Sand-box based file security isolation method, device, equipment and medium
By employing encrypted paths and SM4 algorithm block encryption/decryption technology in a sandbox environment, the security shortcomings of sandbox file storage are addressed, achieving high security and key protection for file storage.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHENGDU WEISHITONG INFORMATION SECURITY TECH CO LTD
- Filing Date
- 2026-03-30
- Publication Date
- 2026-06-23
AI Technical Summary
Sandbox environments have significant security vulnerabilities at the file storage level, and existing technologies cannot effectively improve file security.
A sandbox-based file security isolation method is adopted. Through encrypted paths and key management, the SM4 algorithm is used to encrypt and decrypt files in blocks, and dynamic link library injection technology is used to intercept file operation interfaces to ensure that files are stored and transmitted in an encrypted space.
It improves the security of file storage within the sandbox environment, enhances the security of file encryption keys, prevents unauthorized access and leakage, and improves the overall security of file storage.
Smart Images
Figure CN122263168A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of sandboxes, and particularly to sandbox-based methods, apparatuses, devices, and media for secure file isolation. Background Technology
[0002] Currently, sandbox environments employ a spatial isolation architecture. All applications installed and running within the sandbox have their generated files (including installation packages, configuration files, cached data, user business data, etc.) forcibly confined to a dedicated, independent file system space within the sandbox when they are stored. This space is strictly isolated from the host environment and the storage areas of other applications outside the sandbox, ensuring that the access paths of the file systems inside and outside the sandbox are completely independent. However, sandbox environments still have significant security vulnerabilities at the file storage level.
[0003] In summary, improving file security within a sandbox environment is a problem that needs to be addressed. Summary of the Invention
[0004] In view of this, the purpose of this invention is to provide a sandbox-based file security isolation method, apparatus, device, and medium, which can improve file security within a sandbox environment. The specific solution is as follows:
[0005] Firstly, this application discloses a sandbox-based file security isolation method, including:
[0006] Determine the operation type for the current operation;
[0007] If the current operation is a write operation, then determine the first file encryption key, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. Then, store the first encrypted file and the first file encryption key in the encrypted space of the sandbox through the encryption path of the sandbox, and use the key encryption key built into the sandbox to encrypt the first file encryption key in the encrypted space to obtain the first encrypted key.
[0008] If the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encrypted path of the sandbox. The second encrypted file is decrypted using the second file encryption key to obtain the second target file. The second file encryption key is obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox.
[0009] Optionally, before determining the operation type of the current operation, the method further includes:
[0010] A path encryption key is generated using a cryptographic random number generator, and an encrypted space corresponding to the sandbox is created based on the path encryption key.
[0011] Optionally, the creation of the encrypted space corresponding to the sandbox based on the path encryption key includes:
[0012] The core directory structure within the sandbox is encrypted using a path encryption key to create an encrypted path corresponding to the encrypted space of the sandbox.
[0013] Optionally, before determining the operation type of the current operation, the method further includes:
[0014] By using dynamic link library injection technology, the initial POSIX interface related to file operations in the C standard library is intercepted, and the initial POSIX interface is rewritten to embed file encryption and decryption logic to obtain the rewritten POSIX interface. This allows the target file to be encrypted using the rewritten POSIX interface and the first file encryption key, or the encrypted file to be decrypted using the second file encryption key.
[0015] Optionally, determining the first file encryption key includes:
[0016] The first file encryption key is generated using the key generation mechanism of the SM4 algorithm;
[0017] Correspondingly, the file encryption logic in the file encryption and decryption logic is based on the SM4 algorithm's cipher block chaining mode, which divides the target file into blocks based on the algorithm block size and uses the file encryption key to complete the encryption operation. The SM4 algorithm's electronic codebook mode is used to encrypt and store the initial vector random number corresponding to each file block. The file decryption logic in the file encryption and decryption logic is based on the SM4 algorithm's cipher block chaining mode, which divides the encrypted file into blocks based on the algorithm block size and uses the file encryption key to complete the decryption operation.
[0018] Optionally, the steps of decrypting the encrypted key and encrypting the file encryption key can be performed independently by the sandbox process.
[0019] Secondly, this application discloses a sandbox-based file security isolation device, comprising:
[0020] The operation type determination module is used to determine the operation type of the current operation;
[0021] The write operation module is used to determine the first file encryption key if the current operation is a write operation, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. The first encrypted file and the first file encryption key are stored in the encryption space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encryption space using the key encryption key built into the sandbox to obtain the first encrypted key.
