Anti-tampering method, electronic device and storage medium supporting user whitelist

Abstract

The present application relates to an anti-tampering method, device, electronic device and storage medium supporting a user whitelist. The anti-tampering method supporting a user whitelist includes: obtaining whitelist information and anti-tampering rule information; obtaining the changed file path when a change in the file system is detected; matching the anti-tampering rule corresponding to the changed file path according to the changed file path; matching the IP address and / or user name of the user corresponding to the anti-tampering rule in the whitelist information when the anti-tampering rule corresponding to the changed file path is matched; and releasing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule when the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information. The present application reduces the maintenance cost of the webpage anti-tampering system.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to an anti-tampering method, device, electronic device and storage medium supporting a user whitelist. Background Art

[0002] Web page tampering is a common method used by hackers to attack. After the web page content is tampered, it will have a significant impact on users. At the same time, hackers will publish and spread viruses in the web page content, causing property and economic losses to users. The web page anti-tampering system uses file filtering drive technology and event triggering technology to timely detect and prevent hackers from tampering with website content. Even if hackers enter the WEB server, they cannot tamper with the website page content.

[0003] In order to avoid hacker attacks in related technologies, the web anti-tampering system can be used to check the changes in the file system in real time, and intercept in time when there are operations such as addition, deletion, and modification in the file system, thereby solving the problem of file system tampering from the root. However, during the research process, it was found that after the customer installed the web anti-tampering rules, once the protected website needed to be changed, it was necessary to turn off the anti-tampering rules of the web anti-tampering system or use the publishing function of the web anti-tampering system to implement the change, and it was also necessary for operation and maintenance personnel to maintain the web anti-tampering system, resulting in a waste of manpower and material resources, leading to the problem of high maintenance costs of the web anti-tampering system.

[0004] Currently, no effective solution has been proposed for the problem of high maintenance cost of web page anti-tampering systems in related technologies. Summary of the invention

[0005] The embodiments of the present application provide an anti-tampering method, device, electronic device and storage medium that support a user whitelist, so as to at least solve the problem of high maintenance cost of web page anti-tampering systems in related technologies.

[0006] In a first aspect, an embodiment of the present application provides an anti-tampering method supporting a user whitelist, comprising:

[0007] Obtaining whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and an anti-tampering rule corresponding to the file path;

[0008] When a change in the file system is detected, the changed file path is obtained;

[0009] According to the changed file path, matching the anti-tampering rule corresponding to the changed file path;

[0010] In the case where the tamper-proof rule corresponding to the changed file path is matched, matching the IP address and / or user name of the user corresponding to the tamper-proof rule in the whitelist information;

[0011] When the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is allowed.

[0012] In some embodiments, the change in the file system includes: creating, deleting or modifying the file system.

[0013] In some embodiments, after allowing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, the method further includes:

[0014] An operation log is generated for the operation process of releasing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, and the operation log is stored.

[0015] In some embodiments, the method further comprises:

[0016] When the IP address and / or user name of the user corresponding to the anti-tampering rule is not matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is prohibited.

[0017] In some embodiments, after obtaining the whitelist information and the anti-tampering rule information, the method further includes:

[0018] Converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a corresponding relationship between the whitelist information and the kernel-state whitelist information;

[0019] When a change in the file system is detected, the changed file path is obtained;

[0020] According to the changed file path, matching the anti-tampering rule corresponding to the changed file path in the kernel state;

[0021] In the case where an anti-tampering rule corresponding to the changed file path is matched in the kernel state, converting the anti-tampering rule into a kernel state anti-tampering rule recognizable in the kernel state, and matching the kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule in the kernel state;

[0022] When the kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is matched in the kernel state, the user operation corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is released.

[0023] In some embodiments, the whitelist information includes an IP address of a user; converting the whitelist information into kernel-state whitelist information recognizable in kernel-state, and generating a correspondence between the whitelist information and the kernel-state whitelist information includes:

[0024] The IP address of the user in the whitelist information is converted into a SessionID that can be recognized in the kernel state, and a corresponding relationship between the IP address of the user in the whitelist information and the SessionID is generated.

[0025] In some embodiments, the whitelist information includes a user name; converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a correspondence between the whitelist information and the kernel-state whitelist information includes:

[0026] The user name in the whitelist information is converted into a UserID identifiable in the kernel state, and a corresponding relationship between the user name in the whitelist information and the UserID identifiable in the kernel state is generated.

