the application authentication fails, return an access operation rejection message to the application through the SFS client module 201.
  • the SFS service module 202 may include: an SFS authentication unit 203 and an SFS operation unit 204; in an exemplary embodiment, the SFS authentication unit 203 may be configured to: according to SFS
  • the SFS operation unit 204 is configured to: The SFS authentication unit 203 performs the SFS service access operation requested by the application, and returns the result of the SFS service access operation to the SFS authentication unit 203.
  • the SFS authentication unit 203 can also be configured to: access the SFS service. The result of the operation is returned to the application by the SFS client module 201.
  • the SFS authentication unit 203 may be further configured to: receive an authentication password at startup, and the SFS operation unit 204 may further be configured to: receive an authentication password at startup; the SFS operation unit 204 may also be configured to The SFS authentication unit 203 is authenticated according to the authentication password.
  • the SFS authentication unit 203 passes the authentication, the SFS service access operation information sent by the SFS authentication unit 203 is agreed to be processed.
  • the SFS service module 202 may be configured to authenticate the application according to the first access credential carried by the SFS service request message by:
  • the SFS service module 202 may be further configured to: store an application whitelist; the application whitelist may include at least: an application name or identifier, an application startup path, and first fingerprint information of the application; and the SFS service module 202 , may also be configured to allocate the second access credential including the random password to the application according to the application whitelist when the application starts:
  • the SFS service module 202 may be further configured to: if the first fingerprint information and the second fingerprint information are inconsistent, refuse to assign a random password to the application.
  • the application whitelist may further include: an access path of the application license
  • the SFS service module 202 may be further configured to: after comparing the first access credential carried by the SFS service request message with the second access credential assigned by the SFS service module 202 to the application when the application is started, according to the SFS of the application.
  • the comparison result of the access path carried in the service request message and the access path of the application license in the application whitelist controls the SFS service access operation requested by the application.
  • the SFS service module 202 may be further configured to control the access path carried in the SFS service request message of the application and the comparison result of the access path of the application license included in the application whitelist by using the following manner.
  • Application requested SFS service access operation :
  • the SFS service module is configured to: compare a first access credential carried by the SFS service request message of the application with a second access credential assigned by the SFS service module to the application when the application is started, If the first access credential and the second access credential are consistent, the access path carried in the SFS service request message of the application and the access path of the application license included in the application whitelist are compared; if the access path carried in the SFS service request message includes In the access path of the application license included in the application whitelist, determining that the application is successfully authenticated; after determining that the application is successfully authenticated, performing the SFS service access requested by the application according to the access path carried by the SFS service request message. operating.
  • the SFS service module is further configured to: if the access path carried in the SFS service request message is not included in the access path of the application license included in the application whitelist, determine that the application authentication fails.
  • FIG. 4 is a schematic diagram of an SFS access control system according to an embodiment of the present application.
  • the SFS access control system provided in this embodiment includes: an application running on a terminal (for example, application 400a and application 400i, etc.) and SFS 402.
  • the SFS 402 can include an SFS client module 201 and an SFS service module 202.
  • the applications 400a and 400i are applications running on the terminal device, and the access credentials allocated by the SFS service module 202 and the service interface of the SFS client module 201 can be used for data secure storage access operations.
  • the user level of applications 400a and 400i can be root level.
  • the SFS client module 201 is a service interface that provides data secure storage access operations for applications 400a and 400i. Taking the application 400a as an example, the SFS client module 201 is responsible for sending the SFS service request message invoked by the application 400a to the SFS service module 202 through the Socket or the message queue, and returning the message responded by the SFS service module 202 to the application 400a; wherein, the SFS service The request message includes a first access credential for the SFS service module 202 to authenticate the application 400a.
  • the SFS service module 202 is responsible for receiving the SFS service request message sent by the SFS client module 201, and authenticating the application 400a according to the first access credential carried therein and the stored second access credential. If the authentication succeeds, the SFS is executed.
  • the service access operation is performed, and the access operation result is sent to the corresponding SFS client module 201 through the socket or the message queue;
  • the SFS service module 202 is also responsible for verifying the validity of the application 400a according to the application whitelist, and if the verification is passed, the application 400a
  • the random password is assigned and the application 400a is launched, otherwise the application 400a is refused to be assigned a random password and the application 400a is launched;
  • the SFS service module 202 is also responsible for applying the secure storage of the whitelist to prevent the whitelist from being tampered or forged.
  • the SFS service module 202 can include an SFS authentication unit and an SFS operating unit.
  • the SFS authentication unit is responsible for authenticating the application 400a and notifying the SFS operating unit when the authentication succeeds; the SFS operating unit is responsible for providing the data security storage service for the application 400a according to the authentication result of the application 400a by the SFS authentication unit. .
  • FIG. 5 is a flowchart of an SFS access control method according to an embodiment of the present application.
  • the SFS client module 520 sends the SFS service request message of the application 510 to the SFS service module 530 through a Socket or a message queue;
  • the service module 530 authenticates the application according to the first access credential carried in the SFS service request message, and if the authentication passes, completes the SFS service access operation requested by the application. And the result of the access operation is sent to the corresponding SFS client module 520 through the socket or the message queue. If the authentication fails, the result of the access operation failure is sent to the SFS client module 520 through the socket or the message queue; finally, the SFS client module 520 will The response message of the SFS service module 530 is returned to the application 510.
  • the process of this embodiment includes the following steps:
  • Step 501 The application 510 invokes a service interface of the SFS client module 520 to request a data secure storage access operation.
  • the data secure storage access operation may include an SFS file open, an SFS file close, an SFS file delete, and an SFS file read.
  • Step 502 the SFS client module 520 sends the SFS service request message of the application 510 to the SFS service module 530 through a Socket or message queue;
  • Step 503 The SFS service module 530 carries the second access credential of the locally cached application 510 (ie, the second access credential assigned by the SFS service module 530 to the application 510 when the application 510 is started this time) and the SFS service request message of the application 510.
  • the first access credential authenticates the application 510. If the authentication succeeds, step 504 is performed. If the authentication fails, step 507 is performed.
  • the SFS service module 530 may further apply the locally cached application 510.
  • the second access credential, the application whitelist, and the SFS service request message of the application 510 authenticate the application 510;
  • Step 504 The SFS service module 530 performs an SFS service access operation requested by the application 510, and obtains an access operation result.
  • Step 505 the SFS service module 530 sends the access operation result to the SFS client module 520 through a Socket or message queue;
  • Step 506 the SFS client module 520 returns the access operation result to the application 510;
  • Step 507 The SFS service request operation returned by the SFS service module 530 to the SFS client module 520 is rejected.
  • Step 508 the SFS client module 520 returns to the application 510 that its SFS service request operation is rejected.
  • FIG. 6 is a flowchart of an SFS access control method according to an embodiment of the present application.
  • the SFS client module 620 sends the SFS service request message of the application 610 to the SFS authentication unit 630 through a Socket or message queue; After receiving the SFS service request message sent by the SFS client module 620, the SFS authentication unit 630 authenticates the application 610 according to the first access credential carried by the SFS service request message and the locally stored second access credential of the application 610.
  • the SFS service access unit 640 is configured to perform the SFS service access operation requested by the application 610, and the access operation result is sent to the corresponding SFS client module 620 through the socket or the message queue. If the authentication fails, the access will be accessed. The operation failure result is sent to the SFS client module 620 through a socket or a message queue; finally, the SFS client module 620 returns a response message of the SFS authentication unit 630 to the application 610.
  • the process of this embodiment includes the following steps:
  • Step 601 The application 610 invokes the service interface of the SFS client module 620 to request a data secure storage access operation.
  • the data secure storage access operation may include an SFS file open, an SFS file close, an SFS file delete, and an SFS file read.
  • Step 602 the SFS client module 620 sends the SFS service request message of the application 610 to the SFS authentication unit 630 through a Socket or message queue;
  • Step 603 The SFS authentication unit 630 carries the second access credential of the locally cached application 610 (ie, the access credential assigned by the SFS authentication unit 630 to the application 610 when the application 610 is started) and the SFS service request message of the application 610.
  • An access credential authenticates the application 610. If the authentication succeeds, step 604 is performed. If the authentication fails, step 608 is performed.
  • the SFS authentication unit 630 may also be based on the locally cached application 610.
  • the second access credential, the application whitelist, and the SFS service request message of the application 610 authenticate the application 610;
  • Step 604 SFS authentication unit 630 sends the SFS service access operation requested by the application 610 to the SFS operating unit 640;
  • Step 605 SFS operation unit 640 performs the SFS service access operation requested by the application 610, and returns the result to the SFS authentication unit 630;
  • Step 606 the SFS authentication unit 630 sends the SFS service access operation result requested by the application 610 to the SFS client module 620 through a Socket or message queue;
  • Step 607 the SFS client module 620 returns the result of the SFS service access operation requested by the application 610 to the application 610;
  • Step 608 the SFS authentication unit 630 returns an SFS service request operation to the SFS client module 620 is rejected;
  • Step 609 the SFS client module 620 returns to the application 610 that its SFS service request operation is rejected.
  • FIG. 7 is a schematic flowchart of an SFS service module providing an access credential for an application according to an embodiment of the present disclosure.
  • the SFS service module searches for the startup path and the first fingerprint information of the application according to the application whitelist; the SFS service module finds the application according to the startup path of the application, and then calculates the second fingerprint information of the application.
  • the information digest algorithm (MD5) or the secure hash algorithm (SHA) may be used to calculate the second fingerprint information of the application; afterwards, the SFS service module uses the second fingerprint information of the calculated application and the application whitelist. The first fingerprint information of the application is compared.
