WO2023098579A1

WO2023098579A1 - Access control method and related device

Info

Publication number: WO2023098579A1
Application number: PCT/CN2022/134254
Authority: WO
Inventors: 曹建龙; 方锐; 周广宇
Original assignee: 华为技术有限公司
Priority date: 2021-11-30
Filing date: 2022-11-25
Publication date: 2023-06-08
Also published as: CN116204858A

Abstract

Disclosed in embodiments of the present application is an access control method, for use in reducing policy access and policy query overhead during access control. The method in the embodiments of the present application comprises: a kernel maps into a user address space of an object application progress a memory address where a target application policy set is located, the target application policy set being used for indicating an access permission of a subject application progress on an object of the object application progress, wherein the object comprises service and/or a resource; the object application progress determines a first application policy between the subject application progress and a first object on the basis of an access permission query requirement for the first object and according to the target application policy set mapped in the user address space; and the object application progress determines an access permission of the subject application progress on the first object according to the first application policy.

Description

An access control method and related equipment

This application claims the priority of the Chinese patent application with the application number CN202111446740.4 and the title of the invention "An access control method and related equipment" filed with the State Intellectual Property Office of China on November 30, 2021, the entire contents of which are incorporated by reference incorporated in this application.

technical field

The embodiments of the present application relate to the field of computers, and in particular, to an access control method and related equipment.

Background technique

Access control technology is used to distinguish the access rights of different applications to objects. Access control technology stores policies on a trusted base to ensure that policies cannot be tampered with. When an application requests access to an object, it is determined whether the application has permission to access the object by querying the policies in the trust base.

However, since the trusted base usually runs in the kernel space, and the application runs in the user space, context switching is required when applying query policies, resulting in high overhead for policy access and policy query during access control.

Contents of the invention

Embodiments of the present application provide an access control method and related equipment, which are used to reduce policy access and policy query overhead during access control.

In the first aspect, the embodiment of the present application provides an access control method, including: the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, and the target application policy set is used to instruct the subject application process to control the object The access rights of the objects on the application process; where the objects include services and/or resources; the object application process determines the subject application process based on the query requirements for the access rights of the first service and according to the target application policy set mapped to the user address space A first application policy with the first service; the object application process determines the access authority of the subject application process to the first service according to the first application policy.

In this embodiment of the present application, the object on the object application process is also called the object, so the object application process is also called the object application process.

In this embodiment of the application, the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, so that the object application process can query the relevant The object's application policy, which determines access rights. In the process of determining access rights (ie, access control), context switching between the object application process and the kernel is not required, thereby reducing policy access and policy query overhead during access control.

In an optional implementation manner, the kernel maps the memory address where the target application policy set is located to the user address space of the object application process through a binary loader of the kernel.

In an optional implementation manner, the kernel writes the memory address to which the target application policy set is mapped to the auxiliary vector in the executable file of the object application process.

In the embodiment of the present application, the mapping address information is transmitted through the auxiliary vector. Compared with the system call and other methods with high performance overhead, the mapping address information is transmitted through the auxiliary vector, which is relatively simple and has low performance overhead.

In an optional implementation manner, the auxiliary vector is located at the top of the stack of the object application process.

In an optional implementation manner, the executable file of the object application process includes a service mask corresponding to the target application policy set; before the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, The kernel parses the policy source file to obtain a source policy set; then, the kernel determines a target application policy set from the source policy set according to the service mask, wherein the target application policy set is used to protect objects on the object application process.

In the embodiment of this application, the kernel determines the target application policy set corresponding to the object application process from the source policy set through the service mask, realizes the screening of the policy set, and does not map the application policies that are not related to the object application process, thereby reducing the The occupation of the user address space of the object application process is reduced, and the central processing unit (central processing unit, CPU) resource occupied during the mapping process is also reduced.

In an optional implementation manner, the executable file also includes a signature for the executable file; the kernel verifies the validity of the signature; if the signature is legal, the kernel determines from the source policy set according to the service mask A collection of target application policies.

In this embodiment of the application, the validity of the service mask and the executable file is verified through the signature, so as to ensure that the service mask is not tampered with, thereby ensuring the integrity and accuracy of the application policy mapped to the user address space of the object application process (If the mask is not tampered with, it can ensure that all application policies related to the object application process are mapped), ensuring that the object application process can query all application policies related to the object application process.