[0027] In a second aspect, an embodiment of the present application provides an anti-tampering device supporting a user whitelist, comprising:

[0028] A first acquisition module is used to acquire whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and the anti-tampering rule corresponding to the file path;

[0029] The second acquisition module is used to acquire the changed file path when a change in the file system is detected;

[0030] A first matching module, configured to match an anti-tampering rule corresponding to the changed file path according to the changed file path;

[0031] A second matching module is used to match the IP address and / or user name of the user corresponding to the tamper-proof rule in the whitelist information when the tamper-proof rule corresponding to the changed file path is matched;

[0032] The first release module is used to release the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule when the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information.

[0033] In a third aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the anti-tampering method supporting a user whitelist as described in the first aspect above is implemented.

[0034] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the anti-tampering method supporting a user whitelist as described in the first aspect above is implemented.

[0035] Compared with the related art, the tamper-proof method, device, electronic device and storage medium supporting user whitelist provided in the embodiments of the present application obtain whitelist information and tamper-proof rule information, wherein the whitelist information includes the user's IP address and / or user name; the tamper-proof rule information includes a file path and the tamper-proof rule corresponding to the file path; when a change in the file system is detected, the changed file path is obtained; according to the changed file path, the tamper-proof rule corresponding to the changed file path is matched; when the tamper-proof rule corresponding to the changed file path is matched, the IP address and / or user name of the user corresponding to the tamper-proof rule is matched in the whitelist information; when the IP address and / or user name of the user corresponding to the tamper-proof rule is matched in the whitelist information, the user operation corresponding to the IP address and / or user name corresponding to the tamper-proof rule is released, thereby solving the problem of high maintenance cost of web page anti-tampering system in the related art and reducing the maintenance cost of web page anti-tampering system.

[0036] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0038] Figure 1 It is a hardware structure block diagram of a terminal supporting a user whitelist anti-tampering method according to an embodiment of the present invention;

[0039] Figure 2is a flow chart of an anti-tampering method supporting a user whitelist according to an embodiment of the present application;

[0040] Figure 3 is a flow chart of an anti-tampering method supporting a user whitelist according to yet another embodiment of the present application;

[0041] Figure 4 It is a structural block diagram of an anti-tampering device supporting a user whitelist according to a preferred embodiment of the present application;

[0042] Figure 5 is an interactive flow chart of an anti-tampering device supporting a user whitelist according to a preferred embodiment of the present application;

[0043] Figure 6 It is a structural block diagram of an anti-tampering device supporting a user whitelist according to an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application. In addition, it can also be understood that although the efforts made in this development process may be complex and lengthy, for ordinary technicians in the field related to the contents disclosed in the present application, some changes such as design, manufacturing or production based on the technical contents disclosed in the present application are only conventional technical means, and should not be understood as insufficient contents disclosed in the present application.

[0045] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0046] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to greater than or equal to two. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "first", "second", "third" and the like involved in the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects.

[0047] The method embodiment provided in this embodiment can be executed in a terminal, a computer or a similar computing device. Taking running on a terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a terminal supporting a user whitelist anti-tampering method according to an embodiment of the present invention. Figure 1 As shown, the terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the above terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0048] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the anti-tampering method supporting the user whitelist in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0050] This embodiment provides an anti-tampering method that supports a user whitelist. Figure 2 is a flow chart of an anti-tampering method supporting a user whitelist according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0051] Step S201, obtaining whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and the anti-tampering rule corresponding to the file path.

[0052] In this step, the whitelist information may be configured online by the user; the anti-tampering rule information may also be pre-configured, for example, a file path and the anti-tampering rule corresponding to the file path may be configured.

[0053] Step S202: when a change in the file system is detected, obtain the changed file path.

[0054] In this step, the status of the file system can be monitored in real time to obtain the changed file path when a change in the file system is detected.

[0055] In some embodiments, the change in the file system in step S202 includes: creating, deleting or modifying the file system.

[0056] Step S203, according to the changed file path, matching the anti-tampering rule corresponding to the changed file path.

[0057] It should be noted that whether each file path has a corresponding anti-tampering rule can be set by the user. And the configured anti-tampering rule can be used to prevent the IP address and / or user name of the user in the blacklist from tampering with the website content or the content corresponding to the file path.

[0058] Step S204: When an anti-tampering rule corresponding to the changed file path is matched, the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information.

[0059] In this step, the IP address and / or user name of the user corresponding to the anti-tampering rule in the whitelist information may be matched through a preset matching rule, which may be an association rule between the anti-tampering rule and the whitelist information.