  • a non-zero random password is generated and transmitted to the application in a formal parameter manner, and the application is started, and the random password and the application identifier are locally cached, and the application is started.
  • the random password is taken out from the formal parameter as a first access credential for subsequent interaction with the SFS service module; if the second fingerprint information of the calculated application is inconsistent with the first fingerprint information of the application in the application whitelist, the rejection is The application assigns a random password and launches the app.
  • the process of this embodiment includes the following steps:
  • Step 701 The SFS service module reads the application name, the startup path of the application, and the first fingerprint information of the application from the application whitelist.
  • Step 702 The SFS service module finds the application according to the startup path of the application, and then calculates second fingerprint information of the application.
  • the second fingerprint information of the application may be calculated by using MD5 or SHA. For example, using MD5 or SHA to encrypt the startup path of the application to obtain second fingerprint information of the application;
  • Step 703 the SFS service module uses the calculated second fingerprint information of the application to compare with the first fingerprint information of the application in the application white list, if yes, step 705 is performed, if not, step 704 is performed;
  • Step 704 The SFS service module refuses to allocate a random password to the application and starts the application.
  • Step 705 The SFS service module generates a non-zero random password for the application, and sends the application to the application in a formal parameter manner and starts the application.
  • Step 706 The SFS service module locally caches the random password and the application identifier (corresponding to the foregoing second access credential). After the application is started, the random password is taken out from the formal parameter as a first access credential for subsequent interaction with the SFS service module. In other implementations, the application can also use the random password and the application identifier as the first access credential.
  • the application whitelist may include an application name or an application identifier, an activation path of the application, first fingerprint information of the application, an access path of the application license, and a fingerprint algorithm.
  • Table 1 provides an example of providing an application whitelist in this embodiment. In Table 1, only three applications are illustrated, namely App1, App2, and App3. App1 is located in the System ⁇ bin directory, App2 and App3 are located in the System ⁇ sbin directory, and App1 uses the SHA256 fingerprint algorithm. The calculated fingerprint is 256 bits.
  • the hexadecimal string, App2 and App3 use the MD5 fingerprint algorithm, and the calculated fingerprint is a 128-bit hexadecimal string; App1 can only perform file secure storage access operations in the ZTEFILE ⁇ sfs ⁇ app1 directory. App2 can only File security storage access operations are performed in the ZTEFILE ⁇ sfs ⁇ app2 directory. App3 can only perform file secure storage access operations in the ZTEFILE ⁇ sfs ⁇ app3 directory.
  • the digital signature technology is used to verify the authenticity and integrity of the application whitelist.
  • the public key or the root public key used for the digital signature is saved to the SFS through pre-configuration. For example, the SFS service module allows the SFS service module to modify or delete the SFS service module.
  • FIG. 8 is a flowchart of an application for authenticating an application by an SFS service module according to an embodiment of the present disclosure.
  • the SFS service module authenticating the application may include two processes of access credential authentication and path access control.
  • the access credential authentication process includes: the SFS service module extracts the first access credential from the SFS service request message sent by the SFS client module, and then compares it with the locally cached second access credential, and if yes, the authentication passes, if If the registration is inconsistent, the authentication fails and the application authentication fails.
  • the path access control process includes: after the access credential authentication is passed, the SFS service module checks the access path of the application license included in the application whitelist, if the access path carried in the SFS service request message of the application is included in the application whitelist. In the access path of the application license, the application authentication is successful, and the application is allowed to perform the SFS file access operation. If the access path carried in the SFS service request message of the application is not included in the application whitelist, the application is included in the application whitelist. In the permitted access path, the application authentication failure is returned.
  • the process of this embodiment includes the following steps:
  • Step 801 The SFS service module extracts the first access credential of the application from the SFS service request message sent by the SFS client module, and then compares it with the locally cached second access credential of the application. If not, step 802 is performed. If yes, step 803 is performed;
  • Step 802 The SFS service module returns an application authentication failure to the SFS client module.
  • Step 803 the SFS service module checks whether the access path of the application in the SFS service request message is included in the access path of the application license in the application white list; if not, step 804 is performed, and if yes, step 805 is performed;
  • Step 804 The SFS service module returns an application authentication failure to the SFS client module.
  • Step 805 The application authentication succeeds, and the SFS service module allows the application to perform an SFS service access operation.
  • the SFS service module performs an SFS service access operation requested by the application, or the SFS authentication unit may notify the SFS operation unit to execute the application.
  • the requested SFS service access operation may be performed by the application, or the SFS authentication unit may notify the SFS operation unit to execute the application.
  • FIG. 9 is a flowchart of performing authentication by an SFS authentication unit and an SFS operation unit according to an embodiment of the present application.
  • the SFS authentication unit and the SFS operation unit can also perform authentication.
  • the authentication password is allocated by the system.
  • the system transmits the authentication password to the SFS authentication unit in the form of a formal parameter.
  • the authentication password is passed to the SFS operating unit when the SFS operating unit is initialized or loaded.
  • the process of this embodiment includes the following steps:
  • Step 901 The wireless terminal system initialization (Linux init) module generates an authentication password.
  • Step 902 the wireless terminal system Linux init module transmits the authentication password to the SFS operation unit when the SFS operation unit is initialized or loaded;
  • Step 903 The Linux init module of the wireless terminal system transmits the authentication password to the SFS authentication unit in a formal parameter manner when the SFS authentication unit is started.
  • Step 904 the SFS operating unit will use the authentication password to authenticate the SFS authentication unit; if the authentication is passed, step 906 is performed, if the authentication fails, step 905 is performed;
  • Step 905 The SFS operation unit refuses to provide a data secure storage access operation for the SFS authentication unit.
  • Step 906 The SFS operation unit agrees to provide a data secure storage access operation for the SFS authentication unit.
  • the security of the solution of the present application can be further increased by performing authentication between the SFS authentication unit and the SFS operating unit.
  • the application is described below through two application scenarios.
  • the vehicle T-Box supports remote vehicle control functions, which require two-way authentication with the telematics service provider (TSP) back-end to ensure that both parties can be trusted.
  • T-Box is related to TSP authentication. Certificates and account information need to be stored securely. If the information is stolen or modified by hackers or malicious programs, the vehicle may be remotely controlled or the TSP server will be at risk of intrusion.
  • the TSP client (Client) program on the T-Box is responsible for communicating with the depot of the depot TSP.
  • the certificate and account information for authentication with the server is stored in the SFS of the T-Box for security. Since T-Box supports secondary development, the car manufacturer allows third parties to develop automotive applications running on T-Box. If the solution of this application is not used, other applications on the T-Box can also access the TSP Client program and save it in SFS. Important data for authentication. Once this information is stolen or modified by hackers or malicious applications, the vehicle may be remotely manipulated or the TSP server will be at risk of intrusion.
  • the SFS service module will authenticate the car application according to the access credential and the application white list, and only the application with successful authentication can access the data in the SFS, and only access the storage of the application itself. Data, data stored by other applications, the application will not have access. As a result, hackers and malicious applications will not be able to access important data stored in the SFS by the TSP Client program.
  • the solution of the present application is applicable to any hardware environment supporting SFS functions, and may include, but is not limited to, a Qualcomm Mobile Data Modem (MDM) chip platform, MediaTek (MTK) chip platform, and Maiwei Technology Group.
  • MDM Mobile Data Modem
  • MTK MediaTek
  • Marvell chip and Spreadtrum chip platform product types include but not limited to Customer Premise Equipment (CPE), Mobile Hotspot (Mobile WiFi, MiFi), data card, third generation (the third generation (3G) ) Communication module, Fourth Generation (4G) communication module, or Internet Of Things (IOT) terminal.
  • CPE, MiFi, data card, 3G communication module, 4G communication module, or IOT terminal need to use SFS to securely store device sensitive data (such as WiFi and Web UI password), allowing specific applications to access and control these sensitive data. , restricting some network applications from performing access control operations on sensitive data in the SFS. This will not affect the security of the device even if these network applications are compromised due to security breaches.
  • device sensitive data such as WiFi and Web UI password
  • the present application decomposes the SFS into an SFS client module and an SFS service module, or is decomposed into an SFS client module, an SFS authentication unit, and an SFS operation unit, wherein the SFS client module is an interface presented to the application to access the SFS service.
  • the SFS service module is responsible for performing fingerprint authentication, access credential distribution, and startup of the application.
  • the SFS service module can be based on the application whitelist and the access credentials assigned by the SFS service module to the application when the application is started.
  • the access credential and the access path carried in the SFS service request message are authenticated. If the authentication succeeds, the data storage access operation is allowed.
  • the random password in the access credential is used for authentication.
  • the random password will change after each startup, which ensures that the hacker or malicious program can not guess the password or use brute force to crack, to prevent Malicious applications masquerade as normal applications to spoof the SFS service module; set the access path of each application in the application whitelist, so that each application can only access its own data and cannot access data of other applications.
  • the embodiment of the present application further provides a terminal device, including: a memory, a processor, and an SFS access control program stored in the memory and operable on the processor, where the SFS access control program is executed by the processor Any of the SFS access control methods.
  • the embodiment of the present application further provides a machine readable medium storing an SFS access control program, and the SFS access control program is implemented by the processor to implement any one of the foregoing SFS access control methods.
  • Such software may be distributed on a machine-readable medium, such as a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • a computer-readable medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer.
  • communication media typically includes computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .
  • the SFS access control method and system, the SFS and the terminal device provided by the embodiment of the present invention, the SFS client module and the SFS service module authenticate one or more applications running on the terminal device to identify an application having access rights to the SFS, To prevent malicious applications from masquerading as normal applications to spoof SFS, the security of SFS access is improved.

