KR102675729B1 - Data protection methods and Apparatus in Linux-based OS - Google Patents

Abstract

A data protection device in a Linux-based operating system according to the present invention includes a physical storage device; and a software module, a processor equipped with a user application, a user library, a virtual file system, a kernel-based file system, a FUSE kernel driver, and a FUSE user daemon. The user application provides access to the FUSE file path. When the requested request information is provided to the user library, the user library provides the request information to the virtual file system, and if the virtual file system has a processor for the FUSE file path included in the request information registered in advance, It is determined that FUSE is mounted and the request information is provided to the pre-registered FUSE kernel driver, the FUSE kernel driver provides the request information to the FUSE user daemon, and the FUSE user daemon is provided through the kernel-based file system. The FUSE file path directly accesses the file at the file address of the physical storage device, and the FUSE user daemon sends access result information to the file at the file address of the physical storage device to the FUSE kernel driver. and the FUSE kernel driver returns access result information for the file to the virtual file system, and the virtual file system returns access result information for the file to the user library, and the user library A, the access result information for the file is returned to the user application, and the file for the FUSE file path includes data subject to protection.

Description

Data protection methods and Apparatus in Linux-based OS}

The present invention relates to data protection technology, and more specifically, to a data protection method and device in a Linux-based operating system that protects files containing data to be protected by storing them in a FUSE-mounted storage area.

With the advent of new technologies, insecure data storage is emerging as one of the most important network security issues.

Typically, in Linux-based operating systems such as Ubuntu, CentOS, etc., data is stored in the Linux file system, which is used as a standard interface for applications. The Linux File System is a built-in layer of Linux-based operating systems that sorts files on disk storage and manages file names, file sizes, creation dates, and more information about files.

Additionally, access to important data such as encryption keys used to protect the above data was restricted to only users with root authority. However, if the attacker had root privileges, it was difficult to protect the data.

As a data protection technology in a conventional Linux-based operating system, there is patent number 1014166180000 registered with the Korean Intellectual Property Office under the name of Linux kernel security-based intrusion prevention system. This includes an IP table that records IP addresses to be blocked; A database that records IP addresses to be blocked; A detection engine that determines whether or not an unblocked packet is an attack through the IP table; And, a blocking engine that stores the IP address of the packet determined to be an attack (hereinafter referred to as the attack IP address) in the database, and instructs the attack IP address to be stored in the IP table, and a resource monitor that shows the IP address stored in the database. We are launching a Linux kernel security-based intrusion prevention system that detects intrusions into the Linux system, including modules, and restricts access rights to those detected as intrusions.

And there is patent number 1014145800000 registered at the Korean Intellectual Property Office under the name of a multi-class based secure Linux operating system. This includes an access control unit that controls access to users by applying the BLP (Bell-La Padula) model; a reference monitor unit including a subject security label defining a permission level and protection category for the subject and an object security label defining a permission level and protection category for the object; a kernel mode encryption unit that automatically determines whether to encrypt and perform encryption according to the permission level and protection category recorded in the file, with reference to the permission level and protection category recorded in the subject security label and the object security label; and a real-time monitoring unit that records file access in real time using a dynamic database.

As mentioned above, various security methods applied to Linux-based operating systems have been continuously proposed. However, in Linux-based operating systems, the file system is part of the operating system kernel, and understanding the kernel source code is very complex and difficult. Therefore, for most developers, implementing data security functions by creating or modifying the kernel file system was not an easy problem. Additionally, due to licensing issues, no file system could be integrated into the kernel unless the source code was made public.

Accordingly, there has been an urgent need to develop technology that can effectively protect data in Linux-based operating systems.

The purpose of the present invention is to provide a data protection method and device in a Linux-based operating system that safely protects the data to be protected by storing files containing data to be protected in a FUSE storage area that is accessible only when FUSE is mounted. .

In addition, another object of the present invention is to provide a data protection method and device in a Linux-based operating system that safely protects the data by allowing access to files containing protected data recorded in the FUSE storage area only upon an access request by an authorized user. is to provide.

In addition, another object of the present invention is that when a request for a file containing data subject to protection recorded in the FUSE storage area is read, the original file is read and returned through a decryption process, and in the case of write, the original file is returned through an encryption process. To provide a data protection method and device in a Linux-based operating system that safely protects the data to be protected by recording it in a file.