In an optional implementation manner, the service mask corresponding to the target application policy set is used to identify the target application policy set in the source policy set.

In an optional implementation manner, the executable file of the object application process includes a service mask corresponding to the target application policy set; the kernel determines the partial policy source corresponding to the target application policy set from the policy source file according to the service mask Then, the kernel maps the memory address where the target application policy set is located to the user address space of the object application process; the object application process parses the above part of policy source files to the above memory address to obtain the target application policy set.

In the embodiment of the present application, the policy source file is parsed by the object application process in the user space, and the kernel does not need to parse the policy source file, which reduces the performance overhead of the kernel and improves the operating efficiency of the kernel.

In an optional implementation manner, before the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, the kernel randomizes an address in the user address space of the object application process.

In the embodiment of this application, the address of the object application process is randomized before mapping, which can reduce the risk of the address where the application policy set is located being leaked, and also avoid the address where the application policy set is mapped to and the address reserved by the user. Space conflicts.

In the second aspect, the embodiment of the present application provides an access control method, including: the kernel maps the memory address of the policy source file to the address space of the access control management process; the access control management process parses the policy source file to obtain the source policy set; The access control management process loads the target application policy set in the source policy set into the shared memory space of the object application process; wherein, the target application policy set is used to determine the access rights of objects on the object application process; The policy set is mapped to the user address space of the object application process.

In the embodiment of the present application, the policy source file is parsed through the access control management process, and the kernel is not required to parse the policy source file, which reduces the performance overhead of the kernel and improves the operating efficiency of the kernel.

In an optional implementation, the access control management process parses the configuration file of the object application process to obtain the target ID of the target application policy set in the source policy set; the access control management process determines the target ID from the source policy set according to the target ID A target application policy set; the access control management process loads the target application policy set into the shared memory corresponding to the object application process.

In this embodiment of the application, the access control management process determines the target application policy set corresponding to the object application process from the source policy set according to the configuration file, and realizes the screening of the policy set. The policy is applied, thereby reducing the occupation of the user address space of the object application process, and also reducing the CPU resources occupied during the mapping process. Moreover, an access control management process parses a policy source file once to implement application policy mapping for multiple object application processes, reducing the number of times of parsing the policy source file and reducing CPU resource occupation.

In an optional implementation manner, the access control management process parses the service mask in the configuration file of the object application process to obtain the target identifier of the target application policy set in the source policy set.

In an optional implementation manner, the application management process identifies the shared memory corresponding to the object application process through a unique identifier of the object application process (for example, process identification (process identification, PID), application number app name, etc.).

In a third aspect, an embodiment of the present application provides a computing device, including a processor and a memory; the processor is coupled to the memory; the memory is used to store a program; the processor is used to execute the program in the memory, so that the processor executes the first aspect or The access control method described in the second aspect.

In the fourth aspect, the embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed, the method described in the above-mentioned first aspect or the second aspect is realized .

In the fifth aspect, the embodiment of the present application provides a computer program product, the computer program product includes: computer program code, when the computer program code is executed, the method described in the above first aspect or the second aspect is executed .

In a sixth aspect, the present application provides a chip or a chip system, where the chip or chip system includes a processor, configured to implement the method in the first aspect or the second aspect above. In a possible design, the chip or chip system further includes a memory for storing program instructions and/or data. The system-on-a-chip may consist of chips, or may include chips and other discrete devices.

In a seventh aspect, an embodiment of the present application provides a server, where the server includes the chip described in the sixth aspect.

For the beneficial effects of the third aspect to the seventh aspect of the embodiments of the present application, refer to the first aspect or the second aspect, and details are not repeated here.