Abstract

一种SFS访问控制方法及系统、SFS及终端设备。上述SFS访问控制方法，应用于一终端设备，该终端设备上运行有SFS以及一个或多个应用，该SFS包括SFS客户模块以及SFS服务模块，该方法包括：SFS客户模块接收应用的SFS服务请求消息，并将SFS服务请求消息发送给SFS服务模块；SFS服务模块根据SFS服务请求消息携带的第一访问凭证对该应用进行鉴权；在确定该应用鉴权成功后，执行该应用所请求的SFS服务访问操作，并将SFS服务访问操作的结果通过SFS客户模块返回给该应用。

Description

SFS访问控制方法及系统、SFS及终端设备 技术领域
本公开涉及通信技术领域，例如涉及一种安全文件系统(SFS，Secure File System)访问控制方法及系统、SFS及终端设备。
背景技术
Linux系统中可以通过用户标识号(User ID，UID)或组织标识号(Group ID，GID)来限制用户或应用对系统敏感资源的访问控制。以车载远程信息处理器(Telematics BOX，T-Box)为例，车载T-Box要求支持基于安全文件系统(Secure File System，SFS)的数据安全存储功能。由于SFS中保存的是用户重要数据，因此，需要对应用做访问限制，仅允许一些授权的应用访问SFS，并且每个授权的应用只能访问和操作自己的数据。然而，车载T-Box的应用处理器(Application Processor，AP)上运行的是嵌入式Linux系统，其上面的所有应用都属于根(root)用户，也就是说，所有应用都对SFS具有访问权限，导致无法通过UID或GID来限制用户或应用对系统敏感资源的访问控制。
另外，部分智能芯片支持信任区(Trust zone)，Trust zone有两个运行环境，一个是安全运行环境，另一个是普通环境。只有可信赖的应用才能运行在安全运行环境，普通应用运行在普通环境，普通应用无法访问安全运行环境中的重要数据。如此，智能终端可以使用Trust zone来对安全应用(可信赖的应用)和普通应用进行隔离。然而，很多非智能芯片根本不支持信任区(Trust zone)，也就无法对安全应用和普通应用进行隔离。此外，也有一些芯片虽能支持Trust zone，但是其Trust zone功能非常有限，只支持加解密、安全时钟和伪随机序列发生器(pseudo-random number generator，PRNG)等基本服务，不支持安全应用开发，这样也就无法对终端设备上的安全应用和普通应用进行隔离。
发明内容
本申请实施例提供一种SFS访问控制方法及系统、SFS及终端设备，能够提高SFS访问的安全性。
本申请实施例提供一种SFS访问控制方法，应用于一终端设备，所述终端设 备上运行有SFS以及一个或多个应用，所述SFS包括SFS客户模块以及SFS服务模块；所述方法包括：
所述SFS客户模块接收所述应用的SFS服务请求消息，并将所述SFS服务请求消息发送给所述SFS服务模块；
所述SFS服务模块根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
本申请实施例还提供一种SFS，包括：SFS客户模块以及SFS服务模块；
所述SFS客户模块，设置为：接收应用的SFS服务请求消息，并将所述SFS服务请求消息发送给所述SFS服务模块；
所述SFS服务模块，设置为：根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
本申请实施例还提供一种SFS访问控制系统，包括：运行在一终端设备上的一个或多个应用以及如上所述的任意一种SFS。
本申请实施例还提供一种终端设备，包括：存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的SFS访问控制程序，所述SFS访问控制程序被所述处理器执行时实现如上所述的任意一种SFS访问控制方法。
本申请实施例还提供一种机器可读介质，存储有SFS访问控制程序，所述SFS访问控制程序被处理器执行时实现如上所述的任意一种SFS访问控制方法。在本申请实施例中，终端设备上的SFS通过SFS客户模块和SFS服务模块对终端设备上运行的一个或多个应用进行鉴权，以识别对SFS具有访问权限的应用，以防止恶意应用伪装成正常应用欺骗SFS，从而提高了SFS访问的安全性。
在示例性方案中，SFS使用应用的第二访问凭证对应用进行鉴权，且应用的第二访问凭证至少包括随机密码，由于每个应用在每次启动之后其随机密码都会发生改变，从而确保黑客或恶意程序无法猜测出随机密码或使用暴力破解方式进行破解。
在示例性方案中，在SFS的应用白名单中设置每个应用许可的访问路径，从而可以控制每个应用只能访问自己的数据，无法访问其他应用的数据。
附图说明
图1为本申请一实施例提供的一种SFS访问控制方法的流程图；
图2为本申请一实施例提供的一种SFS的示意图；
图3为本申请另一实施例提供的一种SFS的示意图；
图4为本申请一实施例提供的一种SFS访问控制系统的示意图；
图5为本申请另一实施例提供的一种SFS访问控制方法的流程图；
图6为本申请另一实施例的一种SFS访问控制方法的流程图；
图7为本申请一实施例提供的SFS服务模块为应用分配访问凭证的流程图；
图8为本申请一实施例提供的SFS服务模块对应用进行鉴权的流程图；
图9为本申请一实施例提供的SFS鉴权单元和SFS操作单元进行认证的流程图。
具体实施方式
以下结合附图对本申请实施例进行说明，应当理解，以下所说明的实施例仅用于说明和解释本申请，并不用于限定本申请。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
安全文件系统(SFS)可以对应用数据提供加密安全存储服务。SFS具有如下安全特性：SFS使用一个硬件Key和高级加密标准(Advanced Encryption Standard，AES)加密算法对应用数据进行加密，每个设备的硬件Key都是唯一；设备硬件Key保存在芯片中，只有硬件加密引擎或Trust zone(信任区)可以访问，上层应用和外部接口都无法访问该硬件Key；SFS具有与正常文件系统类似的应用程序编程接口(Application Programming Interface，API)，例如sfs_open()、sfs_close()、sfs_read()、sfs_write()和sfs_rm()，应用只需调用API进行文件打开、关闭、读取和写入等一个或多个操作，数据加解密是由文件系统内部加密引擎来完成的。
图1为本申请实施例提供的一种SFS访问控制方法的流程图。本实施例应用于一终端设备，该终端设备上运行有SFS以及一个或多个应用，SFS包括SFS 客户模块以及SFS服务模块。
如图1所示，本实施例提供的方法包括以下步骤：
步骤101、SFS客户模块接收应用的SFS服务请求消息，并将该SFS服务请求消息发送给SFS服务模块；
步骤102、SFS服务模块根据该SFS服务请求消息携带的第一访问凭证对该应用进行鉴权；在确定该应用鉴权成功后，执行该应用所请求的SFS服务访问操作，并将该SFS服务访问操作的结果通过SFS客户模块返回给该应用。
在示例性实施方式中，SFS服务模块可以包括：SFS鉴权单元以及SFS操作单元；在示例性实施方式中，步骤102可以包括：
SFS鉴权单元根据该SFS服务请求消息携带的第一访问凭证对该应用进行鉴权；在确定该应用鉴权成功后，通知SFS操作单元执行该应用所请求的SFS服务访问操作；
SFS操作单元根据SFS鉴权单元的通知，执行该应用所请求的SFS服务访问操作，并将SFS服务访问操作的结果返回给SFS鉴权单元；
SFS鉴权单元将SFS服务访问操作的结果通过SFS客户模块返回给该应用。
本实施例提供的SFS访问控制方法将SFS分离成SFS客户模块和SFS服务模块(类似Client/Server架构)，或者，分离成SFS客户模块、SFS鉴权单元和SFS操作单元，对应用进行鉴权以区分不同应用对SFS的访问权限，从而提高SFS访问的安全性。
在示例性实施方式中，步骤102中，根据SFS服务请求消息携带的第一访问凭证对应用进行鉴权，可以包括：
比较该应用的SFS服务请求消息携带的第一访问凭证和SFS服务模块在该应用启动时为该应用分配的第二访问凭证，若第一访问凭证和第二访问凭证一致，则确定该应用鉴权成功，若第一访问凭证和第二访问凭证不一致，则确定该应用鉴权失败。
在示例性实施方式中，第二访问凭证可以仅包括随机密码，或者，可以包括应用标识和随机密码。如此，通过随机密码进行应用鉴权，而不是通过UID或GID进行访问限制，进而，可以限制root用户等级的不同应用对SFS的访问权限。
在示例性实施方式中，SFS服务模块还可以存储应用白名单；本实施例的 方法还可以包括：SFS服务模块在应用启动时根据SFS服务模块存储的应用白名单为该应用分配第二访问凭证。