In addition, another object of the present invention is to make the physical file address in the FUSE mounted state and the physical file address in the FUSE unmounted state the same, preventing damage that may occur when one of the files recorded in the divided file address is damaged. It provides data protection methods and devices in Linux-based operating systems that can prevent possible FUSE problem situations.

A data protection device in a Linux-based operating system according to the present invention to achieve the above object includes a physical storage device; and a software module, a processor equipped with a user application, a user library, a virtual file system, a kernel-based file system, a FUSE kernel driver, and a FUSE user daemon. The user application provides access to the FUSE file path. When the requested request information is provided to the user library, the user library provides the request information to the virtual file system, and if the virtual file system has a processor for the FUSE file path included in the request information registered in advance, It is determined that FUSE is mounted and the request information is provided to the pre-registered FUSE kernel driver, the FUSE kernel driver provides the request information to the FUSE user daemon, and the FUSE user daemon is provided through the kernel-based file system. The FUSE file path directly accesses the file at the file address of the physical storage device, and the FUSE user daemon sends access result information to the file at the file address of the physical storage device to the FUSE kernel driver. and the FUSE kernel driver returns access result information for the file to the virtual file system, and the virtual file system returns access result information for the file to the user library, and the user library A, the access result information for the file is returned to the user application, and the file for the FUSE file path includes data subject to protection.

The present invention has the effect of safely protecting the data subject to protection by storing the file containing the data subject to protection in a FUSE storage area that is accessible only when the data is FUSE mounted.

In addition, the present invention has the effect of safely protecting the data by allowing access to files containing protected data recorded in the FUSE storage area only upon an access request by an authenticated user.

In addition, in the present invention, when a request for access to a file containing data subject to protection recorded in the FUSE storage area is read, the original file is read and returned through a decryption process, and in the case of write, the request is made by going through an encryption process and writing to the original file. , has the effect of safely protecting the data subject to protection.

In addition, the present invention makes the physical file address of the FUSE mounted state and the physical file address of the FUSE unmounted state the same, preventing FUSE damage that may occur when one of the files recorded in the divided file address is damaged. It has the effect of preventing problem situations in advance.

1 is a schematic configuration diagram of a data protection device according to a preferred embodiment of the present invention.
Figure 2 is a diagram illustrating a FUSE file path according to a preferred embodiment of the present invention.
FIG. 3 is a diagram illustrating a schematic processing procedure of the processor of FIG. 1.
Figure 4 is a software structure diagram according to a preferred embodiment of the present invention.
5 and 6 are diagrams showing the procedures of a data protection method according to a preferred embodiment of the present invention.

The present invention safely protects the data to be protected by storing the file containing the data to be protected in a FUSE storage area that is accessible only when the data is mounted in FUSE.

In addition, the present invention safely protects the data by allowing access to files containing protected data recorded in the FUSE storage area only upon an access request by an authenticated user.

In addition, in the present invention, when a request for access to a file containing data subject to protection recorded in the FUSE storage area is read, the original file is read and returned through a decryption process, and in the case of write, the request is made by going through an encryption process and writing to the original file. , Safely protect the data subject to protection.

In addition, the present invention makes the physical file address of the FUSE mounted state and the physical file address of the FUSE unmounted state the same, preventing FUSE damage that may occur when one of the files recorded in the divided file address is damaged. Helps prevent problem situations in advance.

Prior to the detailed description of the present invention, the Filesystem in Userspace (hereinafter referred to as FUSE) will be described. The FUSE project started in 2004 and was implemented in the Linux kernel in 2005. The FUSE allows unauthorized users to create their own file systems without editing the kernel source code, thereby avoiding licensing issues.

In addition, the FUSE is located in user space, which is easy to develop, and the user space program does not cause damage to the system even if the user space program is damaged, thereby increasing the stability of the system. In contrast, programs in the kernel file system have that risk.

Additionally, while user space code can be written in any language and is easy to debug, writing kernel code is much more complex and accidental glitches can cause unexpected reboots in the kernel and system.

Additionally, the FUSE has limitations in that it performs slower than the basic Linux file system depending on the workload (write/read) or hardware, so moving the file system to user space for large amounts of data is not efficient.

