Method and system for providing security policy for Linux-based security operating system

Patent metadata

Field	Value
Publication number	US-9697382-B2
Application number	US-77682610-A
Country	US
Kind code	B2
Filing date	May 10, 2010
Priority date	May 8, 2009
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

A system for providing security policy for a Linux-based security operating system, which includes a template policy module configured to set an authority using policy information of a downloaded application so that the template policy module can set an access control rule for accessing a system resource of the application, a base policy module executing the access control rule for the system resource in accordance with the access control rule set by the template policy module, and a template policy module editor generating a custom application for the corresponding application using information output from the template policy module.

First claim

What is claimed is:

1. A system for providing security policy for a Linux-based security operating system, comprising:
a template policy module configured to set authority using policy information of a downloaded application and set an access control rule for accessing a system resource of the downloaded application based on the authority;
a base policy module configured to execute the access control rule for the system resource in accordance with the access control rule set by the template policy module; and
a template policy module editor configured to acquire policy manifest and installation information using the policy information, and generate a custom application corresponding to the downloaded application using the policy manifest and the installation information,
wherein the template policy module editor generates the custom application directly after acquiring the policy manifest and the installation information,
wherein the policy manifest is generated from a provider of the downloaded application, and
wherein the custom application is different from the downloaded application.

2. The system as claimed in claim 1 , wherein the template policy module comprises:
a conditional and unconditional Access Control Rule (ACR) number generation unit having different inputs in accordance with existence or nonexistence of a Boolean identifier among policy constituent elements included in the policy information of the downloaded application; and
an application file context number generation unit having an application component path defined during generation of the downloaded application, security context and Type Enforcement (TE) technical terms.

3. The system as claimed in claim 1 , wherein the downloaded application policy information includes:
an application type identifier indicating an attribute of the application;
a policy module identifier defined in the application; and
a Boolean identifier which has a true or false value and can flexibly apply an authority of permitting or interrupting a conditional ACR for an Access Control Interface (ACI) to accessible resources in the system.

4. The system as claimed in claim 2 , wherein the conditional ACR number generation unit acquires a list of application permission list files from the Boolean identifier, and reads out the policy manifest using the acquired list, inherent identifiers of the respective applications, and the policy information.

5. The system as claimed in claim 1 , wherein the template policy module editor comprises a binary template policy module that receives the policy manifest of the corresponding application and a current installation path.

6. A method of providing security policy for a Linux-based security operating system, comprising the steps of:
acquiring policy manifest and installation information of a downloaded application using policy information of the application;
generating an application policy module corresponding to the downloaded application based on the policy manifest and the installation information; and
managing the generated application policy module,
wherein generating the application policy module includes generating the application policy module directly after acquiring the policy manifest and the installation information,
wherein the policy manifest is generated from a provider of the downloaded application, and
wherein the application policy module is different from the downloaded application.

7. The method as claimed in claim 6 , wherein acquiring the policy manifest comprises:
receiving policy information of an application program so that a system resource access control rule for the downloaded application can be set;
acquiring application permission list files from a Boolean identifier among policy constituent elements included in the policy information; and
acquiring an inherent identifier of the application.

8. The method as claimed in claim 6 , wherein the downloaded application policy information includes:
an application type identifier indicating an attribute of the application;
a policy module identifier defined in the application; and
a Boolean identifier which has a true or false value and can flexibly apply an authority of permitting or interrupting a conditional ACR for an Access Control Interface (ACI) to accessible resources in the system.

9. The method as claimed in claim 6 , wherein managing the application policy module comprises:
acquiring the corresponding identifier from the policy manifest of the generated application policy module;
acquiring a customized Boolean list;
installing the application policy module generated in a kernel according to whether an access control rule given to the kernel through the acquired Boolean list is satisfied;
labeling components related to the installed application module; and
registering the corresponding labeled application.

10. The method as claimed in claim 6 , wherein managing the application policy module comprises:
acquiring a corresponding identifier and a name thereof from the policy manifest of the generated application policy module;
unloading the application policy module corresponding to the acquired identifier and name from a database;
labeling components related to the unloaded application policy module; and
deleting the generated application policy module.

Assignees

• Korkishko Tymur
• Lee Kyung-Hee
• Samsung Electronics Co Ltd

Inventors

• Korkishko Tymur
• Lee Kyung-Hee

Classifications

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/6281 Primary

  at program execution time, where the protection is within the operating system · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title