在示例性实施方式中，应用白名单可以至少包括：应用名称或标识、应用的启动路径和应用的第一指纹信息；
SFS服务模块在应用启动时根据应用白名单为该应用分配第二访问凭证，可以包括：
根据应用的应用名称或标识，在应用白名单查找该应用的启动路径和第一指纹信息；
根据该应用的启动路径找到该应用，在根据该应用的启动路径找到该应用后，计算该应用的第二指纹信息；
比较应用白名单中该应用的第一指纹信息和计算得到的第二指纹信息，若第一指纹信息和第二指纹信息一致，则为该应用生成一个随机密码，传递该随机密码给该应用并启动该应用。
在示例性实时方式中，本实施例提供的方法还包括：若第一指纹信息和第二指纹信息不一致，则拒绝给该应用分配随机密码。
在示例性实施方式中，应用白名单还可以包括：应用的访问路径；
在示例性实施方式中，在比较得到该SFS服务请求消息携带的第一访问凭证和SFS服务模块在该应用启动时为该应用分配的第二访问凭证一致之后，本实施例的方法还可以包括：SFS服务模块根据该应用的SFS服务请求消息中携带的访问路径和应用白名单中包括的该应用许可的访问路径的比较结果，控制该应用所请求的SFS服务访问操作。
在示例性实施方式中，SFS服务模块根据该应用的SFS服务请求消息中携带的访问路径和应用白名单中包括的该应用许可的访问路径的比较结果，控制该应用所请求的SFS服务访问操作，可以包括：
若该SFS服务请求消息中携带的访问路径包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权成功，并按照该SFS服务请求消息中携带的访问路径执行该应用所请求的SFS服务访问操作；
若该SFS服务请求消息中携带的访问路径没有包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权失败。
在示例性实施方式中，若第一访问凭证和第二访问凭证一致，则确定该应 用鉴权成功，包括：若该应用的SFS服务请求消息携带的第一访问凭证和SFS服务模块在该应用启动时为该应用分配的第二访问凭证一致，则比较该应用的SFS服务请求消息中携带的访问路径和应用白名单中该应用许可的访问路径；若SFS服务请求消息携带的访问路径包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权成功。
在示例性实施方式中，在确定该应用鉴权成功后，执行该应用所请求的SFS服务访问操作，包括：
在确定该应用鉴权成功后，按照SFS服务请求消息携带的访问路径执行该应用所请求的SFS服务访问操作。
在示例性实施方式中，本实施例提供的方法还包括：若该SFS服务请求消息携带的访问路径没有包含在应用白名单中该应用许可的访问路径中，则确定该应用鉴权失败。
在示例性实施方式中，应用白名单可以包括：应用名称或应用标识、应用的启动路径、应用的第一指纹信息、应用许可的访问路径和指纹算法。在示例性实施方式中，为了防止应用白名单被纂改或伪造，使用数字签名技术对应用白名单进行真实性和完整性校验，用于数字签名的公钥或根公钥可以通过预配置方式保存到SFS中，并只允许SFS进行读取操作，不允许修改或删除。
在示例性实施方式中，本实施例的方法还可以包括：
SFS服务模块确定应用鉴权失败后，通过SFS客户模块向该应用返回访问操作拒绝消息。
在示例性实施方式中，上述终端设备可以包括以下至少之一：车载远程信息处理器(Telematics BOX，T-Box)、客户终端设备(CPE，Customer Premise Equipment)、移动热点(MiFi，Mobile WiFi)、数据卡或物联网(IOT，Internet Of Things)终端。
图2为本申请实施例提供的一种SFS的示意图。如图2所示，本实施例提供的SFS包括：SFS客户模块201和SFS服务模块202；
其中，SFS客户模块201，设置为：接收应用的SFS服务请求消息，并将SFS服务请求消息发送给SFS服务模块202；
SFS服务模块202，设置为：根据SFS服务请求消息携带的第一访问凭证对该应用进行鉴权；在确定该应用鉴权成功后，执行该应用所请求的SFS服务访 问操作，并将SFS服务访问操作的结果通过SFS客户模块201返回给该应用。
在示例性实施方式中，SFS服务模块202，还可以设置为：在确定应用鉴权失败后，通过SFS客户模块201向该应用返回访问操作拒绝消息。
在示例性实施方式中，如图3所示，SFS服务模块202可以包括：SFS鉴权单元203和SFS操作单元204；在示例性实施方式中，SFS鉴权单元203，可以设置为：根据SFS服务请求消息携带的第一访问凭证对应用进行鉴权；在确定该应用鉴权成功后，通知SFS操作单元204执行该应用所请求的SFS服务访问操作；SFS操作单元204，可以设置为：根据SFS鉴权单元203的通知，执行该应用所请求的SFS服务访问操作，并将SFS服务访问操作的结果返回给SFS鉴权单元203；SFS鉴权单元203，还可以设置为：将SFS服务访问操作的结果通过SFS客户模块201返回给该应用。
在示例性实施方式中，SFS鉴权单元203，还可以设置为：在启动时接收认证密码，SFS操作单元204，还可以设置为：在启动时接收认证密码；SFS操作单元204还可以设置为根据认证密码对SFS鉴权单元203进行认证，在SFS鉴权单元203通过认证时，同意处理SFS鉴权单元203发送的SFS服务访问操作信息。
在示例性实施方式中，SFS服务模块202，可以设置为通过以下方式根据SFS服务请求消息携带的第一访问凭证对应用进行鉴权：
比较应用的SFS服务请求消息携带的第一访问凭证和SFS服务模块202在该应用启动时为该应用分配的第二访问凭证，若第一访问凭证和第二访问凭证一致，则确定该应用鉴权成功，若第一访问凭证和第二访问凭证不一致，则确定该应用鉴权失败。
在示例性实施方式中，SFS服务模块202，还可以设置为：存储应用白名单；应用白名单可以至少包括：应用名称或标识、应用的启动路径和应用的第一指纹信息；SFS服务模块202，还可以设置为通过以下方式在应用启动时根据应用白名单为该应用分配至少包括随机密码的第二访问凭证：
根据应用的应用名称或标识，在应用白名单查找该应用的启动路径和第一指纹信息；
根据该应用的启动路径找到该应用，在根据该应用的启动路径找到该应用后，计算该应用的第二指纹信息；
比较应用白名单中该应用的第一指纹信息和计算得到的第二指纹信息，若第一指纹信息和第二指纹信息一致，则为该应用生成一个随机密码，传递该随机密码给该应用并启动该应用。
在示例性实施方式中，SFS服务模块202，还可以设置为：若第一指纹信息和第二指纹信息不一致，则拒绝给该应用分配随机密码。
在示例性实施方式中，应用白名单还可以包括：应用许可的访问路径；
SFS服务模块202还可以设置为：在比较得到该SFS服务请求消息携带的第一访问凭证和SFS服务模块202在该应用启动时为该应用分配的第二访问凭证一致之后，根据该应用的SFS服务请求消息携带的访问路径和应用白名单中该应用许可的访问路径的比较结果，控制该应用所请求的SFS服务访问操作。
在示例性实施方式中，SFS服务模块202还可以设置为通过以下方式根据该应用的SFS服务请求消息中携带的访问路径和应用白名单中包括的该应用许可的访问路径的比较结果，控制该应用所请求的SFS服务访问操作：
若该SFS服务请求消息中携带的访问路径包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权成功，并按照该SFS服务请求消息携带的访问路径执行该应用所请求的SFS服务访问操作；
若该SFS服务请求消息中携带的访问路径没有包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权失败。
在示例性实施方式中，所述SFS服务模块，是设置为：比较该应用的SFS服务请求消息携带的第一访问凭证和SFS服务模块在该应用启动时为该应用分配的第二访问凭证，若第一访问凭证和第二访问凭证一致，比较该应用的SFS服务请求消息中携带的访问路径和应用白名单中包括的该应用许可的访问路径；若SFS服务请求消息中携带的访问路径包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权成功；在确定该应用鉴权成功后，按照SFS服务请求消息携带的访问路径执行该应用所请求的SFS服务访问操作。
在示例性实施方式中，SFS服务模块，还设置为：若SFS服务请求消息中携带的访问路径没有包含在应用白名单中包括的该应用许可的访问路径中，则确定该应用鉴权失败。
图4为本申请实施例提供的一种SFS访问控制系统的示意图。如图4所示， 本实施例提供的SFS访问控制系统包括：运行在一终端上的应用(比如，应用400a和应用400i等)以及SFS402。SFS402可以包括SFS客户模块201和SFS服务模块202。