[0060] It should be noted that if no anti-tampering rule corresponding to the changed file path is matched, it means that the file path is not configured with anti-tampering rules, and user operations can be directly released, such as creation, deletion or modification of the file path.

[0061] Step S205: when the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is allowed.

[0062] Based on steps S201 to S205, by releasing the user operations corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule when the anti-tampering rule corresponding to the changed file path is matched and the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information, the user operations corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule in the web page anti-tampering system are released, thereby providing users with more application scenarios, eliminating the need to close the anti-tampering rules of the web page anti-tampering system or use the publishing function, solving the problem of high maintenance cost of the web page anti-tampering system in the related technology, reducing the maintenance cost of the web page anti-tampering system, and saving manpower and material resources required to maintain the web page anti-tampering system.

[0063] It should be noted that the anti-tampering method supporting a user whitelist of the present application can be applied to a web page anti-tampering system, so that the web page anti-tampering system can implement anti-tampering supporting a user whitelist.

[0064] In some embodiments, after the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is released, an operation log can be generated for the operation process of releasing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, and the operation log can be stored. In this embodiment, by storing the operation log, it is convenient for the user to monitor the anti-tampering rules corresponding to the changed file path.

[0065] In some embodiments, after step S204, if the IP address and / or user name of the user corresponding to the anti-tampering rule is not matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is prohibited. In this way, the IP address and / or user name of the user outside the whitelist information can be prevented from creating, deleting or modifying the file path, thereby improving the security of the file corresponding to the file path.

[0066] It should be noted that the operation process in the above embodiment can be performed in the user mode of the computer.

[0067] In order to further improve the security of the files corresponding to the file path, the operation flow in the above embodiment may be converted to the kernel state of the computer.

[0068] Figure 3 is a flow chart of an anti-tampering method supporting a user whitelist according to another embodiment of the present application. Figure 3 As shown, the method flow includes:

[0069] Step S301, obtaining whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and the anti-tampering rule corresponding to the file path.

[0070] Step S302: convert the whitelist information into kernel-state whitelist information identifiable in kernel-state, and generate a corresponding relationship between the whitelist information and the kernel-state whitelist information.

[0071] Step S303: when a change in the file system is detected, the changed file path is obtained.

[0072] Step S304, according to the changed file path, matching the anti-tampering rule corresponding to the changed file path in the kernel state.

[0073] Step S305, when the anti-tampering rule corresponding to the changed file path is matched in the kernel state, the anti-tampering rule is converted into a kernel state anti-tampering rule that can be recognized by the kernel state, and the kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is matched in the kernel state.

[0074] Step S306, when kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is matched in kernel state, user operations corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule are released.

[0075] In this embodiment, by converting whitelist information into kernel state whitelist information recognizable in kernel state, generating a correspondence between whitelist information and kernel state whitelist information, and converting anti-tampering rules into kernel state anti-tampering rules recognizable in kernel state, and matching kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule in kernel state, it is achieved that kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule is matched in kernel state, thereby further improving the security of files corresponding to the file path.

[0076] In some of the embodiments, the whitelist information includes the user's IP address; converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a correspondence between the whitelist information and the kernel-state whitelist information includes: converting the user's IP address in the whitelist information into a SessionID recognizable in kernel state, and generating a correspondence between the user's IP address in the whitelist information and the SessionID.

[0077] In this embodiment, the TCP connection can be found by reading all TCP connections under / proc / net / and all files under / proc / pid / inode / , and the corresponding relationship between the user's IP address and SessionID can be found according to the network connection status, thereby realizing the conversion between the user's IP address and SessionID.

[0078] In some of the embodiments, the whitelist information includes a user name; converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a correspondence between the whitelist information and the kernel-state whitelist information includes: converting the user name in the whitelist information into a UserID recognizable in kernel state, and generating a correspondence between the user name in the whitelist information and the UserID recognizable in kernel state.

[0079] In this embodiment, the conversion between the user name and the UserID can be achieved by reading the content of the / etc / passwd file and obtaining the corresponding relationship between the user name and the UserID.

[0080] The embodiments of the present application are described and illustrated below through preferred embodiments.

[0081] The anti-tampering method supporting user whitelist in the above embodiment can be applied to Figure 4 In the tamper-proof device that supports user whitelisting, Figure 4 is a structural block diagram of an anti-tampering device supporting a user whitelist according to a preferred embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0082] Central server 41: used to issue anti-tampering rules to the anti-tampering application 42, and specify the anti-tampering file path, as well as the IP address and / or user name of the user in the whitelist information; it can also serve as a display platform for tampering logs (i.e., the operation logs in the above embodiment).

