WO2020114342A1 - Kernel security check method, apparatus, and device, and storage medium - Google Patents

Abstract

The present invention provides a kernel security check method, apparatus, and device, and a storage medium. On the use path of a process permission credential set, a current process permission credential set is compared with a pre-stored process permission credential set, the process permission credential set comprising information related to process permission; whether the current process permission credential set is maliciously modified is determined according to the comparison result. Thus, by checking the integrity of a process permission credential set on the path, the invention makes it difficult for an attacker to bypass although the check time is delayed compared with a real attack.

Description

Kernel safety detection method, device, equipment and storage medium

This application requires the priority of the Chinese patent application submitted on December 07, 2018 with the application number 201811495107.2 and the invention titled "Kernel Security Detection Method, Device, Equipment, and Storage Media", the entire contents of which are incorporated by reference in this application .

Technical field

The present invention relates to the field of kernel security, and in particular to a kernel security detection method, device, equipment, and storage medium.

Background technique

In recent years, the application range of Linux systems has been continuously expanded, and it has been widely used in the fields of servers, desktops, and embedded devices. With the popularization and use of Linux systems around the world, the security issues of the system have also received increasing attention.

At present, attackers mainly obtain higher authority than themselves through kernel vulnerabilities, and then use this authority to perform further harm to the system to achieve its purpose. The existing kernel protection scheme mainly divides the kernel cred structure into read-only and writable parts for protection, but the pointer of the cred structure (not the structure itself) is stored in the kernel process structure, although it is critical to cred The data forms a read-only protection, but if the pointer of cred in the process structure is modified, the scheme can be bypassed.

Therefore, a more effective kernel safety detection scheme is needed.

Summary of the invention

An object of the present invention is to provide a more effective kernel security detection method, device, equipment and storage medium to enhance kernel security.

According to the first aspect of the present invention, a kernel security detection method is provided, which includes: comparing the current process authority credential set with a pre-stored process authority credential set on the usage path of the process authority credential set, the process authority credential The set includes information related to process permissions; and according to the comparison result, it is determined whether the current process permission credential set is maliciously modified.

Optionally, the step of comparing the current process authority voucher set with the pre-stored process authority voucher set includes: calculating the hash value of the current process authority voucher set on the usage path of the process authority voucher set to obtain the first hash Hope; compare the first hash value with the second hash value, where the second hash value is obtained by hashing the pre-stored set of process authority credentials.

Optionally, the step of determining whether the current process authority credential set is maliciously modified includes: in the case where the first hash value and the second hash value are inconsistent, it is determined that the process authority credential set is maliciously modified.

Optionally, the method further includes: in response to modifying the set of process authority credentials in a secure manner, calculating a hash value for the modified set of process authority credentials to obtain a second hash value.

Optionally, the pre-stored process authority credential set is a process authority credential set obtained by modifying the process authority credential set based on the security method before.

Optionally, the security method is to call a standard interface function corresponding to the set of process authority credentials.

Optionally, the process authority credential set includes at least one of the following: group ID; user ID; effective user ID; capabilities; security pointer; security context; current process authority credential set address; startup random number.

Optionally, comparing the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set includes: at the system call entry, the current process authority credential set and the pre-stored process authority credential are included Set comparison; and/or compare the current process authority credential set with the pre-stored process authority credential set when the fork/exec function is executed.

According to the second aspect of the present invention, there is also provided a kernel security detection device, comprising: a comparison module for comparing the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set For comparison, the process authority credential set includes information related to the process authority; and the judgment module is used to judge whether the current process authority credential set is maliciously modified according to the comparison result.

Optionally, the comparison module includes: a first calculation module for calculating the hash value of the current process authority credential set on the usage path of the process authority credential set to obtain a first hash value; a comparison submodule for The first hash value is compared with the second hash value, where the second hash value is obtained by hashing the pre-stored set of process authority credentials.

Optionally, when the first hash value and the second hash value are inconsistent, the judgment module determines that the process authority credential set is maliciously modified.

Optionally, the device further includes: a second calculation module, configured to calculate a hash value for the modified process authority credential set in response to modifying the process authority credential set in a secure manner to obtain a second hash value.

Optionally, the pre-stored process authority credential set is a process authority credential set obtained by modifying the process authority credential set based on the security method before.

Optionally, the security method is to call a standard interface function corresponding to the set of process authority credentials.

Optionally, the process authority credential set includes at least one of the following: group ID; user ID; effective user ID; capabilities; security pointer; security context; current process authority credential set address; startup random number.