Description of drawings

Fig. 1a is an architecture diagram of the access control method provided by the embodiment of the present application;

Figure 1b is another architecture diagram of the access control method provided by the embodiment of the present application;

Figure 1c is another architecture diagram of the access control method provided by the embodiment of the present application;

FIG. 2 is a schematic diagram of an access control method provided in an embodiment of the present application;

FIG. 3 is a schematic flow chart of an access control method provided in an embodiment of the present application;

FIG. 4 is another schematic flowchart of the access control method provided by the embodiment of the present application;

FIG. 5 is a schematic diagram of an executable file of the access control method provided by the embodiment of the present application;

FIG. 6 is another schematic diagram of the access control method provided by the embodiment of the present application;

FIG. 7 is another schematic flowchart of the access control method provided by the embodiment of the present application;

FIG. 8 is another schematic diagram of the access control method provided by the embodiment of the present application;

FIG. 9a is another schematic flowchart of the access control method provided by the embodiment of the present application;

FIG. 9b is another schematic diagram of the access control method provided by the embodiment of the present application;

FIG. 10 is a structural diagram of an access control method provided by an embodiment of the present application;

FIG. 11 is a schematic structural diagram of a computing device provided by an embodiment of the present application;

FIG. 12 is a schematic structural diagram of a chip provided by an embodiment of the present application.

Detailed ways

The embodiment of the present application provides an access control method, which is used to reduce the performance overhead of the kernel and improve the operating efficiency of the kernel.

Please refer to FIG. 1a. FIG. 1a is a structural diagram of an access control method provided by an embodiment of the present application. As shown in Figure 1a, the architecture includes a subject application process, an object application process and a kernel.

Wherein, the subject application process and the object application process run on the user space. The object application process includes objects (also referred to as objects), and there is a policy library in the kernel. The policy library includes a policy library 1 (also referred to as a target application policy set in this embodiment of the application), and the policy library 1 includes the subject application process and The first application policy between objects.

In this embodiment of the application, a policy includes a subject, an object, and an action. The subject represents the execution subject of the access action, which is the subject application process in the embodiment of this application; the object represents the object to be accessed, including services and/or resources in the embodiment of the application; the behavior represents whether the subject can access the object.

In this embodiment of the present application, the object application process is also referred to as the object application process. Since the application process includes the object, it is called the object application process.

The kernel is used to map the policy library 1 to the user address space of the object application process. The object application process is used to protect the object. When the subject application process needs to access the object, it needs to query the first application policy; the object application process can query the first application policy through the mapping of the policy library 1 in the user address space.

Please refer to FIG. 1b. FIG. 1b is another architecture diagram of the access control method provided by the embodiment of the present application. As shown in Figure 1b, the architecture includes a subject application process, an object application process and a kernel.

The kernel is used to determine a part of the policy source file corresponding to the object application process from the policy source file (encoded policy of interest, ePOI) (this part of the policy source file is the target application policy set after parsing), and maps the target application policy set to the user address space of the guest application process. The object application process is used to parse the part of the policy source file, and load the parsed policy set into the user address space of the object application process to obtain the target application policy set (namely policy library 1) of the object application process.

The target application policy set is used to protect the object (object) on the object application process. When the subject application process needs to access the object on the object application process, it needs to query the first application policy; The first application policy is queried for the mapping of the target application policy set (that is, the policy library 1).

Please refer to FIG. 1c. FIG. 1c is another architecture diagram of the access control method provided by the embodiment of the present application. As shown in Figure 1c, the architecture includes a subject application process, multiple object application processes, an access control management process and a kernel.

Among them, the subject application process, the object application process and the access control management process run on the user space. The object application process includes objects, and there is a policy library in the kernel, and the policy library includes policy library 1, policy library 2, ... policy library n. The policy library 1 includes the policies related to the object 1 on the object application process 1, which is also called the target application policy set; other policy libraries can be deduced in the same way, and will not be repeated here.

The kernel is used to map the policy library to the access control management process, and the access control management process is used to map the part of the policy library related to the object application process in the policy library to the user address space of the corresponding object application process (for example, the policy library 1 is mapped to the user address space of the guest application process 1). The object application process 1 is used to protect the object 1. When the subject application process needs to access the object 1, it needs to query the first application policy; the object application process 1 can query the first application policy through the mapping of the user address space to the policy library 1. Strategy. The functions of other object application processes can be deduced by analogy, and will not be repeated here.

In the framework shown in Figure 1a, Figure 1b and Figure 1c, and in other embodiments of the present application, since the object application process can be used to initiate query policies, the object application process can also be called a policy enforcement point (Policy enforcement point , PEP); Since the object application process can be used to perform policy queries, the object application process can also be called a policy decision point (policy decision point, PDP).

