File protection method, device, storage medium and electronic device

Abstract

The embodiment of the present invention provides a file protection method, device, storage medium and electronic device, wherein the method includes obtaining the node value of the target file when it is determined that the target process needs to perform target processing on the target file; detecting the authorization status of the target process according to the identification ID of the process in the policy file when the node value of the target file meets the first condition, wherein the node value is used to identify the target file; and controlling the target process to perform target processing on the target file when it is detected that the target process has been authorized. The present invention solves the problem that the user behavior of illegally operating privacy data in the related art cannot be effectively intercepted, thereby achieving the effect of effectively intercepting the user behavior of illegally operating privacy data and enhancing the privacy protection capability.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of cloud system network security, and in particular, to a file protection method, device, storage medium and electronic device. Background Art

[0002] As users pay more attention to personal privacy, many privacy protection schemes have been proposed to prevent personal privacy data from being leaked. Although these schemes ensure the security of users' privacy data to a certain extent, they are unable to prompt users and intercept user behaviors when users violate regulations in operating privacy data.

[0003] At the same time, as various countries and regions have introduced various personal data privacy protection laws, the protection of personal privacy data has been raised to the national level. Under this premise, how to actively and effectively detect illegal operations that do not comply with laws and regulations and prevent and feedback them, so as to effectively protect personal privacy data and make products compliant, has become a focus of concern for cloud system suppliers and users. Summary of the invention

[0004] The embodiments of the present invention provide a file protection method, device, storage medium and electronic device to at least solve the problem in the related art that user behaviors of illegally operating privacy data cannot be effectively intercepted.

[0005] According to an embodiment of the present invention, a file protection method is provided, comprising:

[0006] In the case of determining that the target process needs to perform target processing on the target file, obtaining a node value of the target file, wherein the node value is used to identify the target file;

[0007] In the case where the node value of the target file satisfies the first condition, detecting the authorization status of the target process according to the identification ID of the target process in the policy file, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process that performs target processing on the protected file;

[0008] In the case where it is detected that the target process is authorized, the target process is controlled to execute target processing on the target file.

[0009] In an exemplary embodiment, before obtaining the node value of the target file, the method further includes:

[0010] Creating a policy script, wherein the policy script includes the node value of the protected file and the ID of the authorized process;

[0011] Generate the policy file according to the policy script

[0012] In an exemplary embodiment, before obtaining the node value of the target file, the method further includes:

[0013] Reading the policy information corresponding to the target file recorded in the policy file;

[0014] In the case where it is determined that the policy information meets the predetermined requirement, the target file is associated with a processing function for performing target processing on the target file.

[0015] In an exemplary embodiment, after obtaining the node value of the target file, the method further includes:

[0016] Obtain a first node value, wherein the first node value is a node value of the target file included in the policy file;

[0017] When it is determined that the first node value is not 0, matching the node value of the target file with the first node value;

[0018] In the case of determining a match, determining that the node value of the target file satisfies the first condition;

[0019] In the case of determining that there is no match, it is determined that the node value of the target file does not satisfy the first condition.

[0020] In an exemplary embodiment, after obtaining the first node value, the method further includes:

[0021] When the first node value is 0, read the full path of the target file;

[0022] Matching the full path of the target file with the full path of the protected file included in the policy file;

[0023] When a match is determined, the node value of the target file is saved in the policy file to update the node value stored in the policy file.

[0024] In an exemplary embodiment, detecting the authorization status of the target process according to the ID of the target process includes:

[0025] Determine whether the policy file contains the ID of the target process;

[0026] The authorization status of the target process is determined based on the judgment result, wherein when the judgment result is included, the target process is determined to be an authorized process.

[0027] In an exemplary embodiment, after determining whether the policy file contains the ID of the target process, the method further includes:

[0028] If the result of the judgment is that the target process is not included, obtaining file information of the disk file of the target process, wherein the file information includes the file length and the file summary;

[0029] Matching the file information of the disk file of the target process with the file information of the authorized process included in the policy file;

[0030] Based on the matching result between the file information of the disk file of the target process and the file information of the authorized process included in the policy file, the authorization status of the target process is determined, wherein when the matching result is a match, the target process is determined to be an authorized process, and when the matching result is a mismatch, the target process is determined to be an unauthorized process.