Optionally, the comparison module compares the current process authority credential set with the pre-stored process authority credential set at the system call entry, and/or the comparison module compares the current process authority credential set with the pre-stored process when the fork/exec function is executed Compare the set of authority credentials.

According to a third aspect of the present invention, there is also provided a computing device, including: a processor; and a memory on which executable code is stored, and when the executable code is executed by the processor, the processor is executed as in the present invention The method mentioned in the first aspect.

According to the fourth aspect of the present invention, there is also provided a non-transitory machine-readable storage medium on which executable code is stored, and when the executable code is executed by the processor of the electronic device, the processor is executed as The method mentioned in the first aspect of the invention.

The invention is based on the scenario where the process authority credential set is used in the kernel, and finds a path that is difficult to be bypassed after the attacker modifies the process authority credential set, and performs integrity detection on the process authority credential set. For example, the passive check of fork/exec can be based on system calls. Although the timing of the check is delayed for a relatively real attack, it is difficult for the attacker to bypass it.

BRIEF DESCRIPTION

The above and other objects, features, and advantages of the present disclosure will become more apparent by describing the exemplary embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. In the exemplary embodiments of the present disclosure, the same reference numerals generally represent The same parts.

Figure 1 shows a schematic diagram of the data structure of the kernel structure of the process.

FIG. 2 is a schematic flowchart illustrating a kernel security detection method according to an embodiment of the present invention.

Figure 3 shows a schematic diagram of the fields added to the hash calculation.

FIG. 4 is a schematic block diagram showing the structure of a kernel security detection device according to an embodiment of the present invention.

FIG. 5 shows a schematic structural diagram of a computing device that can be used to implement the data processing of the kernel security detection method according to an embodiment of the present invention.

detailed description

Hereinafter, preferred embodiments of the present disclosure will be described in more detail with reference to the accompanying drawings. Although the drawings show preferred embodiments of the present disclosure, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

【Term Explanation】

Kernel privilege escalation: Use kernel vulnerabilities to gain an attack method for the process that is higher than the system specified authority

Kernel structure: Each process has an instance of task_struct structure in the kernel. From the perspective of the kernel, this structure represents this process.

cred structure: There are two cred structure pointers in the kernel structure of each process. The cred structure records the identity and permissions of the current process as the host/object, including uid, gid, euid, capability, security context, etc.

uid is UserId, that is, user ID, a unique identifier used to identify each user.

gid is GroupId, which is the group ID, a unique identifier used to identify the user group.

euid is a valid user ID, indicating the process's access rights to files and resources.

capability: Since version 2.1, the Linux kernel has the concept of capability, which breaks the concept of superuser/ordinary user in the UNIX/LINUX operating system. Ordinary users can also do work that only superusers can complete .

[Overview of the program]

The Linux operating system is taken as an example to illustrate the implementation principle of the kernel security detection scheme of the present invention. It should be known that the present invention can also be applied to other operating systems similar to the Linux operating system.

Each process in the Linux operating system has different access rights to system resources. With the development of Linux, the management of system permissions is changed from the initial autonomous access control (DAC, including UID, capability) to the later mandatory access control of SELinux. The access rights to the process provide more fine-grained management and more secure guarantees, and all these guarantees are based on a structure called cred in the kernel.

cred is a data structure that each process has, which stores information related to process permissions, such as user/group information, capability information, and so on. The specific definition of the cred structure is the prior art, and will not be repeated here.

Each process has a kernel stack, usually in kernel mode, the process will get the address of its own cred through the kernel stack (current_thread_info()->task.cred). As shown in Figure 1, the process information (thread_info) in the kernel stack is stored at the lowest end of the stack, including the address space (addr_limit) and process control block (task_struct) structure accessible by the process, and process permission credentials can be obtained from task_struct Set (that is, cred structure). As shown in the figure, the set of process authority credentials may include but not limited to uid, gid, euid, capability, security context, and so on.

Kernel privilege escalation refers to an attack method that uses kernel vulnerabilities to obtain higher privileges than specified by the system. For an attacker, implementing kernel privilege escalation in a Linux system generally includes the following two methods.

1) From the perspective of code, modify the cred operation function, including but not limited to modify the check function of xid, cap_xxx, security/context to bypass the security check.

2) From the perspective of data, directly modify the content of cred, including but not limited to directly modify the content of xid, cap_xxx, security/context.

Modifying the cred operation function actually modifies the code of the kernel. This attack should be protected by security features such as RODATA. For the attack method of modifying the content of the cred, the cred structure of the process is in the data segment of the kernel. Unless RO protection is provided, there is no mechanism in the kernel that can detect this operation at the moment when the attacker modifies the cred. The cost of cred's protection of security features such as RODATA is greater than the benefit, which is determined by the attack vector against cred.