[0083] Anti-tampering application 42: used to convert the user's IP address in the configured whitelist information into a SessionID that can be recognized by the kernel state, and / or convert the user name into a UserID that can be recognized by the kernel state, and write the read / write and other operation rules corresponding to the file into the anti-tampering rules, and notify the kernel state to read the anti-tampering rules; it is also used to forward the tampering log reported from the kernel state to the user state to the central server 41. In addition, before forwarding to the central server 41, the SessionID is converted into the user's IP address and the UserID is converted into the user name for easy viewing.

[0084] Anti-tampering driver 43: used to monitor changes in the file system in real time.

[0085] The interaction process of the anti-tampering device supporting the user whitelist in the above embodiment is described and illustrated in conjunction with the embodiment.

[0086] Figure 5 is an interactive flow chart of an anti-tampering device supporting a user whitelist according to a preferred embodiment of the present application, such as Figure 5 The interactive process shown includes: anti-tampering rule sending process (data sending process) and anti-tampering rule matching process (data uplink process).

[0087] The process of issuing anti-tampering rules includes:

[0088] Step S501: The central server sends the anti-tampering rules and whitelist information to the SELinux anti-tampering application.

[0089] In this step, assume that the web page path is stored in the server's / server / app / xxx path. Configure the IP address of the user to be released as 1.1.1.1, and the user name to be released as root. When the user's IP address 1.1.1.1 logs in to the file system, and the user name of the operating user is root, 1.1.1.1 and root are allowed to operate on the web page path, but other users' IP addresses and / or user names will be blocked from operating on the web server after the user logs in.

[0090] Step S502: When the user state of the tamper-proof application receives the tamper-proof rule, it obtains the whitelist information.

[0091] In this step, if the whitelist information is not obtained, the user state of the anti-tampering application notifies the kernel state of the anti-tampering application to update the anti-tampering rules.

[0092] Step S503, the user state of the tamper-proof application reads all TCP connections under / proc / net / and all files under / proc / pid / inode / , finds the TCP connection, and finds the correspondence between the user's IP address and SessionID according to the network connection status, and converts the user's IP address into SessionID.

[0093] The matching of the anti-tampering rules in this step is performed in the kernel state of the anti-tampering application. The kernel state of the anti-tampering application cannot directly obtain the user's IP address, but can obtain the SessionID.

[0094] Step S504: the user state of the tamper-proof application reads the contents of the / etc / passwd file, obtains the correspondence between the user name and the UserID, and converts the user name into the UserID.

[0095] The matching of the anti-tampering rules in this step is performed in the kernel state of the anti-tampering application. The kernel state of the anti-tampering application cannot directly obtain the user name, but can obtain the UserID.

[0096] Step S505 , the user state of the tamper-proof application generates a corresponding relationship based on step S503 and step S504 .

[0097] The corresponding relationship in this step includes: the corresponding relationship between the user name and the UserID and / or the corresponding relationship between the user's IP address and the SessionID.

[0098] Step S506: The user state of the tamper-proof application generates tamper-proof rules that are recognizable in the kernel state according to the configured tamper-proof rules.

[0099] Step S507, the user state of the tamper-proof application sends the SessionID and / or UserID recognizable by the kernel state of the tamper-proof application to the kernel state of the tamper-proof application, and sends the corresponding relationship and the anti-tampering rules recognizable by the kernel state of the tamper-proof application to the kernel state of the tamper-proof application.

[0100] Step S508 , the kernel state of the tamper-proof application program records the received identifiable tamper-proof rule as RULE1 , and the corresponding relationship as RULE2 .

[0101] Through the above process, after the anti-tampering rules of the central server are sent to the kernel state of the anti-tampering application, when changes in the file system are monitored, the anti-tampering rules that can be identified by the kernel state can be matched, and the corresponding user's IP address and user name can be matched according to SessionID and UserID. If a match is found, it can be determined whether to release the corresponding operation, and the operation corresponding to the user's IP address and user name can be released.

[0102] The anti-tampering rule matching process includes:

[0103] Step S509, the tamper-proof application driver uses SELinux framework technology to hijack the file system calls for operations such as creation, deletion, and modification (including modification of file attributes and content) in the file system.