[0031] In an exemplary embodiment,

[0032] The step of determining whether the policy file contains the ID of the target process includes:

[0033] Determine whether the PID array in the policy file contains the ID of the target process, wherein the PID array is used to store the ID of the process that performs target processing on the protected file;

[0034] In a case where the file information of the target file matches the file information of the protected file included in the policy file, the method further includes: inserting the ID of the target process into the PID array.

[0035] According to another embodiment of the present invention, there is provided a file protection device, comprising:

[0036] A node value acquisition module, used for acquiring a node value of a target file when it is determined that a target process needs to access the target file, wherein the node value is used to identify the target file;

[0037] an authorization detection module, configured to detect the authorization status of the target process according to an identification ID of the target process in a policy file when the node value of the target file satisfies a first condition, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process to access the protected file;

[0038] The processing module is used to control the target process to perform target processing on the target file when it is detected that the target process has been authorized.

[0039] According to yet another embodiment of the present invention, a storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when running.

[0040] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0041] Through the present invention, since the node value of the target file and the ID of the target process are judged respectively, the problem of being unable to effectively intercept user behaviors that illegally operate privacy data can be solved, thereby achieving the effect of preventing unauthorized processes from accessing protected files. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a hardware structure block diagram of a mobile terminal of a file protection method according to an embodiment of the present invention;

[0043] Figure 2 is a flow chart of a file protection method according to an embodiment of the present invention;

[0044] Figure 3 is a structural block diagram of a file protection device according to an embodiment of the present invention;

[0045] Figure 4 is a structural schematic diagram showing a file protection process in an embodiment of the present invention;

[0046] Figure 5 is a flow chart showing a file protection process according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0047] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0049] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a file protection method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0050] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to a file protection method in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0052] In this embodiment, a file protection method is provided. Figure 2 is a flow chart according to an embodiment of the present invention, such as Figure 2 As shown, the process includes the following steps:

[0053] Step S202, when it is determined that the target process needs to perform target processing on the target file, obtaining a node value of the target file, wherein the node value is used to identify the target file;

[0054] In this embodiment, the target process is used to execute the action of performing target processing on the target condition. The target process can be a program, a script file, or a process function, as long as it can execute the target processing action; the target processing can (but is not limited to) include decrypting or encrypting the target file, copying or transferring the target file, or destroying the target file; the node value can be composed of multiple pure numbers, or a combination of multiple numbers and letters, or a single number or letter, as long as it can identify the target file; wherein, the node value can contain file information of the target file, such as the full path, file length, file size and other information, or it can be a random number or letter that does not contain file information of the target file.

[0055] It should be noted that the node value of the target file can be obtained by (but not limited to) identifying the node value, or the target file can send the node value to the target process, as long as the node value of the target file can be collected.

[0056] Step S204, when the node value of the target file meets the first condition, detecting the authorization status of the target process according to the ID (Idengtity document, identity number) of the target process in the policy file, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process that performs target processing on the protected file;

[0057] In this embodiment, the ID of the target process can be composed of multiple pure numbers, or a combination of multiple numbers and letters, or a single number or letter, as long as it can identify the target process; wherein, the ID of the target process can include process information of the target process, such as process path, process size and other information, or it can be a random number or letter that does not include process information of the target process; the policy file can (but is not limited to) include node values ​​of protected files and file information of protected files on the basis of including permissions for processes to access protected files.

[0058] Among them, the process of the policy file determining the authority of the process to access the protected file can be determined by comparing the ID of the target process with the ID of the process in the policy file. For example, if the ID of the target process is the same as the ID of the process in the policy file, the target process is determined to be an authorized process, otherwise it is an unauthorized process, and the target processing is refused to execute; it can also be determined by a preset algorithm, or it can be determined by other methods, as long as the authorization status of the target process can be determined.

