A file association locking method and device

Abstract

The embodiment of the present invention provides a method and device for locking file associations, including: receiving a modification request for a first subkey under a registry root key, wherein the first subkey includes an access control item ACE indicating denial of writing and deletion; according to the ACE, refusing to modify the file opening method information in the first subkey according to the modification request; when it is determined that the modification of the file opening method information fails, detecting whether the path from the registry root key to the first subkey is included in a locked list, wherein the locked list is used to store the path of the subkey corresponding to the file extension that is prohibited from being modified; if included, returning a modification response indicating successful modification. By applying the technical solution provided by the embodiment of the present invention, the file opening method information associated with the file extension can be locked through the ACE and the locked list, thereby realizing file association locking at the application layer.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a file association locking method and device. Background Art

[0002] In a computer, files are opened by applications associated with file extensions. The file opening information such as the application associated with the file extension is stored in the subkey of the file extension under the root key of the registry. Attackers can use some malicious programs to modify the file opening information stored in the subkey to tamper with the application associated with the file extension, thereby achieving the purpose of image hijacking or self-starting. To solve this problem, a method for locking file associations is proposed.

[0003] At present, the locking method of file association is realized by a monitor. Specifically, a monitor is registered to monitor the operation of the registry in real time. When a malicious program wants to tamper with the file opening method information in the subkey under the registry root key, the monitor will prevent the malicious program from tampering with the file opening method information in the subkey, thereby realizing the locking of file association. However, the registration of this monitor needs to be implemented in the driver layer, so only some heavyweight security software or ARK (AntiRootkit, anti-kernel) tools and other software with the highest system authority can realize the registration of the monitor in the driver layer, which plays the effect of file association locking. For applications that only work in the application layer, since it cannot install a kernel module to access the address space of the kernel mode, it is impossible to involve the operation of the driver layer, and it is extremely difficult to monitor the registry operation by registering a monitor to realize file association locking. Summary of the invention

[0004] The purpose of the embodiment of the present invention is to provide a file association locking method and device to achieve file association locking at the application layer. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a method for locking a file association, comprising:

[0006] Receiving a modification request for a first subkey under a registry root key, wherein the first subkey includes an ACE (Access Control Entry) indicating denying write and delete;

[0007] According to the ACE, refusing to modify the file opening mode information in the first subkey according to the modification request;

[0008] When it is determined that the modification of the file opening mode information fails, detecting whether the locked list includes the path from the registry root key to the first subkey, the locked list being used to store the paths of the subkeys corresponding to the file extensions that are prohibited from being modified;

[0009] If included, a modification response indicating that the modification was successful is returned.

[0010] Optionally, the method further includes:

[0011] Get the extension of the file to be locked;

[0012] Obtain the second subkey corresponding to the extension of the file to be locked under the registry root key;

[0013] adding the ACE in the second subkey;

[0014] The path from the registry root key to the second subkey is stored in the locked list.

[0015] Optionally, the number of ACE groups in the first subkey is greater than or equal to 2.

[0016] Optionally, after refusing to modify the file opening mode information in the first subkey according to the modification request according to the ACE, the method further includes:

[0017] Generate a file association modification failure event;

[0018] The step of detecting whether the locked list includes the path from the registry root key to the first subkey after determining that the modification of the file opening mode information fails comprises:

[0019] When a file association modification failure event is detected, it is detected whether the locked list includes a path from the registry root key to the first subkey.

[0020] Optionally, the method further includes:

[0021] Register the file association changed event;

[0022] The step of receiving a modification request for the first subkey under the registry root key includes:

[0023] After an event that a file association of a first subkey under a registry root key is changed is monitored, it is determined that a modification request for the first subkey is received.

