CN102542187A - Method for improving safety performance of computers on basis of safety sandbox - Google Patents
Method for improving safety performance of computers on basis of safety sandbox Download PDFInfo
- Publication number
- CN102542187A CN102542187A CN2010106022449A CN201010602244A CN102542187A CN 102542187 A CN102542187 A CN 102542187A CN 2010106022449 A CN2010106022449 A CN 2010106022449A CN 201010602244 A CN201010602244 A CN 201010602244A CN 102542187 A CN102542187 A CN 102542187A
- Authority
- CN
- China
- Prior art keywords
- request
- black box
- safety
- software
- safe
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Abstract
The invention discloses a method for improving safety performance of computers on the basis of a safety sandbox, which is used for keeping a user system clear and safe. In the method, software is mounted in a safety black box by a user, and the black box runs in a system kernel model and monitors and intercepts behaviors of the application software running in the black box. If the software sends out I/O request, the safety black box receives the request and adds the same into a request queue, and an I/O request analyzer inside the safety black box extracts the request from the request queue and then analyzes and judges the request; if the request accesses the internal resources of the safety black box, the request is added into an executing queue; if the request accesses the external system resources in a read-only manner, then the request is allowed to be added into the executing queue; if the request requires modifying the external system resources, a resource image of the external system resources is generated inside the safety black box, and the I/O request is redirected to request the internal resources of the safety black box and added into the I/O request queue. The method keeps the user system clear and safe.
Description
Technical field
The present invention relates to a kind of method that improves the computer security performance.
Background technology
Safe sandbox is a kind of " environment ", originate insincere, possess destruction or the not clear program of intention can be performed therein, yet all changes in the sandbox can't have any impact to operating system.Sandbox technical operation at present are in multiple different software.Take the lead in adopting sandbox technical limitation web application to cross virtual boundary visit computer memory like GOOGLE browser chrome, prevent other software crash that cause browser or just moving because of the single network application program.
" PowerShadow " also is a kind of application of sandbox technology.PowerShadow adopts the operating system Intel Virtualization Technology to generate the image of current operation system, has and the duplicate function of real system.After getting into PowerShadow, all operations all is virtual, so all virus and rogue software all can't infect real operating system.When system goes wrong, perhaps surf the Net to produce garbage files, only need restart computer easily, make the original state of system recovery.
Yet,, can influence the execution efficient of software to a certain extent, because all operations is not all to have risk though total system is put among the sandbox improving safety greatly.So directly cause influencing the user experience of software.And, system can only solve when encountering problems through restarting system.
Equally, the sandbox technology is applied in each independent software, the software developer not only will be concerned about concrete Software Design exploitation, also will be concerned about the security of how to use the sandbox technology to guarantee software, has increased cost of software development.
Summary of the invention
The technical matters that the present invention will solve provides a kind of method based on safety sandbox raising computer security performance, and it can be protected, and computer system is clean, safety.
In order to solve above technical matters, the invention provides a kind of method based on safety sandbox raising computer security performance, may further comprise the steps:
The user adds in the safety black box, installation application software;
Safe black box operates in system core attitude, intercepts and captures the software action that operates in the black box during operation;
To undelegated non-safety behavior, stop its execution or whether allow this operation by user's ruling; For example stop memory read-write, accesses network of undelegated striding course etc., and the information that gives a warning, whether allow this behavior by user's final decision.If software sends the I/O request, safe black box joins request in the request queue after obtaining this request;
The inner I/O request analyser of safe black box is got request from formation, carry out analysis and judgement;
If this request access security black box internal resource is then put into request and is carried out in the formation;
If request with read-only mode visit external system resource, then allows this request and puts into and carry out in the formation;
If the external system resource is revised in request; Then safe black box external resource is for this reason videoed in a resource of the inner generation of safety black box; This request is revised in successful back, and this I/O request is redirected to the safe black box internal resource of request, puts into medium the waiting of I/O execution formation and moves.