[0059] Step S206, when it is detected that the target process has been authorized, control the target process to perform target processing on the target file.

[0060] Through the above steps, since the node value of the target file and the ID of the target process are judged respectively, the problem that the user behavior cannot be effectively intercepted when the user illegally operates the privacy data can be solved, thereby achieving the effect of preventing unauthorized processes from accessing protected files.

[0061] In an optional embodiment, before obtaining the node value of the target file, the method further includes:

[0062] Step S2002, creating a policy script, wherein the policy script includes the node value of the protected file and the ID of the authorized process;

[0063] Step S2004, generating a policy file according to the policy script.

[0064] In this embodiment, when creating a policy script, the file information of the protected file and the access rights of the protected file are filled in and saved, wherein the file information of each protected file includes the path and node value of the file respectively. In addition, the policy script may also include a list of authorized processes that can perform target processing on the file, the corresponding rights to execute the target processing of each authorized process, etc.; wherein the list of authorized processes that can perform target processing on the file includes at least a list of IDs of authorized processes, and may also include other information; and the corresponding rights to execute the target processing of each authorized process may be the rights for one process to execute multiple target processing, or may be the rights for one target processing to be implemented jointly or individually by multiple processes; for example, when decrypting the target file, it may be completed by a process including the SYS_READ function (System read), or it may be completed independently or jointly by multiple processes including the SYS_READE function.

[0065] After the policy script is created, the language in the policy script is converted into a language that can be recognized and read by the machine device, thereby generating a policy file; for example, a non-binary language is converted into a binary language, or Chinese characters are converted into a programming language such as Java.

[0066] It should be noted that, in the policy file after the language conversion is completed, the data structure of the protected file contains at least the file type, the full path name of the file, the length of the full path name of the file, the length of the file itself, the file summary (hash), the file access rights, the file node number and the process number list of the authorized program, etc.; the data structure of the authorized process contains at least the full path name of the authorized process, the full path name length of the authorized process, the access rights of the authorized process to the protected file, the process file length of the authorized process, the file summary of the authorized process (calculated by hash) and the inserted matching process ID (authorized access), etc.

[0067] In an optional embodiment, before obtaining the node value of the target file, the method further includes:

[0068] Step S2006, reading the policy information corresponding to the target file recorded in the policy file;

[0069] Step S2008: When it is determined that the policy information meets the predetermined requirement, the target file is associated with a processing function for processing the target file.

[0070] In this embodiment, the policy information includes at least file information corresponding to the target file and the ID of the authorized process; the policy information can be read by the policy file sending the policy information to the corresponding reading device, or by the reading device copying the policy information, as long as the policy information can be read.

[0071] The predetermined requirement may be that the read policy information is error-free compared with the preset policy information, or that the policy information is determined to be error-free through a preset algorithm, for example, if the error probability of the read policy information is less than 0.1, the read policy information is determined to be correct; there may also be other requirements, which will not be elaborated here.

[0072] In an optional embodiment, after obtaining the node value of the target file, the method further includes:

[0073] Step S2022, obtaining a first node value, wherein the first node value is a node value of a target file included in the policy file;

[0074] Step S2024, when it is determined that the first node value is not 0, matching the node value of the target file with the first node value;

[0075] Step S2026, when a match is determined, determining whether the node value of the target file satisfies the first condition;

[0076] Step S2028: When it is determined that there is no match, it is determined that the node value of the target file does not satisfy the first condition.

[0077] In this embodiment, if the first node value obtained is not 0, it means that the corresponding target file is not used for the first time. At this time, it is only necessary to match the node value of the target file, which saves detection time and improves detection efficiency.

[0078] Among them, the matching process of the node value of the target file and the first node value can be to compare the node value of the target file with the first node value in the policy file in turn, or to search for the first node value according to the node value of the target file, or to match the first node value through a preset algorithm, for example, pre-store the storage location of the first node value, and when matching is required, indicate the storage location of the first node value corresponding to the node value of the target file according to the node value of the target file, and feed back the matching result.