[0022] The read operation module is used to read the second file encryption key and the second encrypted file from the encrypted space of the sandbox through the encrypted path of the sandbox if the current operation is a read operation, and decrypt the second encrypted file using the second file encryption key to obtain the second target file; the second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox.
[0023] Optionally, the sandbox-based file security isolation device further includes:
[0024] The rewrite module is used to intercept the initial POSIX interface related to file operations in the C standard library through dynamic link library injection technology, and rewrite the initial POSIX interface to embed the encryption and decryption logic of the file encryption key to obtain the rewritten POSIX interface. This allows the target file to be encrypted using the first file encryption key or decrypted using the second file encryption key through the rewritten POSIX interface.
[0025] Thirdly, this application discloses an electronic device, including:
[0026] Memory, used to store computer programs;
[0027] A processor is used to execute the computer program to implement the aforementioned sandbox-based file security isolation method.
[0028] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned sandbox-based file security isolation method.
[0029] As can be seen, this application determines the operation type of the current operation; if the current operation is a write operation, a first file encryption key is determined, and the first target file is encrypted using the first file encryption key to obtain a first encrypted file. The first encrypted file and the first file encryption key are stored in the encrypted space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encrypted space using the key encryption key built into the sandbox to obtain the first encrypted key; if the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encryption path of the sandbox, and the second encrypted file is decrypted using the second file encryption key to obtain the second target file; the second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox. Therefore, it is evident that this application utilizes the encrypted path of the sandbox for current operations, which improves path security and file storage security. Secondly, this application requires the use of a file encryption key to encrypt and decrypt the file, ensuring that the file is stored as an encrypted file rather than a plaintext file, thus enhancing file storage security. Furthermore, this application uses the built-in key encryption key of the sandbox to encrypt the file encryption key and stores it within the sandbox's encrypted space, preventing the file encryption key from being leaked, improving key security, and further enhancing file storage security. Attached Figure Description
[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0031] Figure 1 This application discloses a flowchart of a sandbox-based file security isolation method.
[0032] Figure 2 This is a schematic diagram illustrating the basic implementation principle of a function disclosed in this application;
[0033] Figure 3 This is a schematic diagram of a document header disclosed in this application;
[0034] Figure 4 This is a schematic diagram of a sandbox-based file security isolation device disclosed in this application;
[0035] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation
[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0037] Currently, sandbox environments employ a spatial isolation architecture. All applications installed and running within the sandbox have their generated files (including installation packages, configuration files, cached data, user business data, etc.) forcibly confined to a dedicated, independent file system space within the sandbox when they are stored. This space is strictly isolated from the host environment and the storage areas of other applications outside the sandbox, ensuring that the access paths of the file systems inside and outside the sandbox are completely independent. However, sandbox environments still have significant security vulnerabilities at the file storage level.
[0038] Therefore, this application proposes a sandbox-based file security isolation scheme, which can improve file security within the sandbox environment.
[0039] This application discloses a sandbox-based file security isolation method. See also Figure 1 As shown, the method includes:
[0040] Step S11: Determine the operation type of the current operation.
[0041] In this embodiment, the operation types include read operations and write operations.
[0042] Step S12: If the current operation is a write operation, determine the first file encryption key, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. Store the first encrypted file and the first file encryption key in the encrypted space of the sandbox through the encryption path of the sandbox, and use the key encryption key built into the sandbox to encrypt the first file encryption key in the encrypted space to obtain the first encrypted key.
[0043] In this embodiment, the encrypted space and encrypted path ensure the security of the file storage location and transmission process. The process of encrypting the first file encryption key with the encryption key built into the sandbox in the encrypted space to obtain the first encrypted key ensures the security of the file encryption key.
[0044] Step S13: If the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encrypted path of the sandbox. The second encrypted file is decrypted using the second file encryption key to obtain the second target file. The second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox.
[0045] In this embodiment, before determining the operation type of the current operation, the method further includes: generating a path encryption key through a cryptographic random number generator, and creating an encrypted space corresponding to the sandbox based on the path encryption key.
[0046] It should be noted that the sandbox environment uses an independent file system namespace to build an independent encrypted storage area (encrypted space) for the target application. The root path of this area is decoupled from the host system file system through a kernel-level isolation mechanism, ensuring that file operations within the sandbox are only effective within the isolated space and preventing direct access by unauthorized processes.
[0047] In this embodiment, the step of creating an encrypted space corresponding to the sandbox based on the path encryption key includes: encrypting and storing the core directory structure within the sandbox based on the path encryption key to create an encrypted path corresponding to the encrypted space of the sandbox.