Based on the architecture shown in any one of Fig. 1a, Fig. 1b and Fig. 1c, an embodiment of the present application provides an access control method, and Fig. 2 is a schematic diagram of the access control method. As shown in FIG. 2 , the policy mapping module in the kernel maps the application policy set related to the object (on the object application process) to the user address space of the object application process. If the subject application process needs to access the object on the object application process, the policy query module PDP on the object application process can query the application policy set through the mapping of the application policy set on the user address space based on the access authority query requirements of the object, Therefore, the first application policy between the subject application process and the object is determined, and the access authority of the subject application process to the object is determined according to the first application policy.

Through the access control method of the embodiment of the present application, when the object application process (PDP) needs to query the access authority of the subject application process to the object, only the PDP needs to query the corresponding policy through the application policy mapped to the user address space, and no kernel is required. Participation, there is no need for context switching, which reduces the policy access and policy query overhead during access control.

Please refer to FIG. 3. FIG. 3 uses the object application process as an example of the object application process to illustrate the access control method provided by the embodiment of the present application. The method includes:

301. The kernel maps the memory address where the target application policy set is located to the user address space of the object application process, and the target application policy set is used to indicate the access rights of the subject application process to objects on the object application process; where the objects include services and/or or resources.

In the embodiment of the present application, the kernel can determine the memory address where the target application policy set is located, and before the object application process starts, the kernel can map the memory address of the target application policy set to the user address space of the object application process.

Optionally, the kernel can realize the above-mentioned communication after the mapped address through the auxiliary vector. Specifically, before the object application process is started, the kernel may write the memory address to which the target application policy set is mapped to the auxiliary vector of the executable file of the object application process. When the object application process is started, the auxiliary vector can be used to record the mapping address of the target application policy set (that is, the storage address on the object application process for storing application policies).

302. The object application process determines the first application policy between the subject application process and the first object according to the target application policy set in the user address space based on the access permission query requirement of the subject application process for the first object.

If the subject application process needs to access the first object on the object application process, then the object application process needs to query the access rights of the first object, and the object application process can query the access rights of the first object based on the requirements in the user address space The policy search is performed in the target application policy set, so as to determine the first application policy between the subject application process and the first object.

303. The object application process determines the access right of the subject application process to the first object according to the first application policy.

The subject in the first application policy is the subject application process that accesses the first object, and the object is the first object on the object application process. The object application process can determine the access of the subject application process to the first object according to the behavior of the first application policy permission. If the behavior of the first application policy is access, the subject application process can access the first object.

Optionally, the set of target application policies may be derived from parsing policy source files. In the embodiment of the present application, according to different parsing positions of the policy source file, the embodiments of the present application may include the following situations: 1. The policy source file is parsed by the kernel; 2. The policy source file is parsed by the application management process.

Next, the description will be expanded separately:

1. The policy source file is parsed by the kernel.

Fig. 4 is a schematic diagram of the access control method provided by the embodiment of the present application. The method for parsing the policy source file by the kernel is shown in Fig. 4. This method can be implemented based on the architecture shown in Fig. 1a, and the method includes:

1. The kernel reads the policy source file.

2. Kernel parses policy source files.

The kernel parses the policy source file to obtain a source policy set, which includes policies between all subjects and all objects. Wherein, the object may be resource and/or service; the location where the object is located may be the object application process.

When the object of the policy is an object running on the object application process in the user process space, the policy is called an application policy. The embodiment of the present application is used to avoid the context switch in the process of querying the access rights of the object application process, so it focuses on the application policy, so the application policy is called the policy of interest (POI), and the policy source file is called encoded POIs (ePOIs).

There are one or more POIs, so in this embodiment of the application, POIs are also referred to as an application policy set.

3. The kernel verifies the signature.

Before starting the object application process, the kernel can verify the validity of the executable file of the object application process by verifying the signature, so as to ensure that the executable file has not been tampered with. If the kernel verifies that the signature is valid, the subsequent steps are performed.