The present invention is mainly directed to an attack method that directly modifies the content of the cred, and proposes a kernel security detection scheme. By checking the integrity of the cred to determine whether the cred has been maliciously modified, it can be used to prevent an attacker from directly reading and writing through the kernel state memory Modify the content of cred directly. Although in theory, the kernel security detection scheme proposed by the present invention cannot completely prevent all attacks that directly modify the cred (such as the attacker's reverse cred check algorithm, obtain the verification key, etc.), but it will greatly improve the attacker's Attack difficulty and cost.

The specific implementation process of the kernel security detection scheme of the present invention will be described below.

[Kernel Security Inspection Scheme]

FIG. 2 is a schematic flowchart illustrating a kernel security detection method according to an embodiment of the present invention. Among them, the method shown in FIG. 2 can be used to detect whether a process running in the environment of the Linux operating system (or other operating systems similar to the Linux operating system) is maliciously modified, that is, the kernel escalates privileges.

Referring to FIG. 2, in step S210, on the usage path of the process authority credential set, the current process authority credential set is compared with the pre-stored process authority credential set.

The process authority credential set includes information related to process authority. Taking the Linux operating system as an example, the process authority credential set may refer to a cred structure, which may include but not limited to group ID (gid), user ID (uid), effective user ID (euid), capability, security pointer ( security pointer), security context, current process authority credential set address (such as cred address), boot random number (boot random).

The data stored in the process permission credential set in advance can be regarded as the access right possessed by the process under normal circumstances. As an example of the present invention, the pre-stored process authority credential set may be a process authority credential set obtained by modifying the process authority credential set in a secure manner, for example, it may be based on calling a standard interface function corresponding to the process authority credential set The set of process authority credentials obtained after modification.

When comparing the current process authority credential set with the pre-stored process authority credential set, it is mainly to compare whether the current process authority credential set is consistent with the pre-stored process authority credential set, that is, to compare the integrity of the current process authority credential set.

As an example, it can be determined whether the current set of process authority credentials is consistent with the pre-stored set of process authority credentials by comparing hash values. Specifically, the hash value of the current process authority credential set may be calculated on the usage path of the process authority credential set. For convenience of distinction, the obtained hash value may be referred to as a first hash value. Then, the first hash value can be compared with the second hash value, where the second hash value is obtained by performing the same hash calculation on the pre-stored set of process authority credentials. The storage location of the second hash value can be predefined, for example, it can be stored in the task_struct structure of the process, or it can be stored separately in memory, and indexed according to the process authority credential set address, or it can also be stored in trusted memory.

In step S220, according to the comparison result, it is determined whether the current process authority credential set is maliciously modified.

In the case where the current process authority credential set is consistent with the pre-stored process authority credential set, it can be considered that the current process authority credential set has not been maliciously modified, and when the current process authority credential set is inconsistent with the pre-stored process authority credential set, It can be considered that the current process authority credential set has been maliciously modified. In addition, when it is determined that the permissions of the process are maliciously modified, the process can be terminated or the system can be crashed to actively prevent the attacker from further damaging the system.

[Comparison timing of process authority credential set]

The attack process for an attacker to escalate the kernel is:

1. Use a user mode process to call a system call to trigger a kernel vulnerability;

2. The process modifies the set of process authority credentials in kernel mode;

3. The system call returns to user mode, and the current process has root authority;

4. Operation after having root authority.

Step 1-2 is how to obtain root authority, step 3 is how to return to user mode after obtaining root authority, and step 4 is the harm after root authority. If the attacker only performs steps 1-3, then the attacker actually does not pose any harm to the system. At this time, the attacker can be considered to be capable of harming the system, but the attacker has not performed any dangerous operations.

There are many ways to implement step 4, the common ones are: a) obtain a temporary shell through fork+exec (the most common); b) obtain a temporary shell through shellcode/next (occasionally seen); c) through shellcode/next code directly performs other operations (relatively uncommon).

a and b will eventually obtain a temporary shell, according to the characteristics of the shell, it is difficult to avoid subsequent fork/exec system calls according to the characteristics of the shell, so the invention proposes that the process authority credentials of the current process can be detected in the fork/exec call Whether the set meets expectations, that is, whether it is consistent with the previous set of process authority credentials.

In addition, in the three attack methods a, b, and c, if the attacker wants to cause further harm to the system, he will call the system call again, such as fork/exec/open/close/read/write, etc. The system call is called, so the present invention proposes to check whether the set of process authority credentials of the current process meets expectations at the system call entrance, to ensure that even if an attacker gains root authority, it will not harm the system. That is, step S210 may be executed at the system call entry, and/or step S210 may also be executed when the fork/exec function is executed to detect whether the process authority credential set has been maliciously modified.