[0104] In this step, SELinux (Security-Enhanced Linux) is a security architecture that intercepts requests for accessing web page files based on the kernel, which can avoid the interaction between the kernel driver and the application layer, thereby improving the anti-tampering efficiency.

[0105] Step S510: When the tamper-proof application detects changes in the file system, it determines the changed file path.

[0106] Step S511: the anti-tampering application matches the anti-tampering rules according to the transformed file path.

[0107] Step S512: When the anti-tampering application matches the anti-tampering rule, the anti-tampering application converts the anti-tampering rule into an anti-tampering rule recognizable by the kernel state.

[0108] Step S513, the anti-tampering application matches the SessionID and the UserID according to the anti-tampering rules and corresponding relationships that can be identified in the kernel state.

[0109] In this step, the anti-tampering application matching can be that when the anti-tampering rule corresponding to the changed file path is matched in the kernel state, the anti-tampering rule is converted into a kernel state anti-tampering rule that can be recognized by the kernel state, and the kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is matched in the kernel state.

[0110] Step S514, when the anti-tampering application matches the kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule in the kernel state, it releases the user operation corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule.

[0111] It should be noted that if only the anti-tampering rule of the changed file path is matched in the above steps, the user operation will be blocked; if the anti-tampering rule of the changed file path is matched and the SessionID and / or UserID corresponding to the whitelist information is also matched, the operation will be released, so that the operation corresponding to the IP address and user name of the user set to be released can be implemented.

[0112] Among them, when the user sets the anti-tampering rules to report the tampering log, the anti-tampering application will convert the SessionID and UserID in the tampering log into the corresponding user's IP address and user name through the corresponding relationship, and report the converted tampering log to the central server.

[0113] Through the above method, users can use the web page anti-tampering system to release the IP address and / or user name of the specified user, provide users with more application scenarios, reduce the maintenance cost of the web page anti-tampering system, and save the manpower and material resources required to maintain the web page anti-tampering system.

[0114] This embodiment also provides an anti-tampering device supporting a user whitelist, which is used to implement the above embodiments and preferred implementations, and will not be repeated here. As used below, the terms "module", "unit", "subunit", etc. can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0115] Figure 6 is a structural block diagram of an anti-tampering device supporting a user whitelist according to an embodiment of the present application, such as Figure 6 As shown, the device comprises:

[0116] The first acquisition module 61 is used to acquire whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and an anti-tampering rule corresponding to the file path;

[0117] The second acquisition module 62 is coupled to the first acquisition module 61 and is used to acquire the changed file path when a change in the file system is detected;

[0118] A first matching module 63, coupled to the second acquisition module 62, is used to match the anti-tampering rule corresponding to the changed file path according to the changed file path;

[0119] The second matching module 64 is coupled to the first matching module 63 and is used to match the IP address and / or user name of the user corresponding to the tamper-proof rule in the whitelist information when the tamper-proof rule corresponding to the changed file path is matched;

[0120] The first release module 65 is coupled to the second matching module 64, and is used to release the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule when the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information.

[0121] In some embodiments, the change in the file system includes: creating, deleting or modifying the file system.

[0122] In some of the embodiments, the device further includes: a generating module for generating an operation log of the operation process of the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, and storing the operation log.

[0123] In some of the embodiments, the device also includes: a prohibition module, which is used to prohibit user operations corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule when the IP address and / or user name of the user corresponding to the anti-tampering rule is not matched in the whitelist information.

[0124] In some of the embodiments, the device also includes: a first conversion module, used to convert the whitelist information into kernel-state whitelist information recognizable in kernel-state, and generate a correspondence between the whitelist information and the kernel-state whitelist information; a third acquisition module, used to obtain the changed file path when a change in the file system is detected; a third matching module, used to match the anti-tampering rules corresponding to the changed file path in kernel-state according to the changed file path; a fourth matching module, used to convert the anti-tampering rules into kernel-state anti-tampering rules recognizable in kernel-state, and match the kernel-state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel-state anti-tampering rules in kernel-state when the anti-tampering rules corresponding to the changed file path are matched in kernel-state; a second release module, used to release the user operation corresponding to the IP address and / or user name of the user corresponding to the kernel-state anti-tampering rules when the kernel-state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel-state anti-tampering rules is matched in kernel-state.

[0125] In some embodiments, the conversion module includes: a first conversion unit, configured to convert the user's IP address in the whitelist information into a SessionID recognizable in kernel mode, and generate a correspondence between the user's IP address in the whitelist information and the SessionID.

