CN102663321B - For security enhancement system and the method for software - Google Patents

Abstract

The invention discloses a security enhancement system for software, which includes: a configuration module used to configure the security attributes of the subject of the software and the object of the software; a filter module used for Filtering the subject's access to the object according to a predetermined policy and the security attribute; an access module, configured to call the object processed by the filtering module. The invention conforms to the principle of minimum authority, can ensure the possibility of enhancing software security, and has high versatility. The invention also discloses a safety enhancement method for software.

Description

Security enhancement system and method for software

technical field

The invention relates to the technical field of computer networks, in particular to a security enhancement system and method for software.

Background technique

At present, WindowsXp and IE are still the mainstream operating systems and browsers used by most Internet users. The security access control mechanism of WindowsXp itself has its natural defects. For the operation of ordinary users, many functions are unavailable or even unable to start, so most users run with the highest administrator privileges when using the WindowsXp system, so that as long as the code or plug-in in the browser or other software has a loophole, the entire The system will be controlled by a Trojan horse. And the security protection of the user state is basically meaningless, because it is easy to be broken through. For example, the hook technology in the user state is easily restored or directly bypassed.

The traditional Windows security access control mechanism can be considered as the ACL (AccessControlList, access control list) access control to WindowsXp itself. In the security access control mechanism of Windows, there are two objects: one is the subject, which has an access token (token) describing the permissions it has; the other is the object, which has a security token describing the subject's operational permissions. Descriptor (SECURITY_DESCRIPTOR). Table 1 shows the structure of the access token (subject).

token source imitation type Token ID Authentication ID Modify ID Expiration default main group default DACL user account SID Group 1 SID ······ group n SID Restricted SID1 ······ Restricted SIDn Privilege 1 ······ privilege n

Table 1

Table 2 shows the structure of the security descriptor (object).

Table 2

WindowsXp includes two forms of access control: discretionary access control and privileged access control.

(1) Discretionary access control: The owner of the object (such as a file) authorizes or denies others access to these objects. When users log into a Windows system, they are given a set of security credentials (access tokens). When they try to access an object, the system compares their security credentials with the access control list (DACL) on the object they want to access to determine whether the user is allowed to access the object object. Among them, the security attribute of the object object, that is, the security descriptor, can be freely configured by the user.

(2) Privileged access control:

A privilege is an account's right to perform certain system-related operations, such as shutting down a computer or changing the system's time. Many operations performed by a process during running cannot be authorized and controlled through object access control, because these operations do not deal with a specific object. Privileged information is kept in principal (process) security credentials (access token). Different privileges are defined by and enforced by different components. For example, debugging privileges are checked by the process manager, which enables a process to bypass security checks (discretionary access control) when using the Windows API function OpenProcess to open a handle to another process.

In addition, although Microsoft's mandatory access control mechanism MIC (MandatoryIntegrityControl), although it has strengthened the security of Windows to a large extent, this mechanism is only applicable to systems after WindowsVista, not suitable for WindowsXp systems with higher popularity.

To sum up, the security mechanism of Windows XP itself has many limitations, mainly in the following two points:

(1) Abuse of authority

Windows user processes are typically interactive processes created by users. After the identity authentication is passed, LSA (Local Security Authority Subsystem) generates a login session and an access token for the user, and then the login process starts a Shell for the user, usually the Explorer.exe process. This process owns the user's token and will perform all work as that user. When a user calls CreateProcessAPI to start a new process, the process inherits the token from the Explorer.exe process.

Therefore, most user processes of the same user have access tokens that result in the same access rights to the same subject object. Having the same access rights for user processes with well-defined and distinct functions often leads to abuse of rights.

(2) Permissions are illegally elevated

The use of privileges and privileged processes can lead to illegal elevation of privileges. As mentioned earlier, privileges can bypass discretionary access control. For example, the SeLoadDriverPrivilege privilege can be used to load the driver program, and the driver program runs as a System high-privilege account, resulting in the privilege being elevated; using the SeDebug privilege can open any process in the system to inject remote threads; use the list to obtain the object object access rights.