[0079] It should be noted that, when the node value of the target file matches the first node value successfully, it indicates that the corresponding target file is a protected file, and the matching success information is fed back at the same time; the matching success information can be sent in the form of an analog signal or in the form of a digital signal; when the node value of the target file matches the first node value unsuccessfully, it indicates that the corresponding target file is a non-protected file, and the matching failure information is fed back at the same time, and the corresponding processing action for the target file is allowed to be executed.

[0080] In an optional embodiment, after obtaining the first node value, the method further includes:

[0081] Step S2030, when the first node value is 0, read the full path of the target file;

[0082] Step S2032, matching the full path of the target file with the full path of the protected file included in the policy file;

[0083] Step S2034: When a match is determined, the node value of the target file is saved in the policy file to update the node value stored in the policy file.

[0084] In this embodiment, if the first node value obtained is 0, it means that the target file is processed for the first time, and then the full path of the obtained target file is matched with the full path of the protected file stored in the policy file.

[0085] Among them, the matching process of the full path of the target file and the full path of the protected file included in the policy file can be to compare the full path of the target file with the full path of the protected file included in the policy file in sequence, or to search the full path of the protected file included in the policy file according to the full path of the target file, or to match the full path of the protected file included in the policy file through a preset algorithm, for example, pre-store the storage location of the full path of the protected file included in the policy file, and when matching is required, indicate the storage location of the full path of the protected file included in the policy file corresponding to the full path of the target file according to the full path of the target file, and feed back the matching result.

[0086] It should be noted that when the full path of the target file successfully matches the full path of the protected file included in the policy file, a successful match information is fed back; the successful match information can be sent in the form of an analog signal or a digital signal; when the full path of the target file fails to match the first node value, an unsuccessful match information is fed back.

[0087] Then, if the match is successful, the node value of the target file is saved in the policy file to update the node value stored in the policy file, so that the corresponding process only needs to compare the node value of the target file with the node value in the policy file when executing the processing action on the target file next time, thereby saving file matching time.

[0088] Among them, since the node value is a number or a combination of numbers and letters, the way to save the node value of the target file into the policy file can be to store the node value in a PID array that is convenient for machine identification, or to store it in a storage device, or other storage methods, which will not be repeated here.

[0089] In an optional embodiment, detecting the authorization status of the target process according to the ID of the target process includes:

[0090] Step S2042, determining whether the policy file contains the ID of the target process;

[0091] Step S2044, determining the authorization status of the target process based on the judgment result, wherein, when the judgment result is included, determining that the target process is an authorized process.

[0092] In this embodiment, the method for determining whether the policy file contains the ID of the target process may be to compare the ID of the target process with the IDs of the processes included in the policy file in sequence, or to determine by a preset algorithm, for example, by detecting by an algorithm whether the ID composition of the target process complies with preset rules, or to determine by other methods.

[0093] When the ID of the target process is consistent with the process ID included in the policy file, it is determined that the policy file contains the ID of the target process, and the target process is determined to be an authorized ID, that is, the target process is determined to be a legal operation; when the ID of the target process is inconsistent with the process ID included in the policy file, it is determined that the policy file does not contain the ID of the target process, and then it is determined whether the target process is an illegal process. At this time, it is necessary to further detect the authorization status of the target process through other means; for example, other process information of the target process can be obtained, and the other process information of the target process can be matched with the corresponding process information of the process in the policy file; among which, other process information can include (but is not limited to) the size, full path, permissions, file summary, etc. of the target process.

[0094] In an optional embodiment, after determining whether the policy file contains the ID of the target process, the method further includes:

[0095] Step S2046, when the judgment result is that the target process is not included, obtaining the file information of the disk file of the target process, wherein the file information includes the file length and the file summary;

[0096] Step S2048, matching the file information of the disk file of the target process with the file information of the authorized process included in the policy file;

[0097] Step S2050, based on the matching result of the file information of the disk file of the target process and the file information of the authorized process included in the policy file, determines the authorization status of the target process, wherein, if the matching result is a match, determines that the target process is an authorized process, and if the matching result is a mismatch, determines that the target process is an unauthorized process.

[0098] In this embodiment, the file information of the disk file of the target process may also include the file type, the length of the full path name of the file, the length of the file itself, the file summary (hash), the file access rights, the file node number and the process number list of the authorized program, etc.; the method of obtaining the file information of the disk file of the target process may be to read it through a reading device, or to obtain it through a preset algorithm; the process of matching the file information of the disk file of the target process with the file information of the authorized process included in the policy file may be the same as the matching method of the aforementioned information or node value, or it may be different, which will not be repeated here.

[0099] Among them, when the matching result is a match, the target process is determined to be an authorized process, and then the target operation corresponding to the target processing is executed; when the matching result is a mismatch, the target process is determined to be an unauthorized process, that is, the target process is an illegal operation. At this time, the target process is intercepted and a prompt is given. The prompt method can be broadcast through voice, displayed on the screen, or a combination of voice broadcast and screen display.

[0100] For example, when the ID of the target process is not included in the policy file, the file path of the process and the hash value of the process image are matched with the file path and hash value of the authorized process in the policy file. If a match is found, the process ID is recorded in the policy file. Subsequently, when the matching operation is performed again, there is no need to calculate the process file hash and match the full process path, thereby improving the file matching speed.

[0101] In an optional embodiment, determining whether the policy file contains the ID of the target process includes:

[0102] Step S2052, determining whether the PID (Packet Identifier) ​​array in the policy file contains the ID of the target process, wherein the PID array is used to store the ID of the process that performs target processing on the protected file;

[0103] In the case where the file information of the target file matches the file information of the protected file included in the policy file, the method further includes:

[0104] Step S2054, insert the ID of the target process into the PID array.

[0105] In this embodiment, the PID array can be used (but not limited to) to store numbers, and can also be used to store strings. Therefore, file information such as the full path and node value and process information such as the process ID can be stored in the PID array. When it is necessary to detect or match the file information or process information, the detection or matching can be performed by calling, or by scanning. In order to adapt to the expansion of the process or the target file, an empty storage area is reserved in the PID array, and the empty storage area is used to store the process information of the expanded process or the file information of the target file.

[0106] When inserting the target process ID into the PID array, the target process ID is inserted into the empty storage area of ​​the PID array to avoid data loss or error caused by the insertion of the target process ID. When re-accessing the target file or calling the corresponding target process, it is only necessary to match the corresponding target file node value or the target process ID.

[0107] It should be noted that the PID array can be stored in the PID data processing module or in other data storage devices, which will not be described in detail here.

[0108] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0109] In this embodiment, a file protection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0110] Figure 3 is a structural block diagram of a file protection device according to an embodiment of the present invention. Figure 3 As shown, the device comprises:

[0111] A node value acquisition module 32, for acquiring a node value of a target file when it is determined that the target process needs to access the target file, wherein the node value is used to identify the target file;

[0112] An authorization detection module 34 is used to detect the authorization status of the target process according to the identification ID of the target process in the policy file when the node value of the target file meets the first condition, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process to access the file to be protected;

[0113] The processing module 36 is used to control the target process to perform target processing on the target file when it is detected that the target process has been authorized.

[0114] In an optional embodiment, the device further comprises:

[0115] A script creation module, used to create a policy script before obtaining the node value of the target file, wherein the policy script includes the node value of the file to be protected and the ID of the authorized process;

[0116] The policy generation module is used to generate a policy file according to the policy script.

[0117] In an optional embodiment, the device further comprises:

[0118] A policy reading module is used to read the policy information corresponding to the target file recorded in the policy file before obtaining the node value of the target file;

[0119] The policy association module is used to associate the target file with a processing function for processing the target file when it is determined that the policy information meets the predetermined requirements.

[0120] In an optional embodiment, the node value collection module 32 includes:

[0121] A first node acquisition unit, configured to acquire a first node value after acquiring the node value of the target file, wherein the first node value is the node value of the target file included in the policy file;

[0122] A first node matching unit, configured to match the node value of the target file with the first node value when it is determined that the first node value is not 0;

[0123] A first condition determination unit, configured to determine, when a match is determined, whether a node value of a target file satisfies a first condition;

[0124] The second condition determination unit is used to determine, when a mismatch is determined, whether the node value of the target file satisfies the first condition.

[0125] In an optional embodiment, the node value collection module 32 further includes:

[0126] A path reading unit, used for reading the full path of the target file after obtaining the first node value and when the first node value is 0;

[0127] A path matching unit, used to match the full path of the target file with the full path of the file to be protected included in the policy file;

[0128] The node updating unit is used to save the node value of the target file into the policy file to update the node value stored in the policy file when a match is determined.

[0129] In an optional embodiment, the authorization detection module 34 further includes:

[0130] A process ID judgment unit, used to judge whether the policy file contains the ID of the target process;

[0131] The process authorization judgment unit is used to determine the authorization status of the target process based on the judgment result, wherein when the judgment result is included, it is used to determine that the target process is an authorized process.

[0132] In an optional embodiment, the authorization detection module 34 includes:

[0133] A file information acquisition unit, configured to obtain file information of a disk file of the target process after determining whether the policy file contains the ID of the target process, and if the determination result is that the ID of the target process is not contained, wherein the file information includes a file length and a file summary;

[0134] A file information matching unit, used to match the file information of the disk file of the target process with the file information of the authorized process included in the policy file;

[0135] A matching determination unit is used to determine the authorization status of the target process based on the matching result between the file information of the disk file of the target process and the file information of the authorized process included in the policy file, wherein if the matching result is a match, the target process is determined to be an authorized process, and if the matching result is a mismatch, the target process is determined to be an unauthorized process.

[0136] In an alternative embodiment,

[0137] The process ID determination unit includes:

[0138] A PID judgment subunit, used to judge whether the PID data in the policy file contains the ID of the target process, wherein the PID data is used to store the ID of the process accessing the file to be protected;

[0139] The matching determination unit includes:

[0140] The PID updating subunit is used to insert the ID of the target process into the PID array when the file information of the target file matches the file information of the protected file included in the policy file.

[0141] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0142] The present invention will be described below in conjunction with specific embodiments:

[0143] like Figure 4 and Figure 5 As shown, the kernel module ko first reads the policy file into memory (corresponding to Figure 5 Step S501); After verifying that the policy file is correct, the system kernel function SYS_READ and SYS_WRITE functions (corresponding to Figure 5 Step S502); After loading the external program, if you want to read the file, ko will first compare the node value of the target file (the only value after loading) with the node value saved in the policy file. If they are the same, it is a protected file (corresponding to Figure 5 Step S503).

[0144] If the protected node value is 0, it means that the file is used for the first time, then the full path of the file is matched with the full path stored in the policy file (corresponding to Figure 5 Step S504).

[0145] If the full path of the file matches the full path stored in the policy file, the node value of the file is saved to the node value in the policy (corresponding to Figure 5 Step S505). Then, based on the current process ID and the file number in the policy, query the PID array in the process in the policy process list to see if it is an authorized process (corresponding to Figure 5 Step S506).

[0146] If it cannot be found, it may be the first time that the process reads the protected file, so get its full path name (corresponding to Figure 5 Step S507); If it matches the full path description of the file in the policy file, then compare its file length and file summary (corresponding to Figure 5 Step S508).

[0147] If the file length and file digest are the same as those in the policy file, the process is authorized and the process ID is inserted into the PID array of the policy file (corresponding to Figure 5 Step S509), then the process completes data encryption or decryption (corresponding to Figure 5 Step S510); otherwise, it returns 0, indicating that the read or write operation is rejected (corresponding to Figure 5 Step S511).

[0148] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0149] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0150] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0151] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0152] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0153] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0154] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A file protection method, characterized in that: include: In the case of determining that the target process needs to perform target processing on the target file, obtaining a node value of the target file, wherein the node value is used to identify the target file; In the case where the node value of the target file satisfies the first condition, detecting the authorization status of the target process according to the identification ID of the target process in the policy file, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process that performs target processing on the protected file; In the case where it is detected that the target process has been authorized, controlling the target process to perform target processing on the target file; Wherein, after obtaining the node value of the target file, the method further includes: obtaining a first node value, wherein the first node value is the node value of the target file included in the policy file; when it is determined that the first node value is not 0, matching the node value of the target file with the first node value, wherein, when the target file is used for the first time, the first node value is 0; when a match is determined, determining that the node value of the target file satisfies the first condition; when a mismatch is determined, determining that the node value of the target file does not satisfy the first condition.

2. The method according to claim 1, characterized in that Before obtaining the node value of the target file, the method further includes: Creating a policy script, wherein the policy script includes the node value of the protected file and the ID of the authorized process; The policy file is generated according to the policy script.

3. The method according to claim 1, characterized in that: Before obtaining the node value of the target file, the method further includes: Reading the policy information corresponding to the target file recorded in the policy file; In the case where it is determined that the policy information meets the predetermined requirement, the target file is associated with a processing function for performing target processing on the target file.

4. The method according to claim 1, characterized in that After obtaining the first node value, the method further includes: When the first node value is 0, read the full path of the target file; Matching the full path of the target file with the full path of the protected file included in the policy file; When a match is determined, the node value of the target file is saved in the policy file to update the node value stored in the policy file.

5. The method according to claim 1, characterized in that The detecting the authorization status of the target process according to the ID of the target process includes: Determine whether the policy file contains the ID of the target process; The authorization status of the target process is determined based on the judgment result, wherein when the judgment result is included, the target process is determined to be an authorized process.

6. The method according to claim 5, characterized in that After determining whether the policy file contains the ID of the target process, the method further includes: If the result of the judgment is that the target process is not included, obtaining file information of the disk file of the target process, wherein the file information includes the file length and file summary of the disk file of the target process; Matching the file information of the disk file of the target process with the file information of the authorized process included in the policy file; Based on the matching result between the file information of the disk file of the target process and the file information of the authorized process included in the policy file, the authorization status of the target process is determined, wherein when the matching result is a match, the target process is determined to be an authorized process, and when the matching result is a mismatch, the target process is determined to be an unauthorized process.

7. The method according to claim 6, characterized in that The step of determining whether the policy file contains the ID of the target process includes: Determine whether the PID array in the policy file contains the ID of the target process, wherein the PID array is used to store the ID of the process that performs target processing on the protected file; In a case where the file information of the target file matches the file information of the protected file included in the policy file, the method further includes: inserting the ID of the target process into the PID array.

8. A file protection device, characterized in that: include: A node value acquisition module, used for acquiring a node value of a target file when it is determined that a target process needs to access the target file, wherein the node value is used to identify the target file; an authorization detection module, configured to detect the authorization status of the target process according to an identification ID of the target process in a policy file when the node value of the target file satisfies a first condition, wherein the ID of the target process is used to identify the target process, and the policy file is used to determine the authority of the process to access the protected file; A processing module, used for controlling the target process to perform target processing on the target file when it is detected that the target process has been authorized; The node value acquisition module includes: a first node acquisition unit, used to acquire a first node value after acquiring the node value of the target file, wherein the first node value is the node value of the target file included in the policy file; a first node matching unit, used to match the node value of the target file with the first node value when it is determined that the first node value is not 0, wherein the first node value is 0 when the target file is used for the first time; a first condition determination unit, used to determine that the node value of the target file satisfies a first condition when a match is determined; and a second condition determination unit, used to determine that the node value of the target file does not satisfy the first condition when a mismatch is determined.

9. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images