4. The kernel extracts policies according to the service mask.

The executable file includes the service mask of the guest application process. The service mask is used to identify the identifier (identifier, ID) of the POI in the source policy set. The kernel can determine the POI from the source policy set parsed in step 1 according to the service mask, and realize the screening of the application policy. . In this embodiment of the application, this step is also called extracting a policy.

Optionally, the service mask may be a 32-bit integer, and the service mask may identify the ID of the POI in the source policy set by means of or, matching ID, and the like. It should be noted that 32 bits is just an example of the number of bits in the service mask, and the service mask can be more or less bits, such as 16 bits, 64 bits, etc., which is not limited here.

As shown in Figure 5, before the object application process leaves the factory, the enterprise manager (Oracle Enterprise Manager, OEM) can use the service mask, signature (that is, the signature in step 3 of this embodiment) and the source executable file of the object application process Perform packaging to form an executable file of the object application process. Optionally, the service mask and signature information may be described in the header of the executable file.

Optionally, in addition to determining the service mask before leaving the factory, if there are new objects included in the object application process after leaving the factory, the service mask can also be modified after leaving the factory. In this case, the service mask can be modified by a trusted subject (such as the kernel) to ensure the accuracy of the service mask.

5. The kernel prepares the address space mapping strategy.

The kernel prepares a process address space for the object application process, and at the same time maps the memory address of the POI to the process address space.

6. The kernel assigns the auxiliary vector as the policy map address.

The kernel stores the mapping address information into the auxiliary vector, so as to transfer the mapping address information of the application policy to the object application process. Specifically, the auxiliary vector is a part of the executable file, and during the parsing process of the executable file, the auxiliary vector will be resolved to the above agreed address. Therefore, the kernel assigns the auxiliary vector as the mapping address of the POI, so that the information of the mapping address can be transferred through the auxiliary vector.

Exemplarily, as shown in FIG. 6 , an AT_POLICY vector may be added in a C standard library (C standard library, Libc), and the vector is used to write to a memory location reserved in the user address space.

Optionally, the AT_POLICY vector can reserve a vector array on the stack top of the object application process when creating the auxiliary vector table of the object application process. The vector array is the auxiliary vector, and each element (vector) in the vector array corresponds to An application policy, an AT_POLICY vector is an element in this array, and the AT_POLICY vector is used to indicate the address of the mapping location of the application policy in the user process space.

When the kernel creates the object application process, it can assign the mapping address of the application policy in the POI to AT_POLICY. When the application process queries the policy, it can obtain the mapping address of the target application policy set (POI) at the [AT_POLICY] position corresponding to the auxiliary vector on the top of the stack.

7. The kernel returns to the user address space.

After the kernel completes the above steps 1 to 6, it completes the mapping of the POI memory address to the auxiliary vector in the user address space of the object application process, so it can return to the user address space so that the application process can start and perform subsequent steps.

8. The object application process starts.

In the embodiment of the present application, after the object application process is started, the application process can query the access rights of the object.

9. The object application process obtains the policy mapping address through the auxiliary vector.

The object application process can obtain the mapping address through the auxiliary vector based on the access permission query requirement of the subject application process for the first object, and query the application policy that the subject is the subject application process and the object is the first object through the mapping address.

In the embodiment of the present application, the analysis of the policy source file is implemented through the kernel. Since the policy source file itself is stored on the kernel, the analysis speed is fast and the efficiency is high. Moreover, the kernel parsing and mapping are completed before the application process is started, and the policy can be queried immediately after the application process is started, which improves the efficiency of policy query.

2. The policy source file is parsed by the object application process.

In the above-mentioned method of parsing policy source files by the kernel, since the kernel parsing the policy source files will occupy kernel resources, the embodiment of the present application can transplant the action of parsing the policy source files to the object application process on the user space, so as to reduce the cost of the kernel. Performance overhead, improve the operating efficiency of the kernel.

FIG. 7 is a schematic flow diagram of an access control method provided in the embodiment of the present application. The method can be implemented through the architecture shown in FIG. 1b. As shown in FIG. 7, the method includes:

1. The kernel reads the policy source file ePOI.

2. The kernel verifies the signature.

When the object application process needs to be started, the kernel can verify the validity of the executable file of the object application process by verifying the signature, so as to ensure that the executable file has not been tampered with. If the kernel verifies that the signature is valid, the subsequent steps are performed.