[0048] It should be noted that during sandbox initialization, a unique path encryption key is generated by a cryptographic random number generator to encrypt and store the metadata (path name, configuration information) of the core directory structure (such as data area and configuration area) within the sandbox.
[0049] In this embodiment, before determining the operation type of the current operation, the method further includes: intercepting the initial POSIX (Portable Operating System Interface) interface related to file operations in the C standard library through dynamic link library injection technology, and rewriting the initial POSIX interface to embed file encryption and decryption logic to obtain the rewritten POSIX interface, so as to encrypt the target file using the rewritten POSIX interface and the first file encryption key or decrypt the encrypted file using the second file encryption key.
[0050] It should be noted that when applications in the sandbox start up, they intercept POSIX interfaces related to file operations in libc through dynamic link library injection (such as LD_PRELOAD (Linux dynamic linker preloading mechanism)). These include (only a part is listed): read operations: read(), pread(), fread(); write operations: write(), pwrite(), fwrite(); file creation / opening: open(), openat(); metadata operations: stat(), lstat() (for decryption adaptation of encrypted path metadata).
[0051] It should be noted that the write process is as follows: When the application calls `write()`, the Hook function first retrieves the key from the sandbox key storage, encrypts the written data according to the SM4 (Chinese national cryptographic block cipher) block mode, and then writes the ciphertext to the underlying file system. The read process is as follows: When `read()` is called, the ciphertext is first read, decrypted using the file key, and then the plaintext is returned to the application.
[0052] In this embodiment, determining the first file encryption key includes: generating the first file encryption key through the key generation mechanism of the SM4 algorithm; correspondingly, the file encryption logic in the file encryption and decryption logic is to divide the target file into blocks based on the cipher block chaining mode of the SM4 algorithm, using the algorithm block size as the unit, and to complete the encryption operation using the file encryption key, and to encrypt and store the initial vector random number corresponding to each file block using the electronic codebook mode of the SM4 algorithm; the file decryption logic in the file encryption and decryption logic is to divide the encrypted file into blocks based on the cipher block chaining mode of the SM4 algorithm, using the algorithm block size as the unit, and to complete the decryption operation using the file encryption key.
[0053] It should be noted that the file encryption key uses the SM4 algorithm key generation mechanism and is 128 bits long to ensure the randomness of the key and its resistance to brute-force attacks.
[0054] It should be noted that this application employs hook technology to intercept file read / write functions, achieving transparent encryption and decryption of files by rewriting the function logic. The overall encryption and decryption process is based on the SM4 algorithm's CBC mode (Cipher-block Chaining), dividing file data into blocks of the algorithm block size and completing encryption and decryption operations accordingly, ensuring data integrity and continuity. To further enhance encryption security, for each data block, the corresponding IV (Initialization Vector) random number is encrypted and stored using the SM4 algorithm's ECB mode (Electronic Codebook). By associating the IV random number with the data block and storing it encrypted, the problem of decreased encryption strength due to IV leakage is effectively avoided, strengthening the overall security mechanism from the perspectives of key management and layered data encryption.
[0055] See Figure 2The diagram shows the basic implementation principle of three functions: open, read, and write. The implementation of other functions will vary depending on their specific functional logic and technical details, and will not be specifically limited here. In this diagram, new means new and origin means original. New functions need to be rewritten, while original functions have already been rewritten and cached, so they do not need to be rewritten again.
[0056] See Figure 3 The diagram shows a file header, which is implemented as a single data block (1024 bytes). The first 29 bytes of this data block are allocated as follows: the Flag field is used as the identification information of the encrypted file (4 bytes); the Version field is used to identify the version number (1 byte); the File Length field represents the file size (8 bytes); and the IVSeed field is the IV random number used in the SM4 encryption process of the file (16 bytes).
[0057] In this embodiment, the steps of decrypting the encrypted key and encrypting the file encryption key are completed independently by the sandbox process.
[0058] It should be noted that the encryption key is protected by a key built into the sandbox, which is dynamically generated and stored in the secure execution environment when the sandbox starts. The encrypted key is stored in association with file metadata, and only the sandbox process can decrypt the key, thus preventing the key from being exposed in plaintext.
[0059] In summary, the hooked interface needs to be rewritten to embed the block encryption / decryption logic of the SM4 algorithm. However, the rewritten interface should maintain compatibility with the parameters and return values of the native POSIX interface, ensuring that the application can achieve transparent encryption and decryption without modifying the code, thus reducing integration costs.