The present invention uses the above FUSE to safely protect data subject to protection in a Linux-based operating system. In particular, the present invention can limit the protection target to key data such as encryption keys that are not large in size, taking into account the workload and performance degradation of the CPU.

Now, the data protection method and device according to the preferred embodiment of the present invention described above will be described in detail with reference to the drawings.

<Outline configuration of data protection device>

First, the configuration of the data protection device to which the present invention is applied will be described. 1 is a schematic configuration diagram of a data protection device according to a preferred embodiment of the present invention. Referring to FIG. 1, the data protection device consists of a processor 10, a physical storage device 20, and a user interface device 30.

The processor 10 is FUSE mounted (makeFuseMount()), FUSE unmounted (unmountFuse()), or FUSE mounted according to a user's request through the user interface device 30. Performs read/write data, etc. on files containing data subject to protection in the FUSE storage area accessible from .

The storage device 20 provides a physical storage area and a FUSE storage area for storing data to be protected when FUSE is mounted or FUSE is unmounted. Here, the FUSE storage area when FUSE is mounted or FUSE unmounted has the same path (/path/to/fuse-data) as shown in Figure 2, which is the data in the FUSE storage area when FUSE is unmounted during FUSE mount. The stability of the system can be promoted by preventing the data recorded in the FUSE storage area of the FUSE mount from being changed or changed when FUSE is unmounted.

The user interface device 30 is responsible for the interface between the processor 10 and the user.

<Approximate processing procedure of the processor>

A schematic processing procedure of the processor 10 will be further described with reference to FIG. 3. When reading or writing data to be protected is requested through the user interface device 30, the processor 10 performs a FUSE mount (makeFuseMount()) (step 40). When mounting the FUSE, authentication is performed through user identification information (#uid='rsfuse') and group identification information (#gid='rsfuse').

When the FUSE mount is performed, the processor 10 reads or writes a file containing key data for data to be protected, for example, an encryption key, from the FUSE storage area (Read/Write data) (step 50). Here, if the request for access to a file containing data subject to protection recorded in the FUSE storage area is read, the processor 10 reads the original file and returns it through a decryption process, and if it is a write request, it returns the original file through an encryption process. By recording it in a file, the data subject to protection is safely protected.

When reading or writing the data to be protected is completed, the processor 10 performs FUSE unmounting (unmountFuse()) (step 60).

<Processor software structure>

The structure of the software mounted on the processor 10 of the data protection system configured as described above will be further described with reference to FIG. 4. Referring to FIG. 4, software modules provided in the processor 10 can be roughly divided into user space 101 and kernel space 102.

Software modules belonging to the user space 101 include a user application 113, a user library 114, a user unit 103 for performing the FUSE function, a FUSE daemon program 109, and a FUSE library program 110. The user unit 103 includes a FUSE user daemon 105 and a FUSE library 106.

And the software modules belonging to the kernel space 102 include a virtual file system 117, a kernel-based file system 118, and a FUSE kernel unit 104, and the FUSE kernel unit 104 includes a FUSE device 107. and FUSE kernel driver 108.

The user application 113 is composed of C/C+, JAVA, etc. and performs functions according to user requests. Among the above functions, it includes protecting files containing data to be protected through the FUSE function, as well as reading/writing files containing data to be protected.

The user library 114 requests file access to the virtual file system 117 located in the kernel space 102 according to the request of the user application 113, and files provided by the virtual file system 117. Result information regarding the access request is returned to the user application (113). In particular, the user library 114 requests the FUSE daemon program 109 to mount/unmount FUSE according to a request from the user application 113.

The virtual file system 117 allows access to multiple file systems through an abstraction layer that exists above the actual file system. This virtual file system 117 provides file access to the kernel-based file system 118 or the FUSE kernel unit 104 at the request of the user library 114, the FUSE daemon program 109, or the FUSE user daemon 105. request, and result information regarding the file access request returned by the kernel-based file system 118 or the FUSE kernel unit 104 is returned to the user library 114. In particular, the virtual file system 117 registers information about the processor for the FUSE file path, that is, the FUSE tunnel driver 108, when mounting FUSE.