Improper permission settings lead to illegal elevation of permissions. Because third-party software and users are not security experts, it is common for privilege settings to be expanded, which can also lead to elevated privileges. Use the SeTakeOwnership privilege to take ownership of any protected object, and then modify discretionary access control. The reason for the above defects is that in the Windows access control mechanism, different processes of the same user have the same access token, that is, have the same access rights. In discretionary access control, the security attribute of the object is completely determined by the object owner, that is, the access authority of the object can be modified arbitrarily, but the user often cannot accurately set the object security attribute. All in all, the current Windows access control mechanism does not abide by the principle of least privilege. For the mandatory access control mechanism MIC that appeared after Windows Vista, although the security and ease of use are already very strong, it is only effective for systems after Vista, which will not work for most users who are still using Windows XP . And the scope of this mechanism is still too large to be arbitrarily configured.

Contents of the invention

The purpose of the present invention is to solve at least one of the above-mentioned technical drawbacks.

The first object of the present invention is to provide a security enhancement system for software, which conforms to the principle of least authority, can ensure the possibility of enhancing software security, and has high versatility. A second object of the present invention is to provide a security enhancement method for software.

In order to achieve the above object, the embodiment of the first aspect of the present invention proposes a security enhancement system for software, including: a configuration module, the configuration module is used to configure the security of the subject of the software and the object of the software attribute; a filtering module, which is used to filter the subject's access to the object according to a predetermined policy and the security attribute; an access module, which is used to process the object after being processed by the filtering module object to call.

The security enhancement system for software according to the embodiment of the present invention can ensure the feasibility and security of the system, and use the advanced system architecture to ensure the portability of the system, which is more in line with the principle of minimum authority, and the authority is from the top Downward flow is strictly controlled. Moreover, under the premise of ensuring that the program works normally, the present invention can still obtain very good security control, with finer control granularity, stronger security and strong versatility.

The embodiment of the second aspect of the present invention provides a security enhancement method for software, including the following steps:

configure the security attributes of the subject and object of the software;

filtering the subject's access to the object according to a predetermined policy and the security attributes; and

A call is made to the filtered object.

The security enhancement method for software according to the embodiment of the present invention can ensure the feasibility and security of the system, and use the advanced system architecture to ensure the portability of the system, which is more in line with the principle of minimum authority, and the authority is from the top Downward flow is strictly controlled. Moreover, under the premise of ensuring that the program works normally, the present invention can still obtain very good security control, with finer control granularity, stronger security and strong versatility.

Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of drawings

The above and/or additional aspects and advantages of the present invention will become apparent and easy to understand from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

1 is a schematic diagram of a security enhancement system for software according to an embodiment of the present invention;

FIG. 2 is an architecture diagram of a security enhancement system for software according to an embodiment of the present invention;

3 is a flowchart of a method for enhancing security of software according to an embodiment of the present invention;

4 is an overall schematic diagram of a security enhancement method for software according to an embodiment of the present invention;

Fig. 5 is a flow chart of the software starting the main process for the first time according to an embodiment of the present invention;

FIG. 6 is a flow chart of starting a main process according to an embodiment of the present invention;

FIG. 7 is a flow chart of creating a restricted subprocess according to an embodiment of the present invention;

FIG. 8 is a flowchart of obtaining an access control notification according to an embodiment of the present invention;

Fig. 9 is the flow chart that captures subprocess creation according to the embodiment of the present invention; And

Fig. 10 is a control flow chart of a controlled sub-process according to an embodiment of the present invention.

detailed description

Embodiments of the present invention are described in detail below, examples of which are shown in the drawings, wherein the same or similar reference numerals designate the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, components and arrangements of specific examples are described below. Of course, they are merely examples and are not intended to limit the invention. Furthermore, the present invention may repeat reference numerals and/or letters in different instances. This repetition is for the purpose of simplicity and clarity and does not in itself indicate a relationship between the various embodiments and/or arrangements discussed. In addition, various specific process and material examples are provided herein, but one of ordinary skill in the art will recognize the applicability of other processes and/or the use of other materials. Additionally, configurations described below in which a first feature is "on" a second feature may include embodiments where the first and second features are formed in direct contact, and may include additional features formed between the first and second features. For example, such that the first and second features may not be in direct contact.