[0024] In a second aspect, an embodiment of the present invention further provides a file association locking device, comprising:

[0025] A receiving unit, configured to receive a modification request for a first subkey under a registry root key, wherein the first subkey includes an ACE indicating a denial of writing and deleting;

[0026] a modification rejection unit, configured to reject, according to the ACE, the modification of the file opening mode information in the first subkey according to the modification request;

[0027] a detection unit, configured to detect whether a path from the registry root key to the first subkey is included in a locked list after determining that the modification of the file opening mode information fails, wherein the locked list is used to store paths of subkeys corresponding to file extensions that are prohibited from being modified;

[0028] The returning unit is used to return a modification response indicating that the modification is successful if the locked list includes the path from the registry root key to the first subkey.

[0029] Optionally, the device further comprises:

[0030] A first obtaining unit, used for obtaining the extension of the file to be locked;

[0031] A second acquisition unit is used to acquire a second subkey corresponding to the extension of the file to be locked under the registry root key;

[0032] an adding unit, configured to add the ACE in the second subkey;

[0033] The storage unit is used to store the path from the registry root key to the second subkey in the locked list.

[0034] Optionally, the number of ACE groups in the first subkey is greater than or equal to 2.

[0035] Optionally, the device further comprises:

[0036] A generating unit, configured to generate a file association modification failure event after refusing to modify the file opening mode information in the first subkey according to the modification request according to the ACE;

[0037] The detection unit is specifically used to detect whether the locked list includes the path from the registry root key to the first subkey when a file association modification failure event is monitored.

[0038] Optionally, the device further comprises:

[0039] Registration unit, used to register file association change events;

[0040] The receiving unit is specifically configured to determine that a modification request for a first subkey under a registry root key has been received after monitoring an event that a file association for the first subkey under the registry root key has been changed.

[0041] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0042] Memory, used to store computer programs;

[0043] The processor is used to implement the steps of any of the file-related locking methods when executing a program stored in the memory.

[0044] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the file-associated locking methods are implemented.

[0045] A method and device for locking file associations provided by an embodiment of the present invention stores the path of a subkey that is prohibited from being modified under a registry root key into a locked list, and adds an ACE that denies writing and deleting in the subkey. Through the ACE, any program is denied to modify the file opening method information in the subkey. In addition, through the locked list, a modification response indicating successful modification is returned. In this way, the attacker will think that he has successfully modified the file opening method information in the subkey and will not modify the file opening method information in the subkey again. It can be seen that in the embodiment of the present invention, the file opening method information associated with the file extension is successfully locked through the ACE and the locked list, thereby achieving the locking of the file association. The subkey and the locked list are located in the application layer, and the application program of the application layer can access the subkey and the locked list, thereby achieving file association locking at the application layer.

[0046] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flow chart of a file association locking method provided by an embodiment of the present invention;

[0049] Figure 2 A flow chart of an information configuration method provided by an embodiment of the present invention;

[0050] Figure 3 A structural diagram of a file-associated locking device provided in an embodiment of the present invention;

[0051] Figure 4 A structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] To facilitate understanding, the terms appearing in the embodiments of the present application are explained below.

[0054] The registry is an important database used to store the setting information of the operating system and applications.

[0055] Root key: The lowest level key in the registry, similar to the root directory on a disk.

[0056] Subkey: Subkeys are located under the root key and can also nest other subkeys. There are several subkeys in the five root keys of the registry, and each subkey can nest thousands of subkeys. The subkey contains key values, which can be composed of names, data types, and assigned values.

[0057] In a computer, files are opened by applications associated with file extensions. Attackers can use some malicious programs to modify the file opening information stored in the subkey to tamper with the applications associated with the file extensions, thereby achieving the purpose of image hijacking or self-starting. To solve this problem, a file association locking method is proposed. At present, the file association locking method is implemented through a monitor. Specifically, a monitor is registered to monitor the operation of the registry in real time, but the registration of such a monitor needs to be implemented in the driver layer, so the file association locking effect can only be achieved in the software with the highest system authority. For applications working in the application layer, since it is not easy to install kernel modules to access the address space of the kernel mode, it is impossible to involve the operation of the driver layer.