Beneficial effect of the present invention is: safe black box can be protected the clean safety of client.The use of safe black box can be protected the clean of custom system in user level, does not receive the influence of the garbage files that software installs or produce during operation, and also protection system is avoided the infringement of virus or Malware simultaneously, guarantees the safety of system.When no longer needing this safe black box, can directly delete, solution can't complete discharge the worry of some common people's software of stream.Compare with PowerShadow, do not need to encounter problems at every turn and need restart system, only need the deletion black box to deal with problems, guarantee the clean and safety of system, user-friendly again.From technological layer, safe black box can make the software developer need not in the utilization of safety technique in software such as care sandboxs again, thereby is devoted to the exploitation of software actual functional capability.The user can install and delete software in safe black box and the safe black box arbitrarily.The additions and deletions of safe black box do not influence the use of external system, and not externally system stay " vestige ".
Description of drawings
Below in conjunction with accompanying drawing and embodiment the present invention is done further explain.
Fig. 1 is the synoptic diagram of the said method of the embodiment of the invention.
Embodiment
The present invention adopts the method for sealing software runtime environment, monitoring software running status.Concrete behavior through the intercepting running software comprises striding course internal storage access, bottom I/O solicit operation, accesses network etc., when the intercepting and capturing software action, if software asks striding course access memory or accesses network are then transferred to whether operating software of user's ruling.If software sends the I/O request, safe black box joins request in the request queue after obtaining this request; Be redirected to safe black box inside if safe black box is analyzed the I/O request of intercepting, reach the purpose of sealing software runtime environment.When request visit external system devices file; And when this request permissions is not enough; The external unit file that safe black box needing to be attempted for this reason generates a Device Image file in safety black box inside, and adjusts this I/O solicit operation, makes the newly-generated internal unit file of its visit.Behavior state during monitoring software operation simultaneously to undelegated non-safety behavior, stops its execution or whether allows this operation by useful ruling.For example stop memory read-write, accesses network of undelegated striding course etc., and the information that gives a warning, whether allow this behavior by user's final decision.
Adopt method of the present invention; It is inner to make running software be closed in safe black box; It is inner that generate during the software installation and operation or downloaded files etc. is locked in safe black box, so potential safety hazard also is isolated in the safe black box, stoped some unsafe acts in running software period simultaneously.Guaranteed that not only software can not pollute external system, kept the clean of external system, also protected the safety of user and system simultaneously, stoped virus infections external system file.With the read-write resource file is example, and the software of operation allows the inner resource file of read-write security system in the security system, and for the resource of external system, security system only allows software to read, and does not allow to revise these resources.When software need be revised the external resource file really, security system generated a reflection resource for the external resource that needs to revise in security system inside, adjust this I/O operation simultaneously, lets it visit and revises newly-generated reflection resource file.Guarantee with this that software that moves in security system can not revised and destroy the external system file, the maintenance system is clean.Therefore, use safe black box of the present invention effectively to protect the clean and safety of client.
As shown in Figure 1, it is following to the present invention is based on the flow process that the application safety black box of safe sandbox carries out:
The client starts the security of operation black box after safe black box is installed, and can add and deletion software for the safety black box.
Two kinds of addition manners are arranged: a kind of is to add the mounted software of external system, i.e. trustship mode is added, and the operation of external software is accomplished and monitoring by the trustship of safety black box; Another kind is that mounting means adds, and promptly directly a software is installed into safe black box.
Delete the software that has been provided with in the safe black box to two kinds of different modes should be arranged: a kind of is the cancellation trustship, and another kind is that unloading is installed into the software in the safe black box.When noting the safe black box of deletion dual mode there is different influences,, can influence the externally use of system of this software after the deletion for the former; And the latter can be deleted with security system in the lump.
After having disposed safe black box, operating software.Safe black box monitoring software operation, some behavior operations of intercepting and capturing software are like I/O operation and some predefined dangerous operation, for example striding course memory read-write and accesses network etc.For the I/O operation, I/O request queue of safe black box internal maintenance and I/O carry out formation.Send the I/O request during running software, safe black box obtains after this request request being joined in the request queue.The inner I/O request analyser of safe black box is got request from formation, carry out analysis and judgement.If this request access security black box internal resource is then put into request and is carried out in the formation; If request with read-only mode visit external system resource, then allows this request and puts into and carry out in the formation; If the external system resource is revised in request; Then safe black box is attempted for this reason, and external resource generates a resource reflection in safety black box inside; This request is revised in successful back, and this I/O request is redirected to the safe black box internal resource of request, puts into medium the waiting of I/O execution formation and moves.