Specific application examples

Taking the credential structure of the process authority credential as an example, the integrity of cred can be divided into the following two steps.

1) When the cred is modified by the standard cred interface function, a hash is generated for the new cred.

As an example, as shown in FIG. 3, the fields added to the hash calculation may include various ids such as uid/gid/euid, cap_xxx, security pointer or context, the current cred address, and a boot random number (boot random).

2) Recalculate the hash at the entrance of the system call and the fork/exec function, and compare it with the original hash.

The hash modified by the cred standard interface function will pass the verification. The attacker directly modifies the cred structure and cannot pass the hash verification. The storage location of the hash can be pre-defined. For example, it can be saved in the task_struct structure of the process or can be saved separately. In memory, and indexed by cred address, or can be stored in trusted memory.

Therefore, the system call entry detection can ensure that each time a system call occurs, the cred hash of the current process will be checked first to ensure that the modification of the cred can be detected within a system call cycle. Detection in the fork/exec function can ensure that the attacker can detect the previous malicious modification of the cred when performing most operations through the shell or by running a new process.

In summary, according to the scenario where the process authority credential set is used in the kernel, the present invention finds a path that is difficult to be bypassed after an attacker modifies the process authority credential set, and performs an integrity check on the process authority credential set. For example, the passive check of fork/exec can be based on system calls. Although the timing of the check is delayed for a relatively real attack, it is difficult for the attacker to bypass it.

【Kernel Security Testing Device】

FIG. 4 is a schematic block diagram showing the structure of a kernel security detection device according to an embodiment of the present invention. Among them, the functional module of the kernel safety detection device may be implemented by hardware, software, or a combination of hardware and software that implements the principles of the present invention. Those skilled in the art can understand that the functional modules described in FIG. 4 can be combined or divided into sub-modules, so as to implement the principles of the above invention. Therefore, the description herein may support any possible combination, division, or further definition of the functional modules described herein.

The functional modules that the kernel security detection device can have and the operations that each functional module can perform are briefly described. For the details involved, please refer to the above description, which will not be repeated here.

Referring to FIG. 4, the kernel security detection device 400 includes a comparison module 410 and a judgment module 420. The comparison module 410 is used to compare the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set. The process authority credential set includes information related to the process authority. The judging module 420 is used to judge whether the current process authority credential set is maliciously modified according to the comparison result.

Optionally, the comparison module 410 may compare the current process authority credential set with the pre-stored process authority credential set at the system call entry, and/or the comparison module 410 may also compare the current process authority credential set when the fork/exec function is executed Compare with pre-stored set of process authority credentials.

As an example of the present invention, the comparison module 410 includes a first calculation module and a comparison submodule (not shown in the figure). The first calculation module is used to calculate the hash value of the current process authority credential set on the usage path of the process authority credential set to obtain the first hash value, and the comparison submodule is used to compare the first hash value with the second hash Hope to compare, where the second hash value is obtained by hashing the pre-stored set of process authority credentials. The determining module 420 may determine that the set of process authority credentials is maliciously modified when the first hash value and the second hash value are inconsistent.

As an example of the present invention, the kernel security detection device 400 may further include a second calculation module (not shown in the figure). The second calculation module is configured to calculate a hash value for the modified process authority credential set in response to modifying the process authority credential set in a secure manner to obtain a second hash value.

In the present invention, the pre-stored set of process authority credentials is the set of process authority credentials obtained after modifying the set of process authority credentials based on the security method before. The security method may be to call a standard interface function corresponding to the process authority credential set.

【Computer equipment】

FIG. 5 shows a schematic structural diagram of a computing device that can be used to implement the data processing of the kernel security detection method according to an embodiment of the present invention.

Referring to FIG. 5, the computing device 500 includes a memory 510 and a processor 520.

The processor 520 may be a multi-core processor, or may include multiple processors. In some embodiments, the processor 520 may include a general-purpose main processor and one or more special co-processors, such as a graphics processor (GPU), a digital signal processor (DSP), and so on. In some embodiments, the processor 520 may be implemented using a customized circuit, such as an application specific integrated circuit (ASIC, Application Integrated Circuit) or field programmable logic gate array (FPGA, Field Programmable Gate Arrays).