3. The kernel extracts part of the policy source files corresponding to the object application process according to the service mask.

The executable file includes the service mask of the guest application process. The service mask is used to identify the identifier (identifier, ID) of the POI in the source policy set. The kernel can determine the part of the policy source file corresponding to the POI in the policy source file ePOI according to the service mask, so as to realize the screening of the application policy. In this embodiment of the application, this step is also called extracting a policy.

For the description of the service mask, refer to step 4 in FIG. 4 , which will not be repeated here.

4. The kernel prepares the address space for mapping ePOI.

The kernel prepares an address space for the object application process, and at the same time maps the memory address of the POI to the address space of the object application process.

5. The kernel assigns the auxiliary vector as the policy map address.

The kernel stores the mapping address information into the auxiliary vector, so as to transfer the mapping address information of the application policy to the object application process. For the specific process, refer to the description of step 6 in FIG. 4 , which will not be repeated here.

6. The kernel returns to the user address space.

7. The object application process starts.

For Step 6 and Step 7, refer to the description of Step 7 and Step 8 in FIG. 4 , which will not be repeated here.

8. The object application process obtains the policy mapping address through the auxiliary vector.

The object application process can obtain the mapping address from the auxiliary vector based on the query requirements of the subject application process for the access right of the first object, and determine the location of the application policy through the mapping address.

9. Object application process resolution policy ePOI→POI.

The object application process parses part of the policy source files in the ePOI corresponding to the POI determined in step 3, and obtains the POI. Since the kernel has prepared an address space in step 4 for mapping this part of the policy source file, the object application process can find the POI of the application according to the mapping in step 4, and parse and load it into the process address space (the source policy is mapped in step 4 file, so the object application process can find the source file through this mapping address, and then resolve it to its own user address space, and then query the policy from the source file parsed policy when querying the policy).

In the embodiment of the present application, the policy source file is parsed through the object application process, and the kernel is not required to parse the policy source file, which reduces the performance overhead of the kernel and improves the operating efficiency of the kernel.

3. The policy source file is parsed by the access control management process.

In the method shown in FIG. 7 , the application policy can only be queried after step 9 is executed, and each object application process needs to parse the ePOI into a POI before performing policy query. As shown in Fig. 8, both the object application process 1 and the object application process 2 need to parse the ePOI to the POI before performing the subsequent POI query operation, and the ePOI parsing will slow down the startup speed of each object application process.

In order to prevent each object application process from needing to parse the ePOI, this application implements a method that performs an ePOI parsing in the access control management process to obtain the source policy set, and then collects the application policy sets required by each object application process through shared memory Mapping to the user address space of the corresponding object application process in other user states to realize the mapping from the POI to the corresponding object application process. Therefore, multiple object application processes in the user mode only need to analyze the ePOI once, so as to ensure that all object application processes can query policies.

In this embodiment of the application, the access control management process is used to analyze and manage all application access control policies.

Fig. 9a is a schematic flowchart of an access control method provided by an embodiment of the present application, and the method can be implemented based on the architecture shown in Fig. 1c. As shown in Figure 9a, the specific steps of the method are as follows:

1. The kernel reads the policy source file ePOI.

2. The kernel verifies the signature.

The kernel verifies the signature of the source executable file of the object application process. The source executable file does not include the service mask. The function of signature verification is to verify the legitimacy of the access control management process.

3. The kernel maps the policy source file ePOI to the access control management process.

The kernel prepares to access the address space of the control management process, and maps the policy source file ePOI to it. The ePOI mapped here is a policy source file, which contains information about all policies.

4. The kernel transmits the mapping address information of the ePOI to the access control management process through the auxiliary vector.

The kernel stores the mapping address information of the ePOI into the auxiliary vector, thereby delivering the mapping address information of the ePOI to the access control management process. For the description of the auxiliary vector, refer to the description of step 6 in FIG. 4 , which will not be repeated here.

5. The kernel returns to the user address space.

6. The access control management process starts.

7. The access control management process obtains the mapping address of the ePOI through the auxiliary vector.

8. The access control management process parses the ePOI to obtain the source policy set.

The access control management process parses the ePOI to obtain the source policy set, and parses the source policy set into the process space of the access management process; please refer to Figure 9b, step 9 in Figure 9a corresponds to step ① in Figure 9b.