其中，应用400a和400i为运行在终端设备上的应用程序，可以使用SFS服务模块202分配的访问凭据和SFS客户模块201的服务接口来进行数据安全存储访问操作。应用400a和400i的用户等级可以为root等级。
SFS客户模块201是为应用400a和400i提供数据安全存储访问操作的服务接口。以应用400a为例，SFS客户模块201负责将应用400a调用的SFS服务请求消息通过Socket或消息队列发送给SFS服务模块202，并将SFS服务模块202响应的消息返回给应用400a；其中，SFS服务请求消息中包含第一访问凭证，以用于SFS服务模块202对应用400a进行鉴权。
SFS服务模块202负责接收SFS客户模块201发送的SFS服务请求消息，并根据其中携带的第一访问凭证以及存储的第二访问凭证对应用400a进行鉴权，如果鉴权通过，则执行相应的SFS服务访问操作，并将访问操作结果通过socket或消息队列发送给对应的SFS客户模块201；SFS服务模块202还负责根据应用白名单对应用400a进行合法性验证，如果验证通过，则为该应用400a分配随机密码并启动该应用400a，否则拒绝为该应用400a分配随机密码并启动该应用400a；SFS服务模块202还负责应用白名单的安全存储，以防止白名单被纂改或伪造。
在示例性实施方式中，SFS服务模块202可以包括SFS鉴权单元及SFS操作单元。SFS鉴权单元负责对应用400a进行鉴权，并在鉴权成功时通知SFS操作单元；SFS操作单元负责根据SFS鉴权单元对应用400a的鉴权结果为应用400a提供相应权限的数据安全存储服务。
关于SFS402的其他相关说明可以参照图2和图3对应的实施例说明，故于此不再赘述。
下面对本申请的方案进行说明。
图5为本申请实施例提供的一种SFS访问控制方法的流程图。在本示例中，一个应用510调用SFS客户模块520的服务接口请求数据安全存储访问操作时，SFS客户模块520将该应用510的SFS服务请求消息通过Socket或消息队列发送给SFS服务模块530；SFS服务模块530接收到SFS客户模块520发送的SFS 服务请求消息后，根据SFS服务请求消息携带的第一访问凭证对该应用进行鉴权，如果鉴权通过，则完成该应用请求的SFS服务访问操作，并将访问操作结果通过socket或消息队列发送给对应的SFS客户模块520，如果鉴权失败，则将访问操作失败结果通过socket或消息队列发送给SFS客户模块520；最后，SFS客户模块520将SFS服务模块530的响应消息返回给该应用510。
如图5所示，本实施例的流程包括以下步骤：
步骤501、应用510调用SFS客户模块520的服务接口请求数据安全存储访问操作，在示例性实施方式中，数据安全存储访问操作可以包括SFS文件打开、SFS文件关闭、SFS文件删除、SFS文件读取和SFS文件写入等一个或多个操作；
步骤502、SFS客户模块520将应用510的SFS服务请求消息通过Socket或消息队列发送给SFS服务模块530；
步骤503、SFS服务模块530根据本地缓存的应用510的第二访问凭证(即SFS服务模块530在应用510本次启动时为应用510分配的第二访问凭证)和应用510的SFS服务请求消息携带的第一访问凭证对应用510进行鉴权，如果鉴权成功，则执行步骤504，如果鉴权失败，则执行步骤507；在其他实现方式中，SFS服务模块530还可以根据本地缓存的应用510的第二访问凭证、应用白名单以及应用510的SFS服务请求消息对应用510进行鉴权；
步骤504、SFS服务模块530进行应用510所请求的SFS服务访问操作，并得到访问操作结果；
步骤505、SFS服务模块530将访问操作结果通过Socket或消息队列发送给SFS客户模块520；
步骤506、SFS客户模块520将访问操作结果返回给应用510；
步骤507、SFS服务模块530向SFS客户模块520返回应用510的SFS服务请求操作被拒绝；
步骤508、SFS客户模块520向应用510返回其SFS服务请求操作被拒绝。
图6为本申请实施例提供的一种SFS访问控制方法的流程图。在本示例中，一个应用610调用SFS客户模块620的服务接口请求数据安全存储访问操作时，SFS客户模块620将该应用610的SFS服务请求消息通过Socket或消息队列发送给SFS鉴权单元630；SFS鉴权单元630接收到SFS客户模块620发送的SFS 服务请求消息后，根据SFS服务请求消息携带的第一访问凭证和本地保存的该应用610的第二访问凭证对该应用610进行鉴权，如果鉴权通过，则与SFS操作单元640交互完成该应用610请求的SFS服务访问操作，并将访问操作结果通过socket或消息队列发送给对应的SFS客户模块620，如果鉴权失败，则将访问操作失败结果通过socket或消息队列发送给SFS客户模块620；最后，SFS客户模块620将SFS鉴权单元630的响应消息返回给该应用610。
如图6所示，本实施例的流程包括以下步骤：
步骤601、应用610调用SFS客户模块620的服务接口请求数据安全存储访问操作，在示例性实施方式中，数据安全存储访问操作可以包括SFS文件打开、SFS文件关闭、SFS文件删除、SFS文件读取和SFS文件写入等一个或多个操作；
步骤602、SFS客户模块620将应用610的SFS服务请求消息通过Socket或消息队列发送给SFS鉴权单元630；
步骤603、SFS鉴权单元630根据本地缓存的应用610的第二访问凭证(即SFS鉴权单元630在应用610启动时为应用610分配的访问凭证)和应用610的SFS服务请求消息携带的第一访问凭证对应用610进行鉴权，如果鉴权成功，则执行步骤604，如果鉴权失败，则执行步骤608；在其他实现方式中，SFS鉴权单元630还可以根据本地缓存的应用610的第二访问凭证、应用白名单以及应用610的SFS服务请求消息对应用610进行鉴权；
步骤604、SFS鉴权单元630将应用610所请求的SFS服务访问操作发送给SFS操作单元640；
步骤605、SFS操作单元640进行应用610所请求的SFS服务访问操作，并将结果返回给SFS鉴权单元630；
步骤606、SFS鉴权单元630将应用610所请求的SFS服务访问操作结果通过Socket或消息队列发送给SFS客户模块620；
步骤607、SFS客户模块620将应用610所请求的SFS服务访问操作结果返回给应用610；
步骤608、SFS鉴权单元630向SFS客户模块620返回SFS服务请求操作被拒绝；
步骤609、SFS客户模块620向应用610返回其SFS服务请求操作被拒绝。
图7为本申请实施例提供的SFS服务模块为应用分配访问凭证的流程示意图。在本示例中，SFS服务模块会根据应用白名单查找应用的启动路径和第一指纹信息；SFS服务模块会根据该应用的启动路径来找到该应用，然后计算该应用的第二指纹信息，在示例性实施方式中，可以使用信息摘要算法(MD5)或安全散列算法(SHA)来计算应用的第二指纹信息；之后，SFS服务模块使用计算出来的应用的第二指纹信息与应用白名单中该应用的第一指纹信息进行比较，如果一致，则生成一个非0随机密码并以形参方式传递给该应用并启动该应用，同时在本地缓存该随机密码和应用标识，在该应用启动后从形参中取出该随机密码作为后续与SFS服务模块交互的第一访问凭证；如果计算出来的应用的第二指纹信息与应用白名单中该应用的第一指纹信息不一致，则拒绝为该应用分配随机密码和启动该应用。
如图7所示，本实施例的流程包括以下步骤：
步骤701、SFS服务模块从应用白名单中读取应用名称、应用的启动路径和应用的第一指纹信息；
步骤702、SFS服务模会根据该应用的启动路径来找到该应用，然后计算该应用的第二指纹信息，在示例性实施方式中，可以使用MD5或SHA来计算该应用的第二指纹信息；比如，使用MD5或SHA对该应用的启动路径进行加密得到该应用的第二指纹信息；
步骤703、SFS服务模块使用计算出来的该应用的第二指纹信息与应用白名单中该应用的第一指纹信息进行比较，如果一致，则执行步骤705，如果不一致，则执行步骤704；
步骤704、SFS服务模块拒绝为该应用分配随机密码和启动该应用；
步骤705、SFS服务模块为该应用生成一个非0随机密码，并以形参方式传递给该应用并启动该应用；
步骤706、SFS服务模块在本地缓存该随机密码和应用标识(对应前述的第二访问凭证)，该应用启动后从形参中取出该随机密码作为后续与SFS服务模块交互的第一访问凭证。在其他实现方式中，该应用还可以使用随机密码和应用标识作为第一访问凭证。