The memory 510 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. The ROM may store static data or instructions required by the processor 520 or other modules of the computer. The permanent storage device may be a readable and writable storage device. The permanent storage device may be a non-volatile storage device that does not lose stored instructions and data even after the computer is powered off. In some embodiments, the permanent storage device uses a mass storage device (eg, magnetic or optical disk, flash memory) as the permanent storage device. In some other embodiments, the permanent storage device may be a removable storage device (for example, a floppy disk or an optical drive). The system memory may be a readable and writable storage device or a volatile readable and writable storage device, such as dynamic random access memory. The system memory can store some or all instructions and data required by the processor during operation. In addition, the memory 510 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), magnetic disks, and/or optical disks may also be used. In some embodiments, the memory 510 may include readable and/or writeable removable storage devices, such as compact discs (CDs), read-only digital versatile discs (eg, DVD-ROM, dual-layer DVD-ROM), Read-only Blu-ray discs, ultra-density discs, flash memory cards (such as SD cards, min SD cards, Micro-SD cards, etc.), magnetic floppy disks, etc. The computer-readable storage medium does not contain carrier waves and instantaneous electronic signals transmitted through wireless or wired.

Executable code is stored on the memory 510. When the executable code is processed by the processor 520, the processor 520 can be executed to perform the kernel security detection method mentioned above.

The kernel security detection method, apparatus and device according to the present invention have been described in detail above with reference to the drawings.

In addition, the method according to the present invention may also be implemented as a computer program or computer program product, the computer program or computer program product including computer program code instructions for performing the above steps defined in the above method of the present invention.

Alternatively, the present invention may also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) on which executable code (or computer program, or computer instruction code) is stored ), when the executable code (or computer program, or computer instruction code) is executed by the processor of the electronic device (or computing device, server, etc.), causing the processor to execute the steps of the above method according to the present invention .

Those skilled in the art will also understand that the various exemplary logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or a combination of both.

The flowchart and block diagrams in the drawings show the possible implementation architecture, functions, and operations of systems and methods according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, program segment, or part of code that contains one or more of the Executable instructions. It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks can actually be executed in parallel, and sometimes they can also be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts, can be implemented with dedicated hardware-based systems that perform specified functions or operations Or, it can be realized by a combination of dedicated hardware and computer instructions.

The embodiments of the present invention have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the illustrated embodiments. The selection of terms used herein is intended to best explain the principle, practical application or improvement of the technology in the embodiments of the embodiments, or to enable other ordinary skilled in the art to understand the embodiments disclosed herein.

Claims (11)

A kernel safety detection method, which is characterized by including: Comparing the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set, the process authority credential set including information related to the process authority; and According to the comparison result, it is determined whether the current process authority credential set is maliciously modified. The kernel security detection method according to claim 1, wherein the step of comparing the current set of process authority credentials with a pre-stored set of process authority credentials includes: On the usage path of the process authority credential set, calculate the hash value of the current process authority credential set to obtain the first hash value; Comparing the first hash value with a second hash value, where the second hash value is obtained by hashing the pre-stored set of process authority credentials. The kernel security detection method according to claim 2, wherein the step of determining whether the current process authority credential set is maliciously modified includes: When the first hash value and the second hash value are inconsistent, it is determined that the set of process authority credentials is maliciously modified. The kernel security detection method according to claim 2, further comprising: In response to modifying the process authority credential set in a secure manner, a hash value is calculated for the modified process authority credential set to obtain the second hash value. The kernel security detection method according to claim 1, wherein the pre-stored set of process authority credentials is a set of process authority credentials obtained by modifying the set of process authority credentials based on a security method. The kernel security detection method according to claim 4 or 5, wherein: The security method is to call a standard interface function corresponding to the set of process authority credentials. The kernel security detection method according to claim 1, wherein the set of process authority credentials includes at least one of the following: Group ID User ID; Effective user ID; ability; Safety pointer Security context The address of the current process authority credential set; Start random number. The kernel security detection method according to claim 1, wherein the step of comparing the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set includes: Compare the current set of process authority credentials with the pre-stored set of process authority credentials at the system call entry; and/or When the fork/exec function is executed, the current process authority credential set is compared with the pre-stored process authority credential set. A kernel safety detection device, characterized in that it includes: The comparison module is used to compare the current process authority credential set with the pre-stored process authority credential set on the usage path of the process authority credential set, the process authority credential set includes information related to the process authority; and The judgment module is used for judging whether the current process authority credential set is maliciously modified according to the comparison result. A computing device, including: Processor; and A memory on which executable code is stored, and when the executable code is executed by the processor, causes the processor to perform the method according to any one of claims 1-8. A non-transitory machine-readable storage medium having executable code stored thereon, when the executable code is executed by a processor of an electronic device, the processor is caused to execute any one of claims 1 to 8. The method.

Images