In the description of the present invention, it should be noted that unless otherwise specified and limited, the terms "installation", "connection" and "connection" should be understood in a broad sense, for example, it can be a mechanical connection or an electrical connection, or it can be two The internal communication of each element may be directly connected or indirectly connected through an intermediary. Those skilled in the art can understand the specific meanings of the above terms according to specific situations.

These and other aspects of embodiments of the invention will become apparent with reference to the following description and drawings. In these descriptions and drawings, some specific implementations of the embodiments of the present invention are specifically disclosed to represent some ways of implementing the principles of the embodiments of the present invention, but it should be understood that the scope of the embodiments of the present invention is not limited by this limit. On the contrary, the embodiments of the present invention include all changes, modifications and equivalents coming within the spirit and scope of the appended claims.

A security enhancement system for software according to an embodiment of the present invention will be described below with reference to FIGS. 1 and 2 . The security enhancement system provided by the embodiment of the present invention properly integrates mandatory integrity control, mandatory access control and autonomous access control, and introduces them into the software security control process. In one example of the present invention, the software may be a browser or other application client.

As shown in FIG. 1 , a security enhancement system 1000 for software provided by an embodiment of the present invention includes: a configuration module 100 , a filter module 200 and an access module 300 . The security enhancement system for software in the embodiment of the present invention is applicable to operating systems such as WindowsXp, WindowsVista, and Windows7.

The configuration module 100 is used to configure the security attributes of the subject of the software and the object of the software. In one embodiment of the present invention, the main body includes the main process and thread of the software, the restricted sub-processes and threads created by the software, the sub-processes and threads of the software that require privilege escalation, and other sub-processes and threads for privilege escalation. Objects include objects that the software needs to call.

In one example of the present invention, the object is an entity that is passively accessed. Wherein, the entities that passively accept access may include files, registry, processes and other windows kernel objects.

In yet another embodiment of the present invention, the security attribute of the object may be a whitelist of the object, that is, the configuration module 100 configures the whitelist of the object. Wherein, the objects recorded on the white list are objects that can bypass the ACL enhanced security check of the security enhancement system for software of the present invention, and the subject can arbitrarily access or create the objects in the white list. Wherein, the white list of the object can be adjusted according to the needs of the subject.

In the embodiment of the present invention, the configuration module 100 can set the whitelist by reloading configuration items, adding new objects, or adjusting security attributes of objects through the DeviceIoControl command. Wherein, the objects in the white list are identified by the security attributes of the objects.

The filtering module 200 is used to filter the subject's access to the object according to predetermined policies and security attributes. Specifically, the filtering module 200 filters processes whose process ids do not match the subject. In an embodiment of the present invention, there may be multiple filtering modules 200, each corresponding to the subject's access to different objects for filtering. For example: ObjectHook filter module (ObjectHookFilter), used to filter the subject's access to ObjectHook; registry filter module (RegFilter), used to filter subject's access to the registry; file filter module (FileFilter), used for subject Filter access to files. It can be understood that the various types of filtering modules mentioned above are only for the purpose of illustration, rather than limiting the present invention. The filtering module 200 may also include other types of filtering modules to filter the subject's access to other objects.

The access module 300 is used for invoking the object processed by the filtering module 200 , that is, invoking the object filtered by the filtering module 200 . Specifically, the interface of the access module 300 can be invoked by each filtering module 200, and the final decision on the subject's access right to the object is made through role level check and scene access right check. According to the final decision, deny the subject's access to the object or agree to the subject's access to the object.

In one embodiment of the present invention, if the object is in the white list, the access module 300 allows the subject to access the object, otherwise, it decides whether the subject can access the object according to the security attributes of the subject and the object. It can be understood that the configuration module 100 can adjust the white list of the object according to the needs of the subject.

As shown in Figure 2, the security enhancement system 1000 for software provided by the embodiment of the present invention also includes a subject manager, an object manager, a configuration manager, a filter manager, an ACL manager, an access control asynchronous notification module, Ring0 Device control module. Among them, the subject manager is used to manage the subject, and the object manager is used to manage the object. Specifically, the subject manager can store, query, add and delete subjects. The object manager can store, query, add and delete objects.

The filter manager is used to set the way to filter the access of Windows to the object, and the filter manager can control the enabling and stopping of the specified filter module (Filter), and the dynamic adding function of the Filter. In one example of the invention, a filter manager may be a singleton.