[0058] In order to enable applications working at the application layer to prevent any application from modifying file associations without unlocking authorization and to implement locking of file associations at the application layer, an embodiment of the present invention discloses a method and device for locking file associations, which are described in detail below.

[0059] like Figure 1 As shown, Figure 1A flow chart of a file association locking method provided in an embodiment of the present invention. The method can be applied to an electronic device. The operating system of the electronic device can be a Windows system. In the electronic device, each subkey under the registry root key stores file opening method information, and a subkey corresponds to a file extension. For a file with a file extension, the electronic device can open the file according to the file opening method information stored in the subkey corresponding to the file extension. For ease of description, the following description is based on the electronic device as the execution subject. The file association locking method includes the following steps.

[0060] Step 101: Receive a modification request for a first subkey under a registry root key, wherein the first subkey includes an ACE indicating denying writing and deleting.

[0061] The first subkey is any subkey under the registry root key. Here, only the first subkey is used as an example for explanation, and it does not serve as a limitation.

[0062] In the embodiment of the present invention, when a malicious program or an operating system of an electronic device modifies the first subkey under the registry root key, the electronic device receives a modification request for the first subkey under the registry root key. The first subkey includes an ACE indicating denying write and delete.

[0063] In one embodiment, the electronic device pre-registers a file association change event, and monitors the file association change event in real time. After monitoring the file association change event, the electronic device determines that a modification request for the first subkey under the registry root key is received.

[0064] For example, the electronic device pre-registers a file association change event, and uses a monitoring function, such as SHChangeNotifyRegister, to monitor the file association change event. When SHChangeNotifyRegister monitors the file association change event, the electronic device determines that a modification request for the first subkey under the registry root key is received.

[0065] Step 102: According to ACE, deny modifying the file opening mode information in the first subkey according to the modification request.

[0066] An ACE is added to the subkey, and the electronic device can refuse any application to write and delete the information in the subkey through the ACE. That is, the electronic device refuses to modify the file opening mode information in the first subkey according to the modification request according to the ACE.

[0067] In one embodiment, the number of groups of ACE in the first subkey is greater than or equal to 2. For example, the number of groups of ACE in the first subkey is 2. When an operating system, such as a Windows system, modifies the file opening method information in the first subkey, the electronic device deletes a group of ACE in the first subkey. When a malicious program or the Windows system modifies the file opening method information in the first subkey again, the electronic device can still refuse to modify the file opening method information in the first subkey according to the modification request through the remaining group of ACE. By adding greater than or equal to 2 groups of ACEs indicating rejection of writing and deletion in the subkey, the stability of the file association lock is improved.

[0068] Step 103, when it is determined that the file opening mode information modification fails, it is detected whether the locked list includes the path from the registry root key to the first subkey, the locked list being used to store the path of the subkey corresponding to the file extension that is prohibited from being modified. If it does, step 104 is executed.

[0069] The electronic device stores a locked list. The locked list stores the paths of subkeys corresponding to file extensions that are prohibited from being modified. Here, the path of the subkey refers to the path from the registry root key to the subkey.

[0070] After determining that the file opening mode information modification fails, the electronic device detects whether the locked list includes the path from the registry root key to the first subkey. If it is detected that the locked list includes the path from the registry root key to the first subkey, it is determined that the file opening mode information stored in the first subkey is prohibited from being modified, and the first subkey is a subkey corresponding to the file extension that is prohibited from being modified, and step 104 is executed.

[0071] If it is detected that the locked list does not include the path from the registry root key to the first subkey, the current processing is terminated.

[0072] Step 104: Return a modification response indicating that the modification is successful.

[0073] When it is detected that the locked list includes a path from the registry root key to the first subkey, the electronic device returns a modification response indicating successful modification to the application or operating system that initiated the modification request for the first subkey. After receiving the modification response indicating successful modification, the application or operating system will consider that it has successfully modified the file opening method information in the subkey and will not modify the file opening method information in the subkey again.