The kernel-based file system 118 manages the physical storage device 20 and the files therein, and performs operations according to access requests to the physical storage device 20 according to requests from the virtual file system 117. And the result is returned to the virtual file system 117. In addition, the kernel-based file system 118 is operated by the FUSE daemon program 109 existing in the user space 101 through the virtual file system 117 or from the FUSE user daemon 105 of the user unit 103. The request is performed, and the result is returned to the FUSE daemon program 109 or the FUSE user daemon 105 through the virtual file system 117.

The FUSE daemon program 109 is executed according to the request of the user library 114 to perform the FUSE mount, and when the FUSE mount is completed, it registers itself as the FUSE user daemon 105 and acts as the FUSE user daemon 105. It works. Here, when mounting the FUSE, the FUSE daemon program 109 receives the file address of the physical storage device for the FUSE file path from the kernel-based system 118.

When the FUSE mount by the FUSE daemon program 109 is completed, the FUSE library program 110 sends FUSE file path information and user and group identification information (UID:RSFUSE, GID:RSFUSE) to the FUSE kernel unit 104. It is provided as a kernel device 107.

When the FUSE library program 110 provides FUSE file path information and user and group identification information (UID:RSFUSE, GID:RSFUSE), the FUSE kernel driver 108 stores them and operates the virtual file system 117. This provides information indicating that the processor for the FUSE file path is the user. Here, the virtual file system 117 stores the information, and when a request for the FUSE file path is provided according to the information, it provides it to the FUSE kernel driver 108 of the FUSE kernel unit 104 for processing. request.

Additionally, when a request for the FUSE file path is provided, the FUSE kernel driver 108 checks whether the user and group identification information (UID:RSFUSE, GID:RSFUSE) included in the request information matches the FUSE file path. Authenticate, and if the authentication is successful, access to the FUSE file path is requested to the FUSE user daemon 105. Here, the request is provided to the FUSE user daemon 105 via the FUSE device 107 and the FUSE library 106. More specifically, the FUSE kernel driver 108 allocates a FUSE request structure and writes it to a queue, and the FUSE user daemon 105 reads the FUSE request structure from the queue of the FUSE device 107 to read the queued request. can be processed. And when the request processing is completed, the FUSE user daemon 105 writes a response to the request into the queue of the FUSE device 107. Based on the response written in this way, the FUSE kernel driver 108 can confirm that the request has been completed.

The FUSE user daemon 105 reads the FUSE request through the FUSE device 107, processes the request, and then writes a response to the FUSE device 107 using the FUSE library 106, thereby transmitting and receiving data.

Additionally, when response information is provided in response to a request for access to the FUSE file path from the FUSE user daemon 105, the FUSE kernel driver 108 returns it to the virtual file system 117.

And when an access request for the FUSE file path is provided through the FUSE kernel unit 104, the FUSE user daemon 105 physically stores the FUSE file path corresponding to the FUSE file path through the kernel-based file system 118. By directly accessing the file address of the device 20, reading or writing is performed on the file containing the data to be protected, which is the original file, and the result is returned to the FUSE kernel driver 108. Here, the kernel-based file system 118 and the FUSE user daemon 105 perform data communication via the virtual file system 117.

<Procedures of data protection method>

Now, the procedure of the data protection method according to the preferred embodiment of the present invention described above will be described with reference to FIGS. 5 and 6. Referring to Figures 5 and 6, the user application 113 transmits information requesting a file stored in the FUSE file path to the user library 114 according to the user's request (step 200). Here, the FUSE file path may be set in advance as a file path for a file recording data to be protected.

The user library 114, which has received information requesting a file stored in the FUSE file path, transmits information requesting confirmation whether a processor for the FUSE file path is registered to the virtual file system 117 (step 201).

In response to the request, the virtual file system 117 returns information indicating whether to register a processor for the FUSE file path to the user library 114 (step 202).

If the handler for the FUSE file path is not registered, the user library 114 executes the FUSE daemon program 109 to attempt a FUSE mount (step 204).

When the FUSE daemon program 109 is executed, it accesses the kernel-based file system 118 through the virtual file system 117 and stores the physical storage device 20 for the FUSE directory corresponding to the FUSE file path. Request a file address (steps 206 and 208). In response to the above request, the kernel-based file system 118 returns the file address of the physical storage device 20 for the FUSE directory to the FUSE daemon program 109 through the virtual file system 117 (steps 210 and 212). ). Here, the kernel-based file system 118 may store information about the file address corresponding to the FUSE directory in advance.