在示例性实施方式中，应用白名单可以包括：应用名称或应用标识、应用的启动路径、应用的第一指纹信息、应用许可的访问路径和指纹算法。表1为 本实施例提供应用白名单的示例。在表1中只示例了3个应用，即App1、App2和App3，App1位于System\bin目录下，App2和App3均位于System\sbin目录下，App1采用SHA256指纹算法，计算出来的指纹为256位的16进制字符串，App2和App3采用MD5指纹算法，计算出来的指纹为128位的16进制字符串；App1只能在ZTEFILE\sfs\app1目录下进行文件安全存储访问操作，App2只能在ZTEFILE\sfs\app2目录下进行文件安全存储访问操作，App3只能在ZTEFILE\sfs\app3目录下进行文件安全存储访问操作。为了防止应用白名单被纂改或伪造，使用数字签名技术对应用白名单进行真实性和完整性校验，其中，用于数字签名的公钥或根公钥通过预配置方式保存到SFS中，例如保存到ZTEFILE\sfs\pubkey目录下，该配置文件预配置后只允许SFS服务模块进行读取操作，不允许SFS服务模块修改或删除。
Figure PCTCN2018086098-appb-000001
表1
图8为本申请实施例提供的SFS服务模块对应用进行鉴权的流程图。在本示例中，SFS服务模块对应用进行鉴权可以包括访问凭据认证和路径访问控制两个过程。其中，访问凭据认证过程包括：SFS服务模块从SFS客户模块发送的SFS服务请求消息中提取出第一访问凭证，然后使用它与本地缓存的第二访问凭证进行比较，如果一致则认证通过，如果不一致则认证失败，并返回应用鉴权失败。路径访问控制过程包括：在访问凭据认证通过后，SFS服务模块会 检查应用白名单中包括的该应用许可的访问路径，如果该应用的SFS服务请求消息中携带的访问路径包括在应用白名单中包括的该应用许可的访问路径中，则返回应用鉴权成功，允许该应用进行SFS文件访问操作，如果该应用的SFS服务请求消息中携带的访问路径不包括在应用白名单中包括的该应用许可的访问路径中，则返回应用鉴权失败。
如图8所示，本实施例的流程包括以下步骤：
步骤801、SFS服务模块从SFS客户模块发送的SFS服务请求消息中提取出应用的第一访问凭证，然后使用它与本地缓存的该应用的第二访问凭证进行比较，如果不一致，则执行步骤802，如果一致，则执行步骤803；
步骤802、SFS服务模块给SFS客户模块返回应用鉴权失败；
步骤803、SFS服务模块会检查在SFS服务请求消息中该应用的访问路径是否包括在应用白名单中该应用许可的访问路径中；如果不是，则执行步骤804，如果是，则执行步骤805；
步骤804、SFS服务模块给SFS客户模块返回应用鉴权失败；
步骤805、应用鉴权成功，SFS服务模块允许该应用进行SFS服务访问操作；比如，SFS服务模块执行该应用所请求的SFS服务访问操作，或者，SFS鉴权单元可以通知SFS操作单元执行该应用所请求的SFS服务访问操作。
图9为本申请实施例提供的SFS鉴权单元和SFS操作单元进行认证的流程图。在本示例中，SFS鉴权单元与SFS操作单元之间也可以进行认证，认证密码由系统分配，系统在启动SFS鉴权单元时以形参方式将认证密码传递给SFS鉴权单元，系统在SFS操作单元初始化或加载时将认证密码传递给SFS操作单元。
如图9所示，本实施例的流程包括以下步骤：
步骤901、无线终端系统初始化(Linux init)模块生成认证密码；
步骤902、无线终端系统Linux init模块在SFS操作单元初始化或加载时将该认证密码传递给SFS操作单元；
步骤903、无线终端系统Linux init模块在启动SFS鉴权单元时以形参方式将该认证密码传递给SFS鉴权单元；
步骤904、SFS操作单元将使用该认证密码对SFS鉴权单元进行认证；若认证通过，则执行步骤906，若认证失败，则执行步骤905；
步骤905、SFS操作单元拒绝为SFS鉴权单元提供数据安全存储访问操作；
步骤906、SFS操作单元同意为SFS鉴权单元提供数据安全存储访问操作。
在本示例中，通过SFS鉴权单元和SFS操作单元之间进行认证，可以进一步增加本申请方案的安全性。
下面通过两个应用场景对本申请进行说明。
应用场景一
车载T-Box支持远程车辆控制功能，其与车厂远程服务提供商(Telematics Service Provider，TSP)后台之间需要进行双向鉴权，以确保双方都可信任，T-Box与TSP鉴权认证相关的证书和账户信息需要安全储存，如果这些信息被黑客或恶意程序窃取或修改，那么车辆将可能被人远程操控或者TSP服务器将面临入侵风险。
T-Box上的TSP客户端(Client)程序负责与车厂TSP后台通信，其与服务器鉴权用的证书和账户信息为确保安全需要存储在T-Box的SFS中。由于T-Box支持二次开发，车厂允许第三方开发在T-Box上运行的汽车应用，如果未使用本申请的方案，那么T-Box上的其他应用也是可以访问TSP Client程序保存在SFS中用于鉴权的重要数据的。这些信息一旦被黑客或恶意应用窃取或修改，那么车辆将可能被人远程操控或者TSP服务器将面临入侵风险。
在采用本申请的方案后，SFS服务模块将会根据访问凭证和应用白名单对汽车应用进行鉴权，只有鉴权成功的应用才能访问SFS中的数据，而且也只能访问该应用自己存储的数据，其他应用存储的数据该应用将无权访问。因此，黑客和恶意应用将无法访问TSP Client程序保存在SFS中的重要数据。
应用场景二
本申请的方案适用于任何支持SFS功能的硬件环境，可以包括但不限于高通移动数据调制解调器(Mobile Data Modem，MDM)芯片平台、联发科技股份有限公司(MediaTek，MTK)芯片平台、迈威科技集团有限公司(Marvell)芯片和展讯芯片平台等，产品类型包括但不限于客户终端设备(Customer Premise Equipment，CPE)、移动热点(Mobile WiFi，MiFi)、数据卡、第三代(the third Generation，3G)通信模块、第四代(Fourth Generation，4G)通信模块、或物联网(Internet Of Things，IOT)终端等。
CPE、MiFi、数据卡、3G通信模块、4G通信模块、或IOT终端等需要使 用SFS将设备敏感数据(例如WiFi和Web UI密码)进行安全存储，允许特定应用可以对这些敏感数据进行访问控制操作，限制一些网络应用对SFS内的敏感数据进行访问控制操作。这样即使这些网络应用因存在安全漏洞被攻破了也不会给设备安全造成影响。
综上所述，本申请将SFS分解成SFS客户模块和SFS服务模块，或者分解成SFS客户模块、SFS鉴权单元和SFS操作单元，其中，SFS客户模块是呈现给应用访问SFS服务的接口，SFS服务模块负责对应用进行指纹认证、访问凭证分配和启动，应用调用SFS服务模块进行SFS服务请求时，SFS服务模块可以根据应用白名单及SFS服务模块在应用启动时为应用分配的访问凭证来对应用在SFS服务请求消息中携带的访问凭证和访问路径进行鉴权，如果鉴权成功，则允许进行数据存储访问操作，如果鉴权失败，则拒绝应用的数据存储访问操作请求。其中，通过访问凭证中的随机密码进行鉴权，对于每个应用在每次启动后其随机密码都会发生改变，这样可以确保黑客或恶意程序无法猜测出密码或使用暴力破解方式进行破解，以防止恶意应用伪装成正常应用来欺骗SFS服务模块；在应用白名单中设置每个应用的访问路径，从而可以控制每个应用只能访问自己的数据，无法访问其他应用的数据。
此外，本申请实施例还提供一种终端设备，包括：存储器、处理器以及存储在所述存储器中并可在处理器上运行的SFS访问控制程序，SFS访问控制程序被处理器执行时实现上述的任意一种SFS访问控制方法。
此外，本申请实施例还提供一种机器可读介质，存储有SFS访问控制程序，SFS访问控制程序被处理器执行时实现上述的任意一种SFS访问控制方法。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些组件或所有组件可以被实施为由处理器，如数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在机器可读介质(比如，计算机可读介质)上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计 算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
虽然本申请所揭露的实施方式如上，但所述的内容仅为便于理解本申请而采用的实施方式，并非用以限定本申请。任何本申请所属领域内的技术人员，在不脱离本申请所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本申请的专利保护范围，仍须以所附的权利要求书所界定的范围为准。
工业实用性
本发明实施例提供的SFS访问控制方法及系统、SFS及终端设备，SFS客户模块和SFS服务模块对终端设备上运行的一个或多个应用进行鉴权，以识别对SFS具有访问权限的应用，以防止恶意应用伪装成正常应用欺骗SFS，从而提高了SFS访问的安全性。