9. The access control management process determines the respective POIs of the object application processes (each object application process corresponds to one) according to the service IDs of the object application processes.

Optionally, after the object application process is started, the access control management process can obtain the configuration file of the object application process, thereby parsing the service mask in the configuration file of the object application process, and obtaining the target application policy set (POI) in the source policy set The policy ID (also referred to herein as the target ID, or service ID) in . The access control management process can determine the target application policy set (POI) from the source policy set according to the target identifier.

In this embodiment of the application, in addition to obtaining the policy ID of the POI of the object application process in the source policy set by parsing the service mask in the configuration file; the policy ID can also be obtained by other means, such as inter-process communication IPC, etc. There is no limit.

10. The access control management process loads the POI into the shared memory space of the corresponding object application process.

After the access control management process determines the target application policy set (POI), it can load the memory address of the target application policy set into the shared memory corresponding to the object application process, thereby mapping the target application policy set (POI) to the object application process corresponding shared memory. Optionally, this step may be performed by a policy parser on the access control management process, see step ② in FIG. 9b.

The shared memory space between the access control management process and each object application process is specified by a different shared memory file, and the shared memory file name corresponds to each object application process, which can be the app name or other unique identifier of each object application process , there is no restriction here.

11. The shared memory file corresponding to the object application process mapping.

The object application process finds the corresponding shared memory file according to their respective app names (or other unique identifiers), and maps the POI in the shared memory file to the user process space of the object application process. Wherein, the POI of the object application process is saved in the shared memory file. This step should be the step ③ in Figure 9b.

In this embodiment of the application, an access control management process is used to analyze all policies in the user state, and map the application policies of multiple object application processes, avoiding the need for each object application process when starting Policy analysis reduces system complexity.

As shown in FIG. 10 , the embodiment of the present application provides a policy query framework. The object application process is started by the system process, and after entering the kernel, the kernel uses a binary loader to load the executable file of the object application process. The header analyzer in the kernel analyzes the header mark of the executable file to see if there is a security marker for identity verification. The signature analyzer verifies the identity. If the identity is legal, the policy in the kernel is randomly mapped to the process address space, and the address information is passed to the object application process through the auxiliary vector. After the object application process is started, the memory can be quickly queried to obtain the access policy.

Optionally, if the kernel is a trusted computing base (trusted computing base, TCB), use the policy loading component to load and map the policy to the user address space of the object application process. This method can ensure trusted loading and policy security, and It avoids context switching of the kernel during policy query and reduces the performance overhead of the kernel.

Compared with the prior art, the access control method provided by the embodiment of the present application has the following advantages:

1. In the existing access control technology, the access isolation between the kernel and user mode applications is realized through privilege isolation, so each query strategy needs to go through privilege switching, that is, context switching is required.

The method in this embodiment of the application can query policies without privilege switching. Moreover, the mapping in the embodiment of the present application is implemented by the kernel, and the kernel belongs to the trusted base, which ensures the credibility of the policy mapping.

2. In a prior art, the policy manager server (PMS) running in the user space stores application policies related to the application process of the object to reduce context switching, but this method requires an information processing center (information processing center, IPC) and PMS communication can only be realized, and IPC performance loss cannot be avoided.

The method of the embodiment of the present application does not require IPC to communicate with the PMS, the policy can be directly mapped to the address space of the object application process, and no new privileged process is required.

3. In the prior art, the kernel needs to protect shared resources through atomic locks, and the performance is degraded under a symmetric multi-processing architecture (symmetric multi-processor, SMP).

In the method of the embodiment of the present application, each object application process has a mapping of the required application strategy locally, and the kernel does not need to protect shared resources through atomic locks, and the performance under SMP is improved.

The above describes the access control method provided by the embodiment of the present application, and the following describes the device provided by the embodiment of the present application.

Referring to FIG. 11 , an embodiment of the present application provides a computing device 1100, including a processor 1101 and a memory 1102; the processor 1101 is coupled to the memory 1102; the memory 1101 is used to store programs; the processor 1102 is used to execute the The program enables the processor 1102 to execute the access control methods described in FIG. 2 to FIG. 10 .