The configuration module 100 re-adds the object by calling the interface of the object manager. And the configuration module 100 can add a method of the main process body of the software when the software starts for the first time, and the method can be called by the process corresponding to the filtering module 200 .

The interface of the access module 300 implements the query of the security attributes of the subject and object objects by calling the interfaces of the subject manager and the object manager.

The device control asynchronous notification module uses the Windows asynchronous overlapping IO interface to send the access control notification to the main process of the software, such as the main process of the browser. The main process of the software gets access control notifications. It should be noted that the main software process can only obtain notifications from process groups related to itself.

In one embodiment of the present invention, the access control notification may be an asynchronous notification queue. Wherein, the asynchronous notification queue is related to the main process. In other words, each software's main process includes an independent asynchronous notification queue.

The ACL manager is used to provide the function of creating an object ACL for internal use, adding, deleting and querying ACE (Access Control Entry) and SID (SecurityIdentifiers, security identifier) related operations.

The Ring0 device control module can realize most of the external system interfaces, and is responsible for receiving the control of the above-mentioned configuration module 100, filter module 200 and access module 300, realizing configuration reloading, subject RoleLevel fine-tuning and object addition. Among them, the configuration module 100, the filter module 200 and the access module 300 correspond to the Ring3ACL enhancement function. Among them, Ring0 represents the kernel state, and Ring3 represents the user state.

The function of each module of the security enhancement system 1000 for software according to the embodiment of the present invention will be described below with reference to FIG. 2 .

Send the DeviceIoControl control code to the Ring0 device control module. After the Ring0 device control module receives the "load configuration" control code, the Ring0 device control module calls the configuration module 100 to read the configuration from the memory or the registry. If it is a file configuration, the configuration module 100 calls the data decryption and integrity check submodule to verify the configuration file. The configuration file is read by the data decryption and integrity check submodule.

In an embodiment of the present invention, the data decryption and integrity checking submodule may use MD5 (MessageDigestAlgorithm MD5, message digest algorithm fifth edition) algorithm or Sha1 (SecureHashAlgorithm, secure hash algorithm) algorithm.

In one embodiment of the present invention, the configuration file read by the data decryption and integrity checking submodule is an encrypted file, including the security information of the subject and the security information of the object.

After obtaining the configuration, the configuration module 100 invokes the object manager interface to create related objects, including the security attributes of the created objects. Currently, the objects are stateless. The object manager calls the ACL manager's interface to initialize the object's security attributes. The access module 300 queries related object security information through the object manager interface, and the access module 300 can query related subject security information through the subject manager interface. The filtering manager calls the access module 300 to make related decisions. The access module 300 generates an asynchronous notification of access control by calling an interface of asynchronous notification of access control. The Ring0 device control module obtains the access control asynchronous notification from the access control asynchronous notification module.

In one embodiment of the present invention, the security enhancement system 1000 for software in the embodiment of the present invention further includes an auxiliary function module for generating log information and other auxiliary functions.

According to the security enhancement system for software in the embodiment of the present invention, a kernel driver is implemented to strengthen the ACL security access check mechanism of Windows more carefully and accurately. The present invention can be applied to browsers. While enhancing the security of browsers during use, it does not affect the normal use of users, and cooperates with user state programs to establish a multi-layer three-dimensional defense system to improve the success of defending against malicious program damage. rate, further reducing the risk of security breaches, and making up for the deficiencies of the original security mechanism. Specifically, the security enhancement system for software in the embodiment of the present invention has the following characteristics:

(1) Using relatively mature security theories and systems (access control, mandatory integrity control) as the basis to ensure the feasibility of the system.

(2) Taking WRK (Windows Open Source Kernel) as a reference base to ensure the reliability and stability of the system.

(3) Loosely coupled design and data structure with low system correlation are adopted, and the functions of each functional module are as single as possible, and have reusability, which is easy to plug and connect, so that it can be compatible with higher version Windows or 64-bit Windows operating system The possibility of transplantation ensures portability.

(4) Fully consider the high frequency of system resource access, and adopt a series of technical means, such as HASHTABLE, cache backup pool, and efficient resource read-write lock synchronization, etc., to ensure the high performance of the system.