The FUSE daemon program 109 stores the file address of the physical storage device 20 for the FUSE directory, registers itself as the FUSE user daemon 105, and calls the FUSE library program 110 to use the FUSE The file path and user authentication information are provided to the FUSE library program 110 (steps 214 and 216).

The FUSE library program 110 transmits the FUSE file path and user authentication information to the FUSE kernel driver 108 (step 218).

The FUSE kernel driver 108 stores the FUSE file path and user authentication information and transmits processor information about the FUSE file path to the virtual file system 117 (step 220).

The virtual file system 117, which has received the processor information for the FUSE file path, registers the processor information for the FUSE file path and notifies the user library 114 of the FUSE mount (step 224). When the user library 114 is notified of completion of the FUSE mount, it returns to step 203 (step 226).

Meanwhile, when the FUSE mount is established, the user library 114 requests the virtual file system 117 to access the file in the FUSE file path (step 300). The virtual file system 117 checks whether the processor corresponding to the FUSE file path is registered in advance (step 302). If a processor corresponding to the FUSE file path is registered in advance, the virtual file system 117 transmits the UID/GID of the requester and the FUSE file path to the FUSE kernel driver 108 according to the processor information for the FUSE file path. (Step 304).

The FUSE kernel driver 108 performs authentication by checking whether the UID/GID and FUSE file path provided by the requester correspond to the pre-registered UID/GID and FUSE file path (step 306). If the authentication fails, the FUSE kernel driver 108 determines that the data request is made by an abnormal user and processes an error (step 310).

Contrary to the above, if authentication is successful, the FUSE kernel driver 108 transmits access request information for the FUSE file path to the FUSE user daemon 105 (step 312). The FUSE user daemon 105, which has received the access request information, directly accesses the file address of the physical storage device 20 corresponding to the FUSE file path through the kernel-based file system 118 and the virtual file system 117. Read or write to the file of data subject to protection (step 314). Here, when a request for access to a file containing data to be protected recorded in the FUSE storage area is read, the FUSE user daemon 106 reads the original file and returns it through a decryption process, and when it is a write request, it performs an encryption process. The data subject to protection is safely protected by being recorded in the original file.

In addition, the FUSE user daemon 105 sends result information following a request for access to the FUSE file path, which is the result of reading or writing to a file of data subject to protection, to the FUSE kernel driver 108 and the virtual file system 117. ) to the user library 114 (steps 316, 318, and 320). When result information is provided in response to an access request for the FUSE file path, the user library 114 transmits it to the user application 113 (step 324).

In addition, the FUSE mount status is unmounted upon the elapse of a predetermined time or upon a user's request through the user application 113. That is, in response to a FUSE unmount request through the user application 113, the user library 114 requests the virtual file system 117 and the FUSE user daemon 105 to unmount FUSE, and according to the FUSE unmount request, the virtual In addition to the file system 117 initializing the processor information for the FUSE file path, the FUSE user daemon 105 also initializes the physical address information corresponding to the FUSE file path and the FUSE daemon program 109. restore one's condition.

The embodiments of the present invention described above have been disclosed for illustrative purposes, and those skilled in the art will be able to make various modifications, changes, and additions within the spirit and scope of the present invention, and such modifications , changes and additions should be regarded as falling within the scope of this patent claim.

Claims (10)

