Method and device for carrying out file operation

Abstract

The invention provides a method for carrying out a file operation. The method comprises the following steps of: acquiring a file operation request including invoker input parameter, wherein the input parameter comprises file paths; searching a relative file object analysis routine in an object manager according to the file path; generating an I / O request packets according to the file object analysis routine if the relative file object analysis routine is found out, and transmitting the packets to an original address of the lower layer device of the preset file system. The method in the invention can increase and drive the counterforce capability of a rogue program and avoid potential probability of incompatibility among safe software due to interference of file operation.

Description

technical field [0001] The present invention relates to the technical field of file penetration, in particular to a file operation execution method and a file operation execution device. Background technique [0002] When faced with complex problems, people tend to use the method of divide and conquer to divide and narrow the scope of the problem. This is also the case in the design of the operating system. This approach brings advantages such as portability and scalability. However, due to the security flaws in the design theory (for example, the lack of an integrity verification mechanism, etc.), another aspect of high scalability also means that there are a large number of possibilities for the system to be tampered with. Taking the design of the file system as an example, the hierarchical structure of the file call stack determines the risk of data flow tampering on the call chain. Because of this, ensuring the authenticity and credibility of its own file operation pro...

AI Technical Summary

Problems solved by technology

[0014] Although traditional security software vendors are aware of the possibility of various file operation calls being hijacked, most of the existing solutions only consider the hijacking risk of the operating system user state, and often show a certain lack of capability in the attack and defense of the operating system kernel state , driver-level malware (Rootkit) is weak against

[0015] Therefore, a technical problem that needs to be urgently solved by those skilled in the art is to propose a processing mechanism for file penetration operations, which not only provides attack and defense in the user state of the operating system, but also provides attack and defense in the kernel state of the operating system to enhance and drive Anti-attack and defense capabilities against malicious programs, and avoid the potential for incompatibility between security software due to file operation interference

Images