(5) It is more in line with the principle of least privilege. Specifically, the owner of the resource cannot change the security attributes of the object, which avoids the defects of the Windows security mechanism (abuse of permissions and illegal promotion of permissions), and only the main process of the software (high-privilege process) can adjust the security attributes of the host and object. . Permissions flow from top to bottom with strict controls.

Under the premise of ensuring the normal operation of third-party sub-processes (such as Acrobatreader, Flashplayer, etc.), the third-party sub-processes can still be controlled to prevent the third-party sub-process vulnerabilities from being maliciously exploited. That is, the enhanced control granularity of Ring0ACL is finer and the security is stronger. Thereby, the possibility of enhancing browser security is ensured.

(6) A security module suitable for various clients, with high versatility.

The security enhancement method for software in the embodiment of the present invention will be described below with reference to FIG. 3 to FIG. 10 . The security enhancement method for software in the embodiment of the present invention is applicable to operating systems such as WindowsXp, WindowsVista, and Windows7.

As shown in Figure 3, the security enhancement method for software of the embodiment of the present invention includes the following steps:

S301: Configure the security attributes of the subject and object of the software.

In one embodiment of the present invention, the main body includes the main process and thread of the software, the restricted sub-processes and threads created by the software, the sub-processes and threads of the software that require privilege escalation, and other sub-processes and threads for privilege escalation. Objects include objects that the software needs to call.

In the embodiment of the present invention, the object is an entity that passively accepts access. Wherein, the entities that passively accept access may include files, registry, processes and other windows kernel objects.

In yet another embodiment of the present invention, the security attribute of the object may be a white list of the object. Wherein, the objects recorded on the white list are objects that can bypass the inspection of the security enhancement method for software of the present invention, and the subject can arbitrarily access or create the objects in the white list.

In the embodiment of the present invention, the white list can be set by reloading configuration items, adding new objects, or adjusting security attributes of objects through the DeviceIoControl command. Wherein, the objects in the white list are identified by the security attributes of the objects.

S302: Filter the subject's access to the object according to predetermined policies and security attributes.

Specifically, the subject's access to the object is filtered according to predetermined policies and security attributes, including filtering processes whose process id does not match the subject. According to the different objects, the corresponding subject can filter the access to different objects. For example: ObjectHook filtering corresponds to filtering the subject's access to different object objects; registry filtering corresponds to filtering the subject's access to the registry; file filtering corresponds to the subject's access to files.

S303: Call the filtered object.

Specifically, the final decision on the subject's access right to the object is made through the check of the role level and the scene access right, and the object is called according to the final decision. As shown in Figure 4, it is judged according to the final decision to deny the subject's access to the object or to agree to the subject's access to the object.

In one embodiment of the present invention, if the object is in the white list, the subject is allowed to access the object; otherwise, it is determined whether the subject can access the object according to the security attributes of the subject and the object. It can be understood that the white list of objects can be adjusted according to the needs of the subject.

Referring to FIG. 5 , the process of starting the main process for the first time by the software will be described below. Wherein, the software is described by taking a browser as an example. Wherein, the security enhancement process from step S301 to step S303 in the above embodiment of the present invention is a kernel driver. Therefore, when the software (such as a browser) starts for the first time, the driver and configuration items need to be loaded.

S501: The user logs in to the browser and starts the main process for the first time.

S502: Enabling the ACL to enhance the Ring0 function.

S503: The browser main process adjusts the default security attributes of its own subject through DeviceIoControl.

S504: The browser main process reloads the configuration item through DeviceIoControl, and initializes the security attribute of the object.

In one embodiment of the present invention, the security attributes of the initialization object include a global whitelist of the initialization object.

S505: The browser main process adjusts the security attribute of the object.

In one embodiment of the present invention, the browser main process adjusts the security attributes of the object to include a custom white list. Specifically, adjust the whitelist according to the needs of the subject.

It should be noted that step S505 is an optional step. If the browser main process does not need to adjust the security attributes of the object, this step is skipped.

After the software is started for the first time, close the software and start the software again, the above drivers do not need to be loaded. Because the driver is resident, it can be loaded for the first time. At this point, the main process of the software only needs to modify the response information to the driver. The flow of starting the software main process will be described below with reference to FIG. 6 .

S601: The browser main process is started.

S602: The browser main process adjusts the default security attribute of its own subject through DeviceIoControl.