Please refer to FIG. 12 , the embodiment of the present application provides a chip 1200, the chip 1200 includes at least one processor 1201 and a communication interface 1202, the communication interface 1202 and at least one processor 1201 are interconnected by lines, and at least one processor 1201 is used for Running a computer program or instruction to implement the access control method corresponding to any one of the above-mentioned embodiments in FIG. 2 to FIG. 10 .

Wherein, the communication interface 1202 in the chip may be an input/output interface, a pin or a circuit, and the like.

In a possible implementation, the chip 1200 described above in this application further includes at least one memory 1203 , and instructions are stored in the at least one memory 1203 . The memory 1203 may be a storage unit inside the chip, such as a register, a cache, etc., or a storage unit of the chip (eg, a read-only memory, a random access memory, etc.).

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Claims

An access control method, characterized in that, comprising:

The kernel maps the memory address where the target application policy set is located to the user address space of the object application process, and the target application policy set is used to indicate the subject application process's access rights to objects on the object application process; wherein, the object including services and/or resources;

The object application process determines the first object between the subject application process and the first object according to the target application policy set mapped to the user address space based on the query requirement for the access right of the first object. application strategy;

The object application process determines the access authority of the subject application process to the first object according to the first application policy.
The method according to claim 1, wherein the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, including:

The kernel writes the memory address to which the target application policy set is mapped to the auxiliary vector in the executable file of the object application process.
The method according to claim 1 or 2, wherein the executable file of the object application process includes a service mask corresponding to the target application policy set;

Before the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, the method further includes:

The kernel parses the policy source file to obtain a source policy set;

The kernel determines the target application policy set from the source policy set according to the service mask, and the target application policy set is used to protect the object on the object application process.
The method according to claim 3, wherein the executable file further includes a signature of the executable file;

The kernel determines the target application policy set from the source policy set according to the service mask, including:

The kernel verifies the legality of the signature;

If the signature is valid, the kernel determines the target application policy set from the source policy set according to the service mask.
The method according to claim 3 or 4, wherein the service mask corresponding to the target application policy set is used to identify the target application policy set in the source policy set.
The method according to claim 1 or 2, wherein the executable file of the object application process includes a service mask corresponding to the target application policy set;

Before the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, the method further includes:

The kernel determines a part of policy source files corresponding to the target application policy set from the policy source files according to the service mask;

The method also includes:

The object application process parses the part of policy source files to the memory address to obtain the target application policy set.
The method according to any one of claims 1 to 6, wherein before the kernel maps the memory address where the target application policy set is located to the user address space of the object application process, the method further comprises:

The kernel randomizes addresses of the user address space of the guest application process.
An access control method, characterized in that the method comprises:

The kernel maps the memory address of the policy source file to the address space of the access control management process;

The access control management process parses the policy source file to obtain a source policy set;

The access control management process loads the target application policy set in the source policy set into the shared memory space of the object application process; wherein the target application policy set is used to determine the access of objects on the object application process authority;

The object application process maps the set of target application policies to a user address space of the object application process.
The method according to claim 8, wherein the access control management process loads the memory address of the target application policy set in the source policy set into the shared space corresponding to the object application process, including:

The access control management process parses the configuration file of the object application process, and obtains the target identifier of the target application policy set in the source policy set;

The access control management process determines the target application policy set from the source policy set according to the target identifier;

The access control management process loads the target application policy set into the shared memory corresponding to the object application process.
A computing device, comprising a processor and a memory; the processor is coupled to the memory;

The memory is used to store programs;

The processor is configured to execute the program in the memory, so that the processor executes the access control method according to any one of claims 1-9.
A computer-readable storage medium, characterized in that the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes any one of claims 1 to 9. method described in the item.
A computer program product, characterized in that the computer program product comprises: computer program code;

When the computer program code is executed, the method according to any one of claims 1 to 9 is realized.
A chip, characterized in that it includes at least one processor and an interface;

said interface for providing program instructions or data to said at least one processor;

The at least one processor is configured to execute the program instructions to implement the method as claimed in any one of claims 1-9.
A server, characterized by comprising the chip according to claim 13.