Claims (20)

  1. 一种安全文件系统SFS访问控制方法，应用于一终端设备，所述终端设备上运行有SFS以及一个或多个应用，所述SFS包括SFS客户模块以及SFS服务模块；所述方法包括：
    所述SFS客户模块接收所述应用的SFS服务请求消息，并将所述SFS服务请求消息发送给所述SFS服务模块；
    所述SFS服务模块根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
  2. 根据权利要求1所述的方法，其中，所述SFS服务模块根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权，包括：
    所述SFS服务模块比较所述应用的SFS服务请求消息携带的第一访问凭证和所述SFS服务模块在所述应用启动时为所述应用分配的第二访问凭证，若所述第一访问凭证和所述第二访问凭证一致，则确定所述应用鉴权成功，若所述第一访问凭证和所述第二访问凭证不一致，则确定所述应用鉴权失败。
  3. 根据权利要求2所述的方法，
    所述方法还包括：所述SFS服务模块在所述应用启动时根据所述SFS服务模块存储的应用白名单为所述应用分配所述第二访问凭证。
  4. 根据权利要求3所述的方法，其中，所述应用白名单至少包括：应用名称或标识、应用的启动路径和应用的第一指纹信息；并且，所述第二访问凭证至少包括随机密码；以及
    其中，所述SFS服务模块在所述应用启动时根据所述SFS服务模块存储的应用白名单为所述应用分配所述第二访问凭证，包括：
    根据所述应用的应用名称或标识，在所述应用白名单查找所述应用的启动路径和第一指纹信息；
    根据所述应用的启动路径找到所述应用，并在根据所述应用的启动路径找到所述应用后，计算所述应用的第二指纹信息；
    比较所述应用白名单中所述应用的第一指纹信息和计算得到的第二指纹信息，若所述第一指纹信息和所述第二指纹信息一致，则为所述应用生成所述随机密码；
    传递所述随机密码给所述应用并启动所述应用。
  5. 根据权利要求2、3或4所述的方法，其中，所述应用白名单还包括：应用许可的访问路径；
    其中，所述若所述第一访问凭证和所述第二访问凭证一致，则确定所述应用鉴权成功，包括：
    若所述第一访问凭证和所述第二访问凭证一致，则比较所述应用的SFS服务请求消息中携带的访问路径和所述应用白名单中包括的所述应用许可的访问路径；
    若所述SFS服务请求消息中携带的访问路径包含在所述应用白名单中包括的所述应用许可的访问路径中，则确定所述应用鉴权成功。
  6. 根据权利要求5所述的方法，其中，所述在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，包括：
    在确定所述应用鉴权成功后，按照所述SFS服务请求消息携带的访问路径执行所述应用所请求的SFS服务访问操作。
  7. 根据权利要求6所述的方法，还包括：
    若所述SFS服务请求消息中携带的访问路径没有包含在所述应用白名单中包括的所述应用许可的访问路径中，则确定所述应用鉴权失败。
  8. 根据权利要求1或7所述的方法，还包括：
    所述SFS服务模块确定所述应用鉴权失败后，通过所述SFS客户模块向所述应用返回访问操作拒绝消息。
  9. 根据权利要求1所述的方法，其中，所述SFS服务模块包括：SFS鉴权单元以及SFS操作单元；
    其中，所述SFS服务模块根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用，包括：
    所述SFS鉴权单元根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，通知所述SFS操作单元执行所述应用所请求的SFS服务访问操作；
    所述SFS操作单元根据所述SFS鉴权单元的通知，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果返回给所述SFS鉴权单元；
    所述SFS鉴权单元将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
  10. 根据权利要求1所述的方法，其中，所述终端设备包括以下至少之一：车载远程信息处理器T-Box、客户终端设备CPE、移动热点MiFi、数据卡和物联网终端。
  11. 一种安全文件系统SFS，包括：SFS客户模块以及SFS服务模块；
    所述SFS客户模块，设置为：接收应用的SFS服务请求消息，并将所述SFS服务请求消息发送给所述SFS服务模块；
    所述SFS服务模块，设置为：根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
  12. 根据权利要求11所述的SFS，其中，所述SFS服务模块，是设置为：通过以下方式根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权：
    所述SFS服务模块比较所述应用的SFS服务请求消息携带的第一访问凭证和所述SFS服务模块在所述应用启动时为所述应用分配的第二访问凭证，若所述第一访问凭证和所述第二访问凭证一致，则确定所述应用鉴权成功，若所述第一访问凭证与所述第二访问凭证不一致，则确定所述应用鉴权失败。
  13. 根据权利要求12所述的SFS，其中
    所述SFS服务模块，是设置为：通过以下方式在所述应用启动时根据所述SFS服务模块存储的应用白名单为所述应用分配至少包括随机密码的第二访问凭证，其中，所述应用白名单至少包括：应用名称或标识、应用的启动路径和应用的第一指纹信息：
    根据所述应用的应用名称或标识，在所述应用白名单查找所述应用的启动路径和第一指纹信息；
    根据所述应用的启动路径找到所述应用，并在根据所述应用的启动路径找到所述应用后，计算所述应用的第二指纹信息；
    比较所述应用白名单中所述应用的第一指纹信息和计算得到的第二指纹信息，若所述第一指纹信息和所述第二指纹信息一致，则为所述应用生成所述随机密码，传递所述随机密码给所述应用并启动所述应用。
  14. 根据权利要求11、12或13所述的SFS，其中，所述应用白名单还包括：应用许可的访问路径；
    所述SFS服务模块，是设置为：比较所述应用的SFS服务请求消息携带的第一访问凭证和所述SFS服务模块在所述应用启动时为所述应用分配的第二访问凭证，若所述第一访问凭证和所述第二访问凭证一致；比较所述应用的SFS服务请求消息中携带的访问路径和所述应用白名单中包括的所述应用许可的访问路径；若所述SFS服务请求消息中携带的访问路径包含在所述应用白名单中包括的所述应用许可的访问路径中，则确定所述应用鉴权成功；在确定所述应用鉴权成功后，按照所述SFS服务请求消息携带的访问路径执行所述应用所请求的SFS服务访问操作。
  15. 根据权利要求14所述的SFS，其中，所述SFS服务模块，还设置为：
    若所述SFS服务请求消息中携带的访问路径没有包含在所述应用白名单中包括的所述应用许可的访问路径中，则确定所述应用鉴权失败。
  16. 根据权利要求11所述的SFS，其中，所述SFS服务模块，还设置为：在确定所述应用鉴权失败后，通过所述SFS客户模块向所述应用返回访问操作拒绝消息。
  17. 根据权利要求11所述的SFS，其中，所述SFS服务模块包括：SFS鉴权单元以及SFS操作单元；
    其中，所述SFS鉴权单元，设置为：根据所述SFS服务请求消息携带的第一访问凭证对所述应用进行鉴权；在确定所述应用鉴权成功后，通知所述SFS操作单元执行所述应用所请求的SFS服务访问操作；
    所述SFS操作单元，设置为：根据所述SFS鉴权单元的通知，执行所述应用所请求的SFS服务访问操作，并将所述SFS服务访问操作的结果返回给所述SFS鉴权单元；
    所述SFS鉴权单元，还设置为：将所述SFS服务访问操作的结果通过所述SFS客户模块返回给所述应用。
  18. 一种安全文件系统SFS访问控制系统，包括：运行在一终端设备上的一个或多个应用以及如权利要求11至18中任一项所述的SFS。
  19. 一种终端设备，包括：存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的安全文件系统SFS访问控制程序，所述SFS访问控制程序被所述处理器执行时实现如权利要求1至10中任一项所述的SFS访问控制方 法。
  20. 一种机器可读介质，所述机器可读介质上存储有安全文件系统SFS访问控制程序，所述SFS访问控制程序被处理器执行时实现如权利要求1至10中任一项所述的SFS访问控制方法。
PCT/CN2018/086098 2017-07-03 2018-05-09 Sfs访问控制方法及系统、sfs及终端设备 WO2019007145A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18828420.2A EP3651048A4 (en) 2017-07-03 2018-05-09 PROCEDURE AND SYSTEM FOR SFS ACCESS CONTROL PROCEDURE, SFS AND TERMINAL DEVICE
US16/628,652 US20200218819A1 (en) 2017-07-03 2018-05-09 Sfs access control method and system, sfs and terminal device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710533513.2A CN107358118B (zh) 2017-07-03 2017-07-03 Sfs访问控制方法及系统、sfs及终端设备
CN201710533513.2 2017-07-03