S603: The main browser process adjusts the security attributes of the child processes.

S604: The browser main process adjusts the security attribute of the object.

In one embodiment of the present invention, the browser main process adjusts the security attributes of the object to include a custom white list. Specifically, adjust the whitelist according to the needs of the subject.

It should be noted that steps S603 and S604 are optional steps. If the browser main process does not need to adjust the security attributes of the child process and the object, skip the corresponding steps.

The security enhancement process from step S301 to step S303 in the above embodiment needs to be restricted according to the process, so the creation of the restricted sub-process needs to notify the driver. The flow of creating a restricted sub-process will be described below with reference to FIG. 7 .

S701: The browser main process sets the default security attribute of the next main subprocess to be created through DeviceIoControl.

S702: The browser main process creates a restricted sub-process or a privilege-escalating sub-process.

S703: The main browser process adjusts the security attributes of the child processes.

It should be noted that step S703 is an optional step. If the main browser process does not need to adjust the security attributes of the child process, skip this step.

According to debugging and performance testing requirements, access control notifications need to be obtained. The flow of obtaining the access control notification will be described below with reference to FIG. 8 .

S801: The browser main process starts an access control notification acquisition thread.

S802: The access control notification acquisition thread reads the access control notification through asynchronous IO.

S803: The browser main process displays the access control notification.

In the above-mentioned security enhancement kernel, the child process creation can be caught automatically, so as to decide whether to allow the creation and set the default security attributes. Referring to FIG. 9, the flow of capturing subprocess creation will be described below.

S901: The Filter process captures creation of related sub-processes.

S902: Search for an associated subject of the ID of the related subprocess. If it can be found, perform related cleaning work.

S903: Determine whether the child process can be created according to the object whitelist and the security attributes of the subject and object.

S904: If possible, the Filter process sets the security attribute of the current controllable sub-process according to the default security attribute or the whitelist security attribute of the next sub-process.

The control flow of the controlled sub-process will be described below with reference to FIG. 10 .

S1001: The browser main body (controlled sub-process) accesses object resources when browsing the Web.

S1002: The Filter process captures the opening or creating access of the object by the browser subject.

S1003: First look up the object whitelist, and if the object is in the whitelist, allow the subject to access.

If the object in the whitelist is a process, the object can still become a controlled child process after it is created.

S1004: If it is not an object in the whitelist, judge whether the subject can access the object according to the security attributes of the subject and the object.

According to the security enhancement method for software in the embodiment of the present invention, a kernel driver is implemented to strengthen the ACL security access check mechanism of Windows more carefully and accurately. The present invention can be applied to browsers. While enhancing the security of browsers during use, it does not affect the normal use of users, and cooperates with user state programs to establish a multi-layer three-dimensional defense system to improve the success of defending against malicious program damage. rate, further reducing the risk of security breaches, and making up for the deficiencies of the original security mechanism. Specifically, the security enhancement method for software in the embodiment of the present invention has the following characteristics:

(1) Using relatively mature security theories and systems (access control, mandatory integrity control) as the basis to ensure the feasibility of the system.

(2) Taking WRK (Windows Open Source Kernel) as a reference base to ensure the reliability and stability of the system.

(3) Loosely coupled design and data structure with low system correlation are adopted, and the functions of each functional module are as single as possible, and have reusability, which is easy to plug and connect, so that it can be compatible with higher version Windows or 64-bit Windows operating system The possibility of transplantation ensures portability.

(4) Fully consider the high frequency of system resource access, and adopt a series of technical means, such as HASHTABLE, cache backup pool, and efficient resource read-write lock synchronization, etc., to ensure the high performance of the system.

(5) It is more in line with the principle of least privilege. Specifically, the owner of the resource cannot change the security attributes of the object, which avoids the defects of the Windows security mechanism (abuse of permissions and illegal promotion of permissions), and only the main process of the software (high-privilege process) can adjust the security attributes of the host and object. . Permissions flow from top to bottom with strict controls.

Under the premise of ensuring the normal operation of third-party sub-processes (such as Acrobatreader, Flashplayer, etc.), the third-party sub-processes can still be controlled to prevent the third-party sub-process vulnerabilities from being maliciously exploited. That is, the enhanced control granularity of Ring0ACL is finer and the security is stronger. Thereby, the possibility of enhancing browser security is ensured.