[0074] Through the embodiment of the present invention, the file opening method information associated with the file extension is successfully locked through ACE and the locked list, thereby realizing the locking of the file association. The subkey and the locked list are located at the application layer, and the application program of the application layer can access the subkey and the locked list, thereby realizing the locking of the file association at the application layer.

[0075] In one embodiment, the electronic device pre-registers a file association modification failure event. After the electronic device modifies the file opening method in the first subkey, the file association modification failure event is generated. At this time, the electronic device can monitor the file association modification failure event, determine that the file opening method information modification fails, and then detect whether the locked list includes the path from the registry root key to the first subkey.

[0076] The electronic device can call the monitoring function of the API (Application Program Interface) in the operating system to monitor the file association modification failure event. When the file association modification failure event is monitored, it detects whether the locked list includes the path from the registry root key to the first subkey.

[0077] In one embodiment, based on the above-mentioned file association locking method, the embodiment of the present invention also provides an information configuration method, referring to Figure 2 , which may specifically include the following steps.

[0078] Step 201, obtaining the extension of the file to be locked.

[0079] The extension of the file to be locked may be sent to the electronic device by other electronic devices, or may be input to the electronic device by a user, or may be obtained by the electronic device from a preset database. This embodiment of the present invention does not specifically limit this.

[0080] Step 202: Obtain the second subkey corresponding to the file extension to be locked under the registry root key.

[0081] The registry root key includes a large number of subkeys corresponding to file extensions. After obtaining the file extension to be locked, the electronic device obtains the subkey corresponding to the file extension to be locked as the second subkey.

[0082] Step 203, adding an ACE indicating denying writing and deleting in the second subkey.

[0083] One or more groups of ACEs indicating the denial of writing and deleting are added to the second subkey. One group of ACEs refers to an ACE indicating the denial of writing and deleting.

[0084] Step 204: Store the path from the registry root key to the second subkey in the locked list.

[0085] The electronic device obtains the second subkey, determines the path from the registry root key to the second subkey, and stores the determined path in the locked list.

[0086] In the embodiment of the present invention, the execution order of step 203 and step 204 is not limited.

[0087] After adding an ACE indicating denial of write and delete in the second subkey and storing the path from the registry root key to the second subkey in the locked list, you can Figure 1 The file association locking method shown locks the file opening mode information in the second subkey, thereby realizing the locking of the file association corresponding to the file extension to be locked.

[0088] In a file association locking method provided by an embodiment of the present invention, the path of the subkey that is prohibited from being modified under the registry root key is stored in a locked list, and an ACE that denies writing and deleting is added to the subkey. Through the ACE, any program is denied to modify the file opening method information in the subkey. In addition, through the locked list, a modification response indicating successful modification is returned. In this way, the attacker will think that he has successfully modified the file opening method information in the subkey and will not modify the file opening method information in the subkey again. It can be seen that in the embodiment of the present invention, the file opening method information associated with the file extension is successfully locked through the ACE and the locked list, thereby realizing the locking of the file association. The subkey and the locked list are located in the application layer, and the application program of the application layer can access the subkey and the locked list, thereby realizing the file association locking at the application layer.

[0089] Corresponding to the file-associated locking method embodiment, the present invention also provides a file-associated locking device. Figure 3 As shown, Figure 3 A structural diagram of a file-associated locking device provided in an embodiment of the present invention. The device includes:

[0090] The receiving unit 301 is used to receive a modification request for a first subkey under a registry root key, wherein the first subkey includes an ACE indicating denying writing and deleting;

[0091] The modification rejection unit 302 is used to reject, according to the ACE, the modification of the file opening mode information in the first subkey according to the modification request;

[0092] In one embodiment, the number of ACE groups in the above-mentioned first subkey is greater than or equal to 2.