[0060] In summary, this application employs the national commercial cryptographic algorithm (SM4) to implement encrypted storage and isolation control of the storage area of the application within the sandbox, ensuring that the external environment cannot directly parse the file content, thus constructing the first security barrier at the data storage layer. Simultaneously, relying on the key management mechanism within the commercial cryptographic algorithm system, it blocks unauthorized access paths from the source, completely avoiding the risk of file leakage caused by unauthorized access, forming a dual security system of encrypted storage and closed-loop key management. More specifically, this application uses Hook technology to encrypt the file storage path and the file itself using commercial cryptographic algorithms, thereby constructing a file security isolation mechanism. This mechanism significantly increases the difficulty for attackers to obtain isolated files, effectively blocking unauthorized access paths. At the encryption implementation level, file data is processed in units of encrypted blocks, and each encrypted block uses an independent IVSeed (initialization vector seed). This differentiated IVSeed design avoids the problem of weakened encryption strength caused by vector reuse, significantly increasing the threshold for attackers to crack the file data and further strengthening the security of the encryption layer. Furthermore, regarding inter-application interactions within the sandbox environment, this invention restricts file communication to only through specific interfaces pre-defined by the sandbox. This design further tightens the permission boundaries for file transfer from an access control perspective. By standardizing the interaction path, it prevents unauthorized applications from accessing files without proper authorization, thereby comprehensively improving the overall effectiveness of file security isolation.
[0061] As can be seen, this application determines the operation type of the current operation; if the current operation is a write operation, a first file encryption key is determined, and the first target file is encrypted using the first file encryption key to obtain a first encrypted file. The first encrypted file and the first file encryption key are stored in the encrypted space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encrypted space using the key encryption key built into the sandbox to obtain the first encrypted key; if the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encryption path of the sandbox, and the second encrypted file is decrypted using the second file encryption key to obtain the second target file; the second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox. Therefore, it is evident that this application utilizes the encrypted path of the sandbox for current operations, which improves path security and file storage security. Secondly, this application requires the use of a file encryption key to encrypt and decrypt the file, ensuring that the file is stored as an encrypted file rather than a plaintext file, thus enhancing file storage security. Furthermore, this application uses the built-in key encryption key of the sandbox to encrypt the file encryption key and stores it within the sandbox's encrypted space, preventing the file encryption key from being leaked, improving key security, and further enhancing file storage security.
[0062] Accordingly, this application also discloses a sandbox-based file security isolation device, see [link to relevant documentation]. Figure 4 As shown, the device includes:
[0063] Operation type determination module 11 is used to determine the operation type of the current operation;
[0064] The write operation module 12 is used to determine the first file encryption key if the current operation is a write operation, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. The first encrypted file and the first file encryption key are stored in the encryption space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encryption space using the key encryption key built into the sandbox to obtain the first encrypted key.
[0065] The read operation module 13 is used to read the second file encryption key and the second encrypted file from the encrypted space of the sandbox through the encrypted path of the sandbox if the current operation is a read operation, and decrypt the second encrypted file using the second file encryption key to obtain the second target file; the second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox.
[0066] In one embodiment, the sandbox-based file security isolation device further includes:
[0067] The rewrite module 14 is used to intercept the initial POSIX interface related to file operations in the C standard library through dynamic link library injection technology, and rewrite the initial POSIX interface to embed the encryption and decryption logic of the file encryption key to obtain the rewritten POSIX interface, so that the target file can be encrypted by using the rewritten POSIX interface and the first file encryption key, or the encrypted file can be decrypted by using the second file encryption key.
[0068] The more specific working process of each of the above modules can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0069] As can be seen, this application determines the operation type of the current operation; if the current operation is a write operation, a first file encryption key is determined, and the first target file is encrypted using the first file encryption key to obtain a first encrypted file. The first encrypted file and the first file encryption key are stored in the encrypted space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encrypted space using the key encryption key built into the sandbox to obtain the first encrypted key; if the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encryption path of the sandbox, and the second encrypted file is decrypted using the second file encryption key to obtain the second target file; the second file encryption key is the key obtained by decrypting the second encrypted key in the encrypted space of the sandbox using the key encryption key built into the sandbox. Therefore, it is evident that this application utilizes the encrypted path of the sandbox for current operations, which improves path security and file storage security. Secondly, this application requires the use of a file encryption key to encrypt and decrypt the file, ensuring that the file is stored as an encrypted file rather than a plaintext file, thus enhancing file storage security. Furthermore, this application uses the built-in key encryption key of the sandbox to encrypt the file encryption key and stores it within the sandbox's encrypted space, preventing the file encryption key from being leaked, improving key security, and further enhancing file storage security.
[0070] Furthermore, embodiments of this application also provide an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.
[0071] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the sandbox-based file security isolation method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.