(6) A security module suitable for various clients, with high versatility.

Any process or method descriptions in flowcharts or otherwise described herein may be understood to represent modules, segments or portions of code comprising one or more executable instructions for implementing specific logical functions or steps of the process , and the scope of preferred embodiments of the invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including substantially concurrently or in reverse order depending on the functions involved, which shall It is understood by those skilled in the art to which the embodiments of the present invention pertain.

The logic and/or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced listing of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium, For use with instruction execution systems, devices, or devices (such as computer-based systems, systems including processors, or other systems that can fetch instructions from instruction execution systems, devices, or devices and execute instructions), or in conjunction with these instruction execution systems, devices or equipment for use. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use in or in conjunction with an instruction execution system, device or device. More specific examples (non-exhaustive list) of computer-readable media include the following: electrical connection with one or more wires (electronic device), portable computer disk case (magnetic device), random access memory (RAM), Read Only Memory (ROM), Erasable and Editable Read Only Memory (EPROM or Flash Memory), Fiber Optic Devices, and Portable Compact Disc Read Only Memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program can be printed, since the program can be read, for example, by optically scanning the paper or other medium, followed by editing, interpretation or other suitable processing if necessary. The program is processed electronically and stored in computer memory.

It should be understood that various parts of the present invention can be realized by hardware, software, firmware or their combination. In the embodiments described above, various steps or methods may be implemented by software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques known in the art: Discrete logic circuits, ASICs with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

Those of ordinary skill in the art can understand that all or part of the steps carried by the methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. During execution, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, each unit may exist separately physically, or two or more units may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. If the integrated modules are realized in the form of software function modules and sold or used as independent products, they can also be stored in a computer-readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications and substitutions can be made to these embodiments without departing from the principle and spirit of the present invention. and modifications, the scope of the invention is defined by the appended claims and their equivalents.

Claims (10)

1. for a security enhancement system for software, it is characterized in that, comprising:

Configuration module, described configuration module is for the security attribute of the object of the main body and described software that configure described software, wherein, the security attribute of the main body and object that configure described software comprises the white list configuring described object, wherein, described main body comprises subprocess and the thread that the host process of described software and thread, the limited subprocess of described software creation and thread and described software need to put forward power, and described object comprises the object that described software needs call;

Filtering module, described filtering module is used for filtering the access of described main body to described object according to predetermined policy and described security attribute; And

Access modules, described access modules is used for calling the described object after described filtering module process, wherein, if described object is arranged in white list, then described access modules agrees to the access of described main body to described object, if described object is not arranged in white list, then according to the security attribute of described main body and described object, described access modules determines whether described main body can access described object.

2. system according to claim 1, is characterized in that, described object is passive entity of accepting the interview.

3. system according to claim 2, is characterized in that, described passive entity of accepting the interview comprises file, registration table and process.

4. system according to claim 1, is characterized in that, described access modules needs according to described main body the white list adjusting described object.

5. system according to claim 1, is characterized in that, process id and the unmatched process of described main body filter by described filtering module.

6., for a security Enhancement Method for software, it is characterized in that, comprise the following steps:

Configure the main body of described software and the security attribute of object, wherein, the security attribute of the main body and object that configure described software comprises the white list configuring described object, wherein, described main body comprises subprocess and the thread that the host process of described software and thread, the limited subprocess of described software creation and thread and described software need to put forward power, and described object comprises the object that described software needs call;

The access of described main body to described object is filtered according to predetermined policy and described security attribute; And

Described object after filtering is called, wherein, if described object is arranged in white list, then agree to the access of described main body to described object, if described object is not arranged in white list, then determine whether described main body can access described object according to the security attribute of described main body and described object.

7. method according to claim 6, is characterized in that, described object is passive entity of accepting the interview.

8. method according to claim 7, is characterized in that, described passive entity of accepting the interview comprises file, registration table and process.

9. method according to claim 6, is characterized in that, needs according to described main body the white list adjusting described object.

10. method according to claim 6, is characterized in that, filters the access of described main body to described object comprise and process id and the unmatched process of described main body being filtered according to predetermined policy and described security attribute.