[0093] The detection unit 303 is used to detect whether the locked list includes the path from the registry root key to the first subkey after determining that the modification of the file opening mode information fails, and the locked list is used to store the path of the subkey corresponding to the file extension that is prohibited from being modified;

[0094] The returning unit 304 is configured to return a modification response indicating successful modification if the locked list includes a path from the registry root key to the first subkey.

[0095] In one embodiment, the file association locking device provided by the embodiment of the present invention may further include:

[0096] A first obtaining unit, used for obtaining the extension of the file to be locked;

[0097] A second acquisition unit is used to acquire a second subkey corresponding to the extension of the file to be locked under the root key of the registry;

[0098] Add unit, used to add ACE in the second subkey;

[0099] A storage unit for storing the path from the registry root key to the second subkey in the locked list.

[0100] In one embodiment, the file association locking device provided by the embodiment of the present invention may further include:

[0101] A generating unit, configured to generate a file association modification failure event after refusing to modify the file opening mode information in the first subkey according to the modification request according to the ACE;

[0102] The detection unit 303 may be specifically configured to detect whether the locked list includes a path from a registry root key to a first subkey when a file association modification failure event is detected.

[0103] In one embodiment, the file association locking device provided by the embodiment of the present invention may further include:

[0104] Registration unit, used to register file association change events;

[0105] The receiving unit 301 may be specifically configured to determine that a modification request for the first subkey is received after an event that a file association for the first subkey under the registry root key is modified is detected.

[0106] In a file association locking device provided by an embodiment of the present invention, the path of the subkey that is prohibited from being modified under the registry root key is stored in a locked list, and an ACE that denies writing and deleting is added to the subkey. Through the ACE, any program is denied to modify the file opening method information in the subkey. In addition, through the locked list, a modification response indicating a successful modification is returned. In this way, the attacker will think that he has successfully modified the file opening method information in the subkey and will not modify the file opening method information in the subkey again. It can be seen that in the embodiment of the present invention, the file opening method information associated with the file extension is successfully locked through the ACE and the locked list, thereby realizing the locking of the file association. The subkey and the locked list are located in the application layer, and the application program of the application layer can access the subkey and the locked list, thereby realizing the file association locking at the application layer.

[0107] Corresponding to the locking method embodiment associated with a file, the embodiment of the present invention further provides an electronic device, such as Figure 4As shown, it includes a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0108] Memory 403, used for storing computer programs;

[0109] The processor 401 is used to execute the program stored in the memory 403 to implement the following steps:

[0110] Receive a modification request for a first subkey under a registry root key, the first subkey including an ACE indicating denying write and delete;

[0111] According to ACE, the modification of the file opening mode information in the first subkey according to the modification request is denied;

[0112] When it is determined that the modification of the file opening mode information fails, detecting whether the locked list includes the path from the registry root key to the first subkey, the locked list being used to store the path of the subkey corresponding to the file extension that is prohibited from being modified;

[0113] If included, a modification response indicating that the modification was successful is returned.

[0114] In an electronic device provided by an embodiment of the present invention, the path of the subkey that is prohibited from being modified under the root key of the registry is stored in a locked list, and an ACE that denies writing and deleting is added to the subkey. Through the ACE, any program is denied to modify the file opening method information in the subkey. In addition, through the locked list, a modification response indicating a successful modification is returned. In this way, the attacker will think that he has successfully modified the file opening method information in the subkey and will not modify the file opening method information in the subkey again. It can be seen that in the embodiment of the present invention, the file opening method information associated with the file extension is successfully locked through the ACE and the locked list, thereby realizing the locking of the file association. The subkey and the locked list are located in the application layer, and the application program of the application layer can access the subkey and the locked list, thereby realizing the file association locking at the application layer.

[0115] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0116] The communication interface is used for communication between the above electronic device and other devices.

[0117] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0118] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0119] Corresponding to the embodiments of the file-associated locking method, an embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned file-associated locking methods are implemented.