[0072] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0073] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include computer programs 221, and the storage method can be temporary storage or permanent storage. The computer programs 221 may include, in addition to computer programs capable of performing the sandbox-based file security isolation method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, computer programs capable of performing other specific tasks.
[0074] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned sandbox-based file security isolation method.
[0075] The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0076] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. As for the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and relevant parts can be referred to in the method section.
[0077] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0078] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0079] Finally, it should be noted that in this document, relational terms such as "first" and "first" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0080] The above provides a detailed description of a sandbox-based file security isolation method, apparatus, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A sandbox-based file security isolation method, characterized in that, include: Determine the operation type for the current operation; If the current operation is a write operation, then determine the first file encryption key, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. Then, store the first encrypted file and the first file encryption key in the encrypted space of the sandbox through the encryption path of the sandbox, and use the key encryption key built into the sandbox to encrypt the first file encryption key in the encrypted space to obtain the first encrypted key. If the current operation is a read operation, the second file encryption key and the second encrypted file are read from the encrypted space of the sandbox through the encrypted path of the sandbox. The second encrypted file is then decrypted using the second file encryption key to obtain the second target file. The second file encryption key is obtained by decrypting the second encrypted key in the sandbox's encrypted space using the sandbox's built-in encryption key.
2. The sandbox-based file security isolation method according to claim 1, characterized in that, Before determining the operation type of the current operation, the method further includes: A path encryption key is generated using a cryptographic random number generator, and an encrypted space corresponding to the sandbox is created based on the path encryption key.
3. The sandbox-based file security isolation method according to claim 2, characterized in that, The creation of the encrypted space corresponding to the sandbox based on the path encryption key includes: The core directory structure within the sandbox is encrypted using a path encryption key to create an encrypted path corresponding to the encrypted space of the sandbox.
4. The sandbox-based file security isolation method according to claim 1, characterized in that, Before determining the operation type of the current operation, the method further includes: By using dynamic link library injection technology, the initial POSIX interface related to file operations in the C standard library is intercepted, and the initial POSIX interface is rewritten to embed file encryption and decryption logic to obtain the rewritten POSIX interface. This allows the target file to be encrypted using the rewritten POSIX interface and the first file encryption key, or the encrypted file to be decrypted using the second file encryption key.
5. The sandbox-based file security isolation method according to claim 4, characterized in that, Determining the encryption key for the first file includes: The first file encryption key is generated using the key generation mechanism of the SM4 algorithm; Correspondingly, the file encryption logic in the file encryption and decryption logic is based on the SM4 algorithm's cipher block chaining mode, which divides the target file into blocks based on the algorithm block size and uses the file encryption key to complete the encryption operation. The SM4 algorithm's electronic codebook mode is used to encrypt and store the initial vector random number corresponding to each file block. The file decryption logic in the file encryption and decryption logic is based on the SM4 algorithm's cipher block chaining mode, which divides the encrypted file into blocks based on the algorithm block size and uses the file encryption key to complete the decryption operation.
6. The sandbox-based file security isolation method according to any one of claims 1 to 5, characterized in that, The steps of decrypting the encrypted key and encrypting the file encryption key are completed independently by the sandbox process.
7. A sandbox-based file security isolation device, characterized in that, include: The operation type determination module is used to determine the operation type of the current operation; The write operation module is used to determine the first file encryption key if the current operation is a write operation, and use the first file encryption key to encrypt the first target file to obtain the first encrypted file. The first encrypted file and the first file encryption key are stored in the encryption space of the sandbox through the encryption path of the sandbox, and the first file encryption key is encrypted in the encryption space using the key encryption key built into the sandbox to obtain the first encrypted key. The read operation module is used to read the second file encryption key and the second encrypted file from the encrypted space of the sandbox through the encrypted path of the sandbox if the current operation is a read operation, and then use the second file encryption key to decrypt the second encrypted file to obtain the second target file. The second file encryption key is obtained by decrypting the second encrypted key in the sandbox's encrypted space using the sandbox's built-in encryption key.
8. The sandbox-based file security isolation device according to claim 7, characterized in that, Also includes: The rewrite module is used to intercept the initial POSIX interface related to file operations in the C standard library through dynamic link library injection technology, and rewrite the initial POSIX interface to embed the encryption and decryption logic of the file encryption key to obtain the rewritten POSIX interface. This allows the target file to be encrypted using the first file encryption key or decrypted using the second file encryption key through the rewritten POSIX interface.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the sandbox-based file security isolation method as described in any one of claims 1 to 6.
10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the sandbox-based file security isolation method as described in any one of claims 1 to 6.