Article Preview
TopIntroduction
Union filesystem is a technology that extends the union mount supported by the Linux/Unix operating system to the filesystem. This technology utilizes other filesystems as one filesystem by continuously mounting them in the same location. Previously used only in the Linux/Unix operating system, but now the research is expanding in the Windows operating system.
To use union filesystem, you must select source directory and mount it. When calculating with union filesystem, check the configuration item of the source directory for mount and remove the duplicate item and mount it with one filesystem. Finally, the user can access the mounted filesystem and do file I/O.
However, union filesystem is a highly vulnerable structure for security. According to the principle of information protection for Isolation, only one use interface of all objects should be provided. Therefore, when using union filesystem, access should be made only through mount path. However, the union filesystem can be accessed through source directory as well as mount path. In particular, if a user directly accesses the source directory and changes the file structure, the change is reflected in the mounted filesystem.
If these security environments are exploited, when applications are being provided using union filesystem, critical files can be arbitrarily modulated to reduce the availability of the application, and access source directory to distribute malicious code.
In response to these security threats, the operating system used secureOS to block unauthorized access to critical files/directories. However, current secureOS is not considering union filesystem. For this reason, union filesystem has limitations that are not protected from unauthorized access.
This study proposes an approach control mechanism that can block unauthorized access to the unauthorized filesystem for these risks. If unauthorized access to union filesystem can be blocked, it will increase the integrity and availability of applications using Union filesystem. Since the proposed approach control mechanism needs to be verified for this purpose, positive and negative function tests are carried out.
This study consists of two chapters. Chapter 1 describes the background and purpose of the study. Chapter 2 introduces union filesystem and describes the security requirements that must be met to take advantage of it. Chapter 3 describes the current secureOS being provided and analyzes the security environment for union filesystem versus current file access control technology. Chapter 4 proposes an approach control mechanism for the targeted union filesystem in this study. Chapter 5 performs the validation of the effectiveness of the proposed approach control mechanism. Lastly, Chapter 6 summarizes and organizes the entire research.