For unsafe striding course memory read-write operation, whether if this operation is uncommitted, safe black box provides safety instruction, continued by this operation of user's ruling.For the softward interview network, safe black box allows software from the outer net read data, and when software taking place when outer net sends sensitive data, safe black box provides safety instruction.
Described safe black box starts operation with an application software mode that operates in peripheral operation system core attitude.Black box is directly transferred to the peripheral operation system with the operation of software and is accomplished, and black-box system is responsible for monitoring.After safe black box starts operation, intercept and capture the software action operation, comprise operation of I/O resource request and unsafe acts operation, above-mentioned behavior is further analyzed and handled.
The present invention can " not pollute " external system through adopting the method for sealing software runtime environment and monitoring software operation action when guaranteeing install software or operating software, when no longer needing certain software or whole safe black box, can directly delete.Safe black box guarantees in the uninstalling system that software or whole safe black box are can influence external system completely and not, after the unloading not externally system stay any information.Solution can't the complete discharge rogue software, remove problems such as virus and Malware.And safe black box can protect user and system not to receive the infringement of virus and Malware.
The present invention is not limited to the embodiment that preceding text are discussed.More than the description of embodiment is intended in order to describe and explain the technical scheme that the present invention relates to.Based on the conspicuous conversion of the present invention enlightenment or substitute and also should be considered to fall into protection scope of the present invention.Above embodiment is used for disclosing best implementation method of the present invention, so that those of ordinary skill in the art can use numerous embodiments of the present invention and multiple alternative reaches the object of the invention.
Claims (4)
1. one kind is improved the method for computer security performance based on the safety sandbox, it is characterized in that: may further comprise the steps:
The user adds in the safety black box, installation application software;
Safe black box operates in system core attitude, intercepts and captures the software action that operates in the black box during operation;
To undelegated non-safety behavior, stop its execution or whether allow this operation by user's ruling;
If software sends the I/O request, safe black box joins request in the request queue after obtaining this request;
The inner I/O request analyser of safe black box is got request from formation, carry out analysis and judgement;
If this request access security black box internal resource is then put into request and is carried out in the formation;
If request with read-only mode visit external system resource, then allows this request and puts into and carry out in the formation;
If the external system resource is revised in request; Then safe black box external resource is for this reason videoed in a resource of the inner generation of safety black box; This request is revised in successful back, and this I/O request is redirected to the safe black box internal resource of request, puts into medium the waiting of I/O execution formation and moves.
2. the method that improves the computer security performance based on the safety sandbox as claimed in claim 1; It is characterized in that: black box obtains the I/O device request of the external system of process, after the safe black box analysis request, judges whether this solicit operation has authority; If there are not enough authorities; Safe black box is done the device interior reflection to external system devices in black box, the adjustment request is inner I/O request, adjusted request is dropped into continue to carry out.
3. the method that improves the computer security performance based on the safety sandbox as claimed in claim 2; It is characterized in that: the monitoring software operation action; If software asks striding course access memory or accesses network then stop this behavior or transfer to user's ruling and whether continue this behavior.