[0120] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0121] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, and computer-readable storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0122] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method for locking file associations, which implements locking of file associations at the application layer, characterized in that: include: Receive a modification request for a first subkey under a registry root key, wherein the first subkey includes an access control item ACE indicating denying writing and deleting; wherein each subkey under the registry root key stores file opening mode information, one subkey corresponds to one file extension, and the file is opened according to the file opening mode information stored in the subkey corresponding to the file extension; the first subkey is any subkey under the registry root key; According to the ACE, refusing to modify the file opening mode information in the first subkey according to the modification request; When it is determined that the modification of the file opening mode information fails, detecting whether the locked list includes the path from the registry root key to the first subkey, the locked list being used to store the paths of the subkeys corresponding to the file extensions that are prohibited from being modified; If included, a modification response indicating that the modification was successful is returned.

2. The method according to claim 1, characterized in that The method further comprises: Get the extension of the file to be locked; Obtain the second subkey corresponding to the extension of the file to be locked under the registry root key; adding the ACE in the second subkey; The path from the registry root key to the second subkey is stored in the locked list.

3. The method according to claim 1, characterized in that The number of ACE groups in the first subkey is greater than or equal to 2.

4. The method according to claim 1, characterized in that: After refusing to modify the file opening mode information in the first subkey according to the modification request according to the ACE, the method further includes: Generate a file association modification failure event; The step of detecting whether the locked list includes the path from the registry root key to the first subkey after determining that the modification of the file opening mode information fails comprises: When a file association modification failure event is detected, it is detected whether the locked list includes a path from the registry root key to the first subkey.

5. The method according to claim 1, characterized in that The method further comprises: Register the file association changed event; The step of receiving a modification request for the first subkey under the registry root key includes: After an event that a file association of a first subkey under a registry root key is changed is monitored, it is determined that a modification request for the first subkey is received.

6. A file association locking device, which implements file association locking at the application layer, characterized in that: include: A receiving unit, configured to receive a modification request for a first subkey under a registry root key, wherein the first subkey includes an access control item ACE indicating denial of writing and deletion; wherein each subkey under the registry root key stores file opening method information, one subkey corresponds to one file extension, and the file is opened according to the file opening method information stored in the subkey corresponding to the file extension; the first subkey is any subkey under the registry root key; a modification rejection unit, configured to reject, according to the ACE, the modification of the file opening mode information in the first subkey according to the modification request; a detection unit, configured to detect whether a path from the registry root key to the first subkey is included in a locked list after determining that the modification of the file opening mode information fails, wherein the locked list is used to store paths of subkeys corresponding to file extensions that are prohibited from being modified; The returning unit is used to return a modification response indicating that the modification is successful if the locked list includes the path from the registry root key to the first subkey.

7. The device according to claim 6, characterized in that The device also includes: A first obtaining unit, used for obtaining the extension of the file to be locked; A second acquisition unit is used to acquire a second subkey corresponding to the extension of the file to be locked under the registry root key; an adding unit, configured to add the ACE in the second subkey; The storage unit is used to store the path from the registry root key to the second subkey in the locked list.

8. The device according to claim 6, characterized in that The number of ACE groups in the first subkey is greater than or equal to 2.

9. The device according to claim 6, characterized in that The device also includes: A generating unit, configured to generate a file association modification failure event after refusing to modify the file opening mode information in the first subkey according to the modification request according to the ACE; The detection unit is specifically used to detect whether the locked list includes the path from the registry root key to the first subkey when a file association modification failure event is monitored.

10. The device according to claim 6, characterized in that The device also includes: Registration unit, used to register file association change events; The receiving unit is specifically configured to determine that a modification request for a first subkey under a registry root key has been received after monitoring an event that a file association for the first subkey under the registry root key has been changed.

11. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 5 when executing a program stored in a memory.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 5 are implemented.

Images