[0126] In some of the embodiments, the conversion module further includes: a second conversion unit, configured to convert the user name in the whitelist information into a UserID recognizable in the kernel state, and generate a correspondence between the user name in the whitelist information and the UserID recognizable in the kernel state.

[0127] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0128] This embodiment further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0129] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0130] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0131] S201, obtaining whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and the anti-tampering rule corresponding to the file path.

[0132] S202, when a change in the file system is detected, obtaining a changed file path.

[0133] S203: According to the changed file path, match the anti-tampering rule corresponding to the changed file path.

[0134] S204: When an anti-tampering rule corresponding to the changed file path is matched, the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information.

[0135] S205: When the IP address and / or user name of the user corresponding to the anti-tampering rule is matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is allowed.

[0136] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0137] In addition, in combination with the anti-tampering method supporting a user whitelist in the above embodiment, the embodiment of the present application can provide a storage medium for implementation. The storage medium stores a computer program; when the computer program is executed by a processor, any of the anti-tampering methods supporting a user whitelist in the above embodiment is implemented.

[0138] Those skilled in the art should understand that the technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0139] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A tamper-proof method supporting a user whitelist, characterized in that: include: Obtaining whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and an anti-tampering rule corresponding to the file path, which is used to prevent the IP address and / or user name of the user in the blacklist from tampering with the website content or the content corresponding to the file path; Converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a correspondence between the whitelist information and the kernel-state whitelist information, including: converting the IP address of the user in the whitelist information into a SessionID recognizable in kernel state, and generating a correspondence between the IP address of the user in the whitelist information and the SessionID; converting the user name in the whitelist information into a UserID recognizable in kernel state, and generating a correspondence between the user name in the whitelist information and the UserID recognizable in kernel state; When a change in the file system is detected, the changed file path is obtained; According to the changed file path, matching the anti-tampering rule corresponding to the changed file path in the kernel state; In the case where an anti-tampering rule corresponding to the changed file path is matched in the kernel state, converting the anti-tampering rule into a kernel state anti-tampering rule recognizable in the kernel state, and matching the kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule in the kernel state; When the kernel state whitelist information corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is matched in the kernel state, the user operation corresponding to the user's IP address and / or user name corresponding to the kernel state anti-tampering rule is released.

2. The anti-tampering method supporting user whitelist according to claim 1, characterized in that: The change of the file system includes: creating, deleting or modifying the file system.

3. The anti-tampering method supporting user whitelist according to claim 1, characterized in that: After allowing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, the method further includes: An operation log is generated for the operation process of releasing the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule, and the operation log is stored.

4. The anti-tampering method supporting user whitelist according to claim 1, characterized in that: The method further comprises: When the IP address and / or user name of the user corresponding to the anti-tampering rule is not matched in the whitelist information, the user operation corresponding to the IP address and / or user name of the user corresponding to the anti-tampering rule is prohibited.

5. An anti-tampering device supporting a user whitelist, characterized in that: include: A first acquisition module is used to acquire whitelist information and anti-tampering rule information, wherein the whitelist information includes the user's IP address and / or user name; the anti-tampering rule information includes a file path and an anti-tampering rule corresponding to the file path, which is used to prevent the IP address and / or user name of the user in the blacklist from tampering with the website content or the content corresponding to the file path; A conversion module, used for converting the whitelist information into kernel-state whitelist information recognizable in kernel state, and generating a correspondence between the whitelist information and the kernel-state whitelist information, including: converting the IP address of the user in the whitelist information into a SessionID recognizable in kernel state, and generating a correspondence between the IP address of the user in the whitelist information and the SessionID; converting the user name in the whitelist information into a UserID recognizable in kernel state, and generating a correspondence between the user name in the whitelist information and the UserID recognizable in kernel state; The third acquisition module is used to acquire the changed file path when a change in the file system is detected; A third matching module, configured to match, in the kernel state, an anti-tampering rule corresponding to the changed file path according to the changed file path; a fourth matching module, configured to, when an anti-tampering rule corresponding to the changed file path is matched in the kernel state, convert the anti-tampering rule into a kernel state anti-tampering rule recognizable in the kernel state, and match the kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule in the kernel state; The second release module is used to release the user operation corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule when the kernel state whitelist information corresponding to the IP address and / or user name of the user corresponding to the kernel state anti-tampering rule is matched in the kernel state.

6. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the anti-tampering method supporting a user whitelist according to any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the anti-tampering method supporting a user whitelist according to any one of claims 1 to 4 when running.

Images