4. the method based on safety sandbox raising computer security performance as claimed in claim 3 is characterized in that safe black box operates in the operating system kernel attitude, accessing operation system kernel data structure and kernel function; Under the windows platform, safe black box moves with the mode of driver; Under the Linux platform, safe black box starts operation with the mode of module.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010602244.9A CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201010602244.9A CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102542187A true CN102542187A (en) | 2012-07-04 |
| CN102542187B CN102542187B (en) | 2016-06-15 |
Family
ID=46349056
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201010602244.9A Active CN102542187B (en) | 2010-12-23 | 2010-12-23 | Based on the method that safe sandbox improves computer security performance |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102542187B (en) |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102819711A (en) * | 2012-08-21 | 2012-12-12 | 北京思创银联科技股份有限公司 | Restoring protection method for magnetic disk |
| CN103778384A (en) * | 2014-02-24 | 2014-05-07 | 北京明朝万达科技有限公司 | Identity authentication based virtual terminal safety environment protection method and system |
| CN104036183A (en) * | 2013-05-17 | 2014-09-10 | 腾讯科技（深圳）有限公司 | Method and system for installing software in sandbox |
| CN104063284A (en) * | 2013-03-18 | 2014-09-24 | 腾讯科技（深圳）有限公司 | Method and device operating application program |
| CN104182684A (en) * | 2014-08-15 | 2014-12-03 | 浪潮电子信息产业股份有限公司 | Design solution of security process operating environment |
| CN104376255A (en) * | 2014-11-28 | 2015-02-25 | 北京奇虎科技有限公司 | Application program running control method and device |
| CN104408367A (en) * | 2014-11-28 | 2015-03-11 | 北京奇虎科技有限公司 | Application program configuration method and device |
| CN104704468A (en) * | 2012-09-27 | 2015-06-10 | 谷歌公司 | Cross system installation of WEB applications |
| CN105138905A (en) * | 2015-08-25 | 2015-12-09 | 中国科学院信息工程研究所 | Isolation operation method for Linux application program |
| CN105528542A (en) * | 2014-09-28 | 2016-04-27 | 北京云巢动脉科技有限公司 | Control method and system based on software capable of running without installation |
| CN106874731A (en) * | 2017-04-14 | 2017-06-20 | 深信服科技股份有限公司 | A kind of application layer multi-user method and device based on terminal |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040064710A1 (en) * | 2002-09-30 | 2004-04-01 | Pervasive Security Systems, Inc. | Document security system that permits external users to gain access to secured files |
| CN101510888A (en) * | 2009-03-19 | 2009-08-19 | 阿里巴巴集团控股有限公司 | Method, device and system for improving data security for SaaS application |
| US20100229218A1 (en) * | 2009-03-05 | 2010-09-09 | Microsoft Corporation | Quota management for network services |
-
2010
- 2010-12-23 CN CN201010602244.9A patent/CN102542187B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040064710A1 (en) * | 2002-09-30 | 2004-04-01 | Pervasive Security Systems, Inc. | Document security system that permits external users to gain access to secured files |
| US20100229218A1 (en) * | 2009-03-05 | 2010-09-09 | Microsoft Corporation | Quota management for network services |
| CN101510888A (en) * | 2009-03-19 | 2009-08-19 | 阿里巴巴集团控股有限公司 | Method, device and system for improving data security for SaaS application |
Non-Patent Citations (1)
| Title |
|---|
| 戴新宇: "《一种基于Xen半虚拟化技术的沙盒模型的设计与实现》", 《万方学位论文》, 25 January 2010 (2010-01-25), pages 14 - 44 * |
Cited By (19)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102819711A (en) * | 2012-08-21 | 2012-12-12 | 北京思创银联科技股份有限公司 | Restoring protection method for magnetic disk |
| CN104704468A (en) * | 2012-09-27 | 2015-06-10 | 谷歌公司 | Cross system installation of WEB applications |
| CN108509207A (en) * | 2012-09-27 | 2018-09-07 | 谷歌有限责任公司 | The cross-system of WEB application program is installed |
| CN104704468B (en) * | 2012-09-27 | 2018-04-27 | 谷歌有限责任公司 | The cross-system installation of WEB application program |
| CN104063284A (en) * | 2013-03-18 | 2014-09-24 | 腾讯科技（深圳）有限公司 | Method and device operating application program |
| CN104063284B (en) * | 2013-03-18 | 2016-07-06 | 腾讯科技（深圳）有限公司 | The method and apparatus running application program |
