File access control method, device and equipment based on sensitive mark

Abstract

The invention discloses a file access control method, a file access control device and file access control equipment based on a sensitive mark, and a computer readable storage medium. The file accesscontrol method comprises the steps of: traversing all running processes on a system through employing a kernel driver, and extracting user information and paths of each process, so as to determine a main body sensitive mark of each process; judging whether a file is provided with a sensitive mark or not by means of the sensitive mark in extension attributes of the file when the kernel driver intercepts an access operation of the file; if the file is provided with the sensitive mark, extracting the sensitive mark of the file as a target object sensitive mark; searching a target main body sensitive mark of the access operation in main body sensitive marks of all the processes through PID of the access operation; and comparing the target subject sensitive mark with the target object sensitivemark process to determine the access permission of the access operation to the file. According to the file access control method, the file access control device, the file access control equipment andthe computer readable storage medium provided by the invention, different subjects can be effectively controlled to only access the resources which the subjects have access to, and multi-level security access is realized.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a file access control method, device, device and computer-readable storage medium based on sensitive marks. Background technique [0002] In some environments with relatively high confidentiality requirements, it is often required that some files with relatively high confidentiality can only be read and written by users or processes with the same confidentiality level, or read by users or processes with higher confidentiality levels to ensure network security. However, in the existing system, there is no strategy for uniformly setting the confidentiality level for users, processes, and files in the system, so it is impossible to effectively control different subjects in the system to only have access to the resources they have access to; it may cause users or processes with low confidentiality levels to read The phenomenon that files with high confidentiality le...

AI Technical Summary

Problems solved by technology

[0004] The object of the present invention is to provide a file access control method, device, device and computer-readable storage medium based on sensitive tags, which solves the problem in the prior art that different subjects in the system can only access the resources they are authorized to access due to the inability to effectively control the system. Issues that lead to low security of network files

Images