Publications (1)

Publication Number Publication Date
WO2019007145A1 true WO2019007145A1 (zh) 2019-01-10

Family

ID=60291687

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/086098 WO2019007145A1 (zh) 2017-07-03 2018-05-09 Sfs访问控制方法及系统、sfs及终端设备

Country Status (4)

Country Link
US (1) US20200218819A1 (zh)
EP (1) EP3651048A4 (zh)
CN (1) CN107358118B (zh)
WO (1) WO2019007145A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107358118B (zh) * 2017-07-03 2020-06-09 中兴通讯股份有限公司 Sfs访问控制方法及系统、sfs及终端设备
CN110362984B (zh) * 2019-06-28 2021-04-30 北京思源理想控股集团有限公司 多设备运行业务系统的方法及装置
CN110489986B (zh) * 2019-08-22 2021-03-23 网易（杭州）网络有限公司 图数据功能的响应方法、系统及电子设备
CN113923017A (zh) * 2021-10-08 2022-01-11 安徽江淮汽车集团股份有限公司 基于双重加密的车辆关键信息传输方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103812649A (zh) * 2012-11-07 2014-05-21 中国电信股份有限公司 机卡接口的安全访问控制方法与系统、手机终端
CN104348951A (zh) * 2013-07-24 2015-02-11 北京握奇数据系统有限公司 一种卡片应用管理系统
CN104994498A (zh) * 2015-05-18 2015-10-21 中国联合网络通信集团有限公司 一种终端应用与手机卡应用交互的方法及系统
CN105472605A (zh) * 2014-08-15 2016-04-06 中国电信股份有限公司 手机应用调用鉴权方法、多功能通用智能卡与移动终端
CN105743651A (zh) * 2014-12-11 2016-07-06 卓望数码技术（深圳）有限公司 芯片安全域的卡应用使用方法、装置和应用终端
CN107358118A (zh) * 2017-07-03 2017-11-17 中兴通讯股份有限公司 Sfs访问控制方法及系统、sfs及终端设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1219260C (zh) * 2003-09-02 2005-09-14 四川大学 一种安全文件系统的存储及访问控制方法
EP2534604A4 (en) * 2010-02-11 2013-12-04 Hewlett Packard Development Co ACCESS OF FILE EXECUTABLE ON THE BASIS OF IDENTITY
US9773102B2 (en) * 2011-09-09 2017-09-26 Microsoft Technology Licensing, Llc Selective file access for applications
US10389709B2 (en) * 2014-02-24 2019-08-20 Amazon Technologies, Inc. Securing client-specified credentials at cryptographically attested resources
CN104866778A (zh) * 2015-01-30 2015-08-26 武汉华工安鼎信息技术有限责任公司 一种基于Linux内核的文档安全访问控制方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103812649A (zh) * 2012-11-07 2014-05-21 中国电信股份有限公司 机卡接口的安全访问控制方法与系统、手机终端
CN104348951A (zh) * 2013-07-24 2015-02-11 北京握奇数据系统有限公司 一种卡片应用管理系统
CN105472605A (zh) * 2014-08-15 2016-04-06 中国电信股份有限公司 手机应用调用鉴权方法、多功能通用智能卡与移动终端
CN105743651A (zh) * 2014-12-11 2016-07-06 卓望数码技术（深圳）有限公司 芯片安全域的卡应用使用方法、装置和应用终端
CN104994498A (zh) * 2015-05-18 2015-10-21 中国联合网络通信集团有限公司 一种终端应用与手机卡应用交互的方法及系统
CN107358118A (zh) * 2017-07-03 2017-11-17 中兴通讯股份有限公司 Sfs访问控制方法及系统、sfs及终端设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3651048A4 *

Also Published As

Publication number Publication date
CN107358118A (zh) 2017-11-17
EP3651048A4 (en) 2021-03-24
CN107358118B (zh) 2020-06-09
EP3651048A1 (en) 2020-05-13
US20200218819A1 (en) 2020-07-09

Similar Documents

Publication Publication Date Title
US11711222B1 (en) Systems and methods for providing authentication to a plurality of devices
US9027086B2 (en) Securing organizational computing assets over a network using virtual domains
US20080077592A1 (en) method and apparatus for device authentication
US9954834B2 (en) Method of operating a computing device, computing device and computer program
CN113168476A (zh) 操作系统中个性化密码学安全的访问控制
CA3035817A1 (en) System and method for decentralized authentication using a distributed transaction-based state machine
US20090319793A1 (en) Portable device for use in establishing trust
TW202109320A (zh) 基於可信執行環境的應用程式啟動方法及裝置
JP2016506107A (ja) 仮想マシンのための管理制御方法、装置及びシステム
WO2019007145A1 (zh) Sfs访问控制方法及系统、sfs及终端设备
US10713381B2 (en) Method and apparatus for securely calling fingerprint information, and mobile terminal
US20220245631A1 (en) Authentication method and apparatus of biometric payment device, computer device, and storage medium
US10812272B1 (en) Identifying computing processes on automation servers
WO2015117523A1 (zh) 访问控制方法及装置
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
CN116192483A (zh) 认证鉴权方法、装置、设备及介质
CN108667800B (zh) 一种访问权限的认证方法及装置
CN109474431B (zh) 客户端认证方法及计算机可读存储介质
JP2015104020A (ja) 通信端末装置、通信端末関連付けシステム、通信端末関連付け方法、及びコンピュータプログラム
Kim et al. Secure user authentication based on the trusted platform for mobile devices
CN110287725B (zh) 一种设备及其权限控制方法、计算机可读存储介质
Choi et al. Hardware-assisted credential management scheme for preventing private data analysis from cloning attacks
Tank et al. Security analysis of OpenStack keystone
Tamrakar et al. On rehoming the electronic id to TEEs
CN112632589A (zh) 密钥托管方法、装置、设备及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18828420

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018828420

Country of ref document: EP

Effective date: 20200203