physical storage; and a software module, comprising a processor equipped with a user application, a user library, a virtual file system, a kernel-based file system, a FUSE kernel driver, and a FUSE user daemon;
When the user application provides request information requesting access to the FUSE file path to the user library, the user library provides the request information to the virtual file system, and the virtual file system includes the request information. If a processor for the FUSE file path is pre-registered, it is determined that FUSE is mounted and the request information is provided to the pre-registered FUSE kernel driver, and the FUSE kernel driver provides the request information to the FUSE user daemon, The FUSE user daemon directly accesses a file with a file address of the physical storage device that is predetermined corresponding to the FUSE file path through the kernel-based file system, and the FUSE user daemon accesses the file address of the physical storage device. Access result information for the file is returned to the FUSE kernel driver, the FUSE kernel driver returns access result information for the file to the virtual file system, and the virtual file system returns access result information for the file. returns to the user library, and the user library returns access result information for the file to the user application,
The file for the FUSE file path includes data to be protected,
The requested information further includes user and group identification information,
The FUSE kernel driver checks whether the user and group identification information included in the request information corresponds to user and group identification information predetermined to correspond to the FUSE file path, and identifies the user and group included in the request information. If the information corresponds to the user and group identification information predetermined to correspond to the FUSE file path, authentication is determined to be successful, and only when the authentication is successful, the request information is provided to the FUSE user daemon,
The processor further includes a FUSE daemon program and a FUSE library program,
If a processor for the FUSE file path included in the request information is not registered in the virtual file system, the user library determines that the FUSE is unmounted and executes the FUSE daemon program, and the FUSE daemon program executes the execution event. Accordingly, the file address of the physical storage device corresponding to the FUSE file path is requested from the kernel-based file system, and when the kernel-based file system returns the file address of the physical storage device, the file address of the physical storage device is After saving the file address corresponding to the FUSE file path, it registers itself as the FUSE user daemon and also sends the FUSE file path and corresponding user and group identification information to the FUSE kernel driver through the FUSE library program. A data protection device characterized in that it is determined to be in a FUSE mount state after being provided and registered. According to paragraph 1,
A data protection device, characterized in that the physical file address in a FUSE mounted state and the physical file address in a FUSE unmounted state for the file containing the data to be protected are the same. According to paragraph 1,
The FUSE user daemon, when a request for access to data of a file recorded at the file address of the physical storage device is a read, reads the original file and returns it through a decryption process, and in the case of a write, it returns the original file through an encryption process. A data protection device characterized by recording to a file. In a device comprising a processor equipped with a physical storage device and a software module, a user application, a user library, a virtual file system, a kernel-based file system, a FUSE kernel driver, and a FUSE user daemon,
The user application providing request information requesting access to the FUSE file path to the user library; The user library providing the request information to the virtual file system; determining that the virtual file system is FUSE mounted if a processor for the FUSE file path included in the request information is pre-registered, and providing the request information to the pre-registered FUSE kernel driver; The FUSE kernel driver providing the request information to the FUSE user daemon; Directly accessing, by the FUSE user daemon, a file with a file address of the physical storage device predetermined corresponding to the FUSE file path through the kernel-based file system; Returning, by the FUSE user daemon, access result information for a file of the file address of the physical storage device to the FUSE kernel driver; Returning, by the FUSE kernel driver, access result information for the file to the virtual file system; returning, by the virtual file system, access result information for the file to the user library; and returning, by the user library, access result information for the file to the user application,
The file for the FUSE file path includes data to be protected,
The requested information further includes user and group identification information,
The FUSE kernel driver checks whether the user and group identification information included in the request information corresponds to user and group identification information predetermined in correspondence to the FUSE file path, and identifies the user and group included in the request information. If the information corresponds to the user and group identification information predetermined to correspond to the FUSE file path, authentication is determined to be successful, and only when the authentication is successful, the request information is provided to the FUSE user daemon,
The processor further includes a FUSE daemon program and a FUSE library program,
The user library, if a processor for the FUSE file path included in the request information is not registered in the virtual file system, determining a FUSE unmounted state and executing the FUSE daemon program; The FUSE daemon program requests a file address of a physical storage device corresponding to the FUSE file path from the kernel-based file system according to an execution event; And when the kernel-based file system returns the file address of the physical storage device, it stores the file address of the physical storage device corresponding to the FUSE file path and then registers itself as the FUSE user daemon. , providing and registering the FUSE file path and corresponding user and group identification information to the FUSE kernel driver through the FUSE library program, and then determining the FUSE mount status. According to clause 4,
A data protection method, wherein the physical file address in a FUSE mounted state and the physical file address in a FUSE unmounted state for the file containing the data to be protected are the same. According to clause 4,
The FUSE user daemon, when a request for access to data of a file recorded at the file address of the physical storage device is a read, reads the original file and returns it through a decryption process, and in the case of a write, it returns the original file through an encryption process. A data protection method characterized by recording in a file. delete delete delete delete