| CN104036183A (en) * | 2013-05-17 | 2014-09-10 | 腾讯科技（深圳）有限公司 | Method and system for installing software in sandbox |
| CN104036183B (en) * | 2013-05-17 | 2015-04-08 | 腾讯科技（深圳）有限公司 | Method and system for installing software in sandbox |
| CN103778384B (en) * | 2014-02-24 | 2016-09-28 | 北京明朝万达科技股份有限公司 | The guard method of the virtual terminal security context of a kind of identity-based certification and system |
| CN103778384A (en) * | 2014-02-24 | 2014-05-07 | 北京明朝万达科技有限公司 | Identity authentication based virtual terminal safety environment protection method and system |
| CN104182684A (en) * | 2014-08-15 | 2014-12-03 | 浪潮电子信息产业股份有限公司 | Design solution of security process operating environment |
| CN105528542A (en) * | 2014-09-28 | 2016-04-27 | 北京云巢动脉科技有限公司 | Control method and system based on software capable of running without installation |
| CN105528542B (en) * | 2014-09-28 | 2018-07-17 | 北京云巢动脉科技有限公司 | A kind of management-control method and system for exempting from installation and operation based on software |
| CN104408367A (en) * | 2014-11-28 | 2015-03-11 | 北京奇虎科技有限公司 | Application program configuration method and device |
| CN104376255A (en) * | 2014-11-28 | 2015-02-25 | 北京奇虎科技有限公司 | Application program running control method and device |
| CN104376255B (en) * | 2014-11-28 | 2017-05-24 | 北京奇虎科技有限公司 | Application program running control method and device |
| CN104408367B (en) * | 2014-11-28 | 2019-04-05 | 北京奇虎科技有限公司 | Application program configuration method and device |
| CN105138905A (en) * | 2015-08-25 | 2015-12-09 | 中国科学院信息工程研究所 | Isolation operation method for Linux application program |
| CN106874731A (en) * | 2017-04-14 | 2017-06-20 | 深信服科技股份有限公司 | A kind of application layer multi-user method and device based on terminal |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102542187B (en) | 2016-06-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102542187B (en) | Based on the method that safe sandbox improves computer security performance | |
| CN1794131B (en) | Computer security management, such as in a virtual machine or hardened operating system | |
| US10552610B1 (en) | Adaptive virtual machine snapshot update framework for malware behavioral analysis | |
| Abbasi et al. | ECFI: Asynchronous control flow integrity for programmable logic controllers | |
| CN103842971B (en) | Monitor for indirect interface and the system and method for vertical line detection | |
| Xiong et al. | Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions. | |
| US8732824B2 (en) | Method and system for monitoring integrity of running computer system | |
| Schrammel et al. | Jenny: Securing Syscalls for {PKU-based} Memory Isolation Systems | |
| CN110912876A (en) | Mimicry defense system, method and medium for information system | |
| CN105512550A (en) | Systems and methods for active operating system kernel protection | |
| CN105138905A (en) | Isolation operation method for Linux application program | |
| CN104008329A (en) | Software privacy leak behavior detection method and system based on virtualization technology | |
| Jeong et al. | A kernel-based monitoring approach for analyzing malicious behavior on android | |
| CN105320884A (en) | Security protection method and system for virtual machine | |
| Khan et al. | {M2MON}: Building an {MMIO-based} security reference monitor for unmanned vehicles | |
| CN103425563A (en) | Online input/output (I/O) electronic evidence obtaining system and method based on virtualization technology | |
| Shi et al. | Vanguard: A cache-level sensitive file integrity monitoring system in virtual machine environment | |
| RU2708355C1 (en) | Method of detecting malicious files that counteract analysis in isolated environment | |
| Tsifountidis | Virtualization security: Virtual machine monitoring and introspection | |
| Hizver et al. | Cloud-based application whitelisting | |
| Xiong et al. | SILVER: Fine-grained and transparent protection domain primitives in commodity OS kernel | |
| Wei et al. | Toward a general defense against kernel queue hooking attacks | |
| Zhan et al. | SAVM: A practical secure external approach for automated in‐VM management | |
| Anikeev et al. | Preventing malicious data harvesting from deallocated memory areas | |
| Liu et al. | Multi-Variant Execution Research of Software Diversity |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |