File integrity verification method, device, equipment and storage medium

Abstract

The present invention discloses a file integrity verification method, device, equipment and storage medium. The method includes: when receiving an access request from a process of a target application scenario, obtaining a system file corresponding to the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of an operating system; authenticating the tag information based on a security protection policy; when the tag information is authenticated, determining a target system file to which the process of the target application scenario has access rights from the obtained system file; and verifying the integrity of the determined target system file.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a file integrity verification method, device, equipment and storage medium. Background Art

[0002] With the continuous emergence of IoT devices, attacks on IoT operating systems are becoming more and more frequent. Most IoT devices have the characteristics of long-term operation and unattended operation. By ensuring the integrity of system files during the operation of IoT operating systems, the ability of IoT operating systems to resist attacks can be enhanced, and the security of IoT devices can be improved.

[0003] In related technologies, only the root user has the permission to modify system files. However, in actual applications, once an attacker exploits a system vulnerability to elevate root privileges to the operating system, system files can be tampered with at will, causing the integrity check of the system files to fail, affecting the security of IoT devices. Summary of the invention

[0004] In view of this, embodiments of the present invention are intended to provide a file integrity verification method, apparatus, device and storage medium.

[0005] The technical solution of the embodiment of the present invention is achieved as follows:

[0006] An embodiment of the present invention provides a file integrity verification method, which is applied to an electronic device, and the method includes:

[0007] When receiving an access request from a process of a target application scenario, obtaining a system file corresponding to the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system;

[0008] Authenticating the tag information based on a security protection strategy;

[0009] When the tag information is authenticated, determining a target system file to which the process of the target application scenario has access rights from the acquired system file;

[0010] The integrity of the determined target system file is verified.

[0011] In the above solution, the tag information at least includes the security context of the system file; and the authenticating the tag information based on the security protection policy includes:

[0012] Parsing the security protection policy to obtain the security context of the process of the target application scenario;

[0013] Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file;

[0014] Accordingly, when the tag information is authenticated, determining the target system file to which the process of the target application scenario has access rights from the acquired system file includes:

[0015] When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated;

[0016] The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

[0017] In the above solution, the checking of the integrity of the determined target system file includes:

[0018] When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value;

[0019] Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file;

[0020] Compare the first Hash value with the second Hash value to obtain a comparison result;

[0021] When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with;

[0022] When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

[0023] In the above scheme, the method further comprises:

[0024] After determining, from the acquired system files, a target system file to which the process of the target application scenario has access rights, assigning to the process of the target application scenario the operation rights that the process has after accessing the target system file;

[0025] Based on the operation authority, the operation of the process of the target application scenario on the target system file is controlled.

[0026] In the above solution, authenticating the tag information based on the security protection strategy includes:

[0027] Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system;

[0028] When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

[0029] In the above scheme, the method further comprises:

[0030] Generate an image file of the operating system;

[0031] Performing a hash operation on the image file of the operating system to obtain a third hash value;

[0032] Based on taking the third hash value as a reference value for starting the electronic device, it is determined whether the electronic device meets the trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

[0033] In the above solution, the image file of the operating system is stored in the virtual memory disk of the electronic device.

[0034] An embodiment of the present invention further provides a file integrity verification device, which is applied to an electronic device, and the device includes:

[0035] an acquisition unit, configured to acquire a system file corresponding to the target application scenario upon receiving an access request from a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, the tag information being configured based on a mandatory access control mechanism of the operating system;

[0036] An authentication unit, used to authenticate the tag information based on a security protection policy;

[0037] A first determining unit is used to determine, from the acquired system files, a target system file to which the process of the target application scenario has access rights when the tag information is authenticated;

[0038] The verification unit is used to verify the integrity of the determined target system file.

[0039] In the above solution, the tag information at least includes the security context of the system file; the authentication unit is specifically used to:

[0040] Parsing the security protection policy to obtain the security context of the process of the target application scenario;

[0041] Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file;

[0042] Accordingly, the first determining unit is specifically configured to:

[0043] When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated;

[0044] The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

[0045] In the above solution, the verification unit is specifically used for:

[0046] When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value;

[0047] Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file;

[0048] Compare the first Hash value with the second Hash value to obtain a comparison result;

[0049] When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with;

[0050] When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

[0051] In the above solution, the device further comprises:

[0052] an allocating unit, configured to allocate, to the process of the target application scenario, the operation permission after accessing the target system file, after the first determining unit determines the target system file to which the process of the target application scenario has access rights from the acquired system file;

[0053] A control unit is used to control the operation of the process of the target application scenario on the target system file based on the operation authority.

[0054] In the above solution, the authentication unit is specifically used for:

[0055] Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system;

[0056] When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

[0057] In the above scheme, the device also includes:

[0058] A generating unit, used to generate an image file of the operating system;

[0059] The second determination unit is used to perform a hash operation on the image file of the operating system to obtain a third hash value; and based on the third hash value as a reference value for starting the electronic device, determine whether the electronic device has a trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

[0060] An embodiment of the present invention further provides a file integrity verification device, the device comprising:

[0061] A communication interface, configured to obtain a system file corresponding to a target application scenario upon receiving an access request from a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, the tag information being configured based on a mandatory access control mechanism of the operating system;

[0062] The processor is used to authenticate the tag information based on the security protection policy; when the tag information is authenticated, determine the target system file to which the process of the target application scenario has access rights from the acquired system files; and verify the integrity of the determined target system file.

[0063] An embodiment of the present invention further provides a file integrity verification device, the device comprising: a processor and a memory for storing a computer program that can be run on the processor;

[0064] Wherein, when the processor is used to run the computer program, it executes the steps of any of the above methods provided by the embodiments of the present invention.

[0065] An embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods provided by the embodiment of the present invention are implemented.

[0066] The file integrity verification method, device, equipment and storage medium provided by the embodiment of the present invention, when receiving an access request from a process of a target application scenario, obtains a system file corresponding to the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on the mandatory access control mechanism of the operating system; the tag information is authenticated based on the security protection policy; when the tag information is authenticated, the target system file that the process of the target application scenario has access rights is determined from the acquired system file; the integrity of the determined target system file is verified to determine whether the integrity of the target system file has been tampered with. The scheme of the embodiment of the present invention is adopted, and the tag information configured based on the mandatory access control mechanism of the operating system is used to perform access control on the process of the target application scenario, that is, the process of the target application scenario is restricted to only access the target system file, and the target system file is the system file corresponding to the authenticated tag information, so as to achieve a secure update of a specific target system file, thereby avoiding the situation where the system file is illegally tampered with after the operating system is root-escalated, thereby ensuring the security and integrity of the target system file, and improving the accuracy of the integrity verification of the target system file. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 A schematic diagram of the process of implementing integrity measurement of system files based on the IMA framework is provided for related technologies;

[0068] Figure 2 A schematic diagram of a flow chart of a file integrity verification method provided by an embodiment of the present invention;

[0069] Figure 3 A schematic diagram of an implementation architecture of a file integrity verification method provided by an embodiment of the present invention;

[0070] Figure 4 A schematic diagram of the structure of a file integrity verification device provided by an embodiment of the present invention;

[0071] Figure 5 A schematic diagram of the structure of a file integrity verification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present invention. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0073] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments. However, it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments, and the technical solutions recorded in the embodiments of the present invention may be combined with each other without conflict.

[0074] Before introducing the technical solution of the embodiment of the present invention, the related technology is described below.

[0075] In actual applications, the operating system is the basis for the safe operation of business applications. Therefore, the security of the operating system is crucial to ensuring the security of IoT devices and business security. Generally, by ensuring the integrity of system files during the operation of the IoT operating system, the ability of the IoT operating system to resist attacks can be enhanced, and the security of IoT devices can be improved.

[0076] The Integrity Measurement Architecture (IMA) is a framework that can implement the integrity measurement of system files during the operation of the above-mentioned operating system, such as the Linux operating system. The framework can provide the operating system with functions such as integrity measurement reporting, integrity access control, and integrity reference value encryption. When the operating system runs for the first time, the IMA framework measures the integrity of the system files and stores the reference values ​​in the file's extended attribute security.ima. When the operating system is set to ima_appraise=enforce mode, the IMA framework will perform integrity measurement on the system files to be accessed to obtain measurement values, and compare the measurement values ​​with the reference values ​​in the file's extended attributes. If the comparison fails, it is considered that the integrity of the system file has been destroyed and may have been illegally tampered with, thereby denying access to the system file.

[0077] The following is a detailed description of the process of implementing system file integrity measurement based on the IMA framework.

[0078] Figure 1 A schematic diagram of the process of implementing integrity measurement of system files based on the IMA framework is provided for related technologies, such as Figure 1As shown, the IMA framework first uses the trusted computing chip to measure the integrity of the Loader code, and stores the measurement results in the port command register (PCR) 0-7. The specific name of the measurement result is boot_aggregate. After determining that the Loader code has integrity, the IMA framework will hand over control to the Loader, and the Loader will measure the integrity of the operating system kernel code. After the measurement is completed, the measurement results are stored in the measurement list (ML), and it is decided whether to hand over the system control to the kernel based on policy requirements. After the kernel obtains the system control, the kernel will measure the application code to be loaded and store the measurement results in ML.

[0079] It should be noted that each change to ML is accompanied by an expansion update of the PCR10 register. This method can ensure the integrity and credibility of the data in ML.

[0080] In the related technology, under the IMA framework, the root user has the permission to modify system files. However, it is well known that exploiting system vulnerabilities to escalate root privileges is a common attack method; that is, once an attacker obtains root privileges, he can arbitrarily tamper with system files, thereby causing the integrity check of system files to fail and affecting the security of IoT devices.

[0081] To solve this technical problem, a dynamic integrity protection method based on a trusted chip is proposed in the related art. The main idea is to solve the above problem by adding a measurement mechanism and a measurement agent. The specific implementation process includes: setting a benchmark update program in the user state to store the measurement benchmark of the dynamically changing file; the benchmark update program initializes the non-volatile (NV) storage area of ​​the trusted cryptographic module (TCM) chip: defines the index, size and operation password of the NV storage area; after the user updates the file each time, the benchmark of the file in the NV storage area is updated using the benchmark update program and the operation password; a measurement module and a verification module are set in the kernel state; the measurement module calculates the measurement result of the dynamically changing file when the file is loaded into the memory, and sends the measurement result to the verification module; the verification module reads the benchmark of the file in the NV storage area for comparison. If they are consistent, the measurement module determines that the integrity of the file is good, otherwise it determines that the file has been illegally modified.

[0082] However, the above solution still has some defects, mainly reflected in the need to modify the operating system kernel and add additional verification modules and measurement modules to ensure the integrity of the loaded files. Specifically, they include: first, the native environment of the operating system is destroyed. If the modification is not careful, it is easy to cause the operating system to run unstable and destroy the system compatibility; second, the newly added measurement module will also affect the performance of the operating system, resulting in more operating overhead; third, the newly added system module is easy to introduce new security vulnerabilities, resulting in more security threats. It can be seen that the above method of the related technology is not a better solution to the above technical problems. Therefore, it is urgent to find a better solution to ensure the security and integrity of system files.

[0083] Based on this, in various embodiments of the present invention, when an access request from a process of a target application scenario is received, a system file corresponding to the target application scenario is obtained; the file attributes of the system file include at least tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system; the tag information is authenticated based on a security protection policy; when the tag information is authenticated, the target system file to which the process of the target application scenario has access rights is determined from the obtained system file; the integrity of the determined target system file is verified to determine whether the integrity of the target system file has been tampered with.

[0084] By adopting the solution of the embodiment of the present invention, without modifying the operating system kernel, access control is performed on the process of the target application scenario by utilizing the tag information configured based on the mandatory access control mechanism of the operating system, that is, the process of the target application scenario is restricted to access only the target system file, and the target system file is the system file corresponding to the authenticated tag information. In this way, a secure update of a specific target system file is achieved, thereby preventing the illegal tampering of the system file after the operating system is escalated by root, thereby ensuring the security and integrity of the target system file and improving the accuracy of the integrity check of the target system file.

[0085] The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

[0086] The embodiment of the present invention provides a file integrity verification method, which is applied to electronic equipment. Figure 2 A flowchart of a file integrity verification method provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0087] Step 201, upon receiving an access request from a process of a target application scenario, obtaining a system file corresponding to the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system.

[0088] Here, the electronic device that implements the file integrity verification method in the embodiment of the present invention may be an access network device that supports an operating system, such as a Linux operating system, such as an Internet of Things device.

[0089] Here, the system file corresponding to the target application scenario may be a plurality of system files pre-set for the target application scenario, wherein the plurality of system files includes two or more system files.

[0090] Of course, in actual application, a system file may be pre-set only for the target application scenario, so that when the electronic device receives an access request from the process of the target application scenario, it can obtain a system file corresponding to the target application scenario.

[0091] In the embodiment of the present invention, the tag information is associated with access control, that is, the tag information can be used to restrict the access of the process of the target application scenario to the system file. In actual application, the tag information at least includes the security context of the system file.

[0092] The Mandatory Access Control (MAC) mechanism is an access control rule enforced by the operating system kernel. Specifically, the configuration of label information can be implemented based on the Security-Enhanced Linux (SELinux) integrated in the operating system, such as the Linux operating system kernel. SELinux is a security subsystem integrated in the Linux kernel, which is usually implemented using the mandatory access control mechanism.

[0093] Take the Linux operating system as an example for explanation. Figure 3 A schematic diagram of an implementation architecture of a file integrity verification method provided by an embodiment of the present invention, such as Figure 3 As shown, the file integrity verification method provided by the embodiment of the present invention is based on the original IMA framework. Without modifying the Linux operating system kernel, it uses another general security model SELinux framework of the Linux operating system to implement access control on the process of the target application scenario, thereby realizing fine-grained access control on specific target system files.

[0094] In actual application, in SELinux, it is necessary to create corresponding users and roles in advance according to different application scenarios. For example, the IoT device can support n different application scenarios, such as scene_1, scene_2, ... scene_n. For the above different application scenarios, users and roles in the corresponding application scenarios are created respectively, namely user_1, user_2, ... user_n and role_1, role_2, ... role_n. At the same time, in SELinux, the processes of each application scenario can also be numbered by domain, that is, the processes of each application scenario are assigned domain labels to distinguish the processes of different application scenarios; and the security context of the processes of each application scenario is set. Here, the security context of the processes of the application scenario includes the role, user, type, security sensitivity and classification of the process. Among them, the role and user of the process are correspondingly associated with the users and roles in the corresponding application scenarios created above. The security sensitivity of the process is used to indicate the security level of the process. Usually, a process has one and only one security level. The security level of the process is divided into 0 to 15 levels, among which s0 is the lowest security level. The security level of the process used by the SELinux policy by default is s0.

[0095] In actual application, in SELinux, security contexts can also be set for system files corresponding to various application scenarios. The security context of system files includes the role, user, type, security sensitivity, and classification of the system files. Among them, the security sensitivity of the system files is used to indicate the security level of the system files. Usually, a system file has one and only one security level.

[0096] In actual application, the above step 201 is performed after the electronic device is trusted to start. Therefore, determining whether the electronic device is trusted to start is a key operation before performing step 201 of the embodiment of the present invention.

[0097] Based on this, in some embodiments, the method further includes: generating an image file of the operating system;

[0098] Performing a hash operation on the image file of the operating system to obtain a third hash value;

[0099] Based on taking the third hash value as a reference value for starting the electronic device, it is determined whether the electronic device meets the trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

[0100] In actual application, the image file of the operating system can be stored in a virtual memory disk of the electronic device, such as a RamDisk. Here, by calculating the Hash-based Message Authentication Code (HMAC) of the configuration file of the operating system, such as the GRUB configuration file, the HMAC value is updated to the extended attributes of the corresponding file, such as the inode->security.ima attribute, to generate the image file of the operating system.

[0101] Among them, HMAC is an important part of secure communication. It can be used to prevent messages from being tampered with and to ensure the integrity of data communication together with symmetric encryption technology.

[0102] In actual application, the MD5 information digest algorithm (also referred to as the MD5 algorithm) can be used to perform a hash operation on the image file of the operating system to obtain a third hash value, which can be used as a reference value for determining whether the electronic device can be started up in a trusted manner.

[0103] Here, in actual application, in order to ensure the security of the third hash value, the third hash value may be stored in a non-volatile memory inside a trusted platform module (TPM).

[0104] Step 202: Authenticate the tag information based on the security protection policy.

[0105] Step 203: When the tag information is authenticated, a target system file to which the process of the target application scenario has access rights is determined from the acquired system files.

[0106] Here, the security protection policy may be configured in the IMA, wherein the security protection policy may carry the security context of the process of the target application scenario.

[0107] In actual application, the method also includes: canceling the custom startup function of the operating system and using IMA as a fixed startup item of the operating system; that is, in an embodiment of the present invention, when the electronic device starts the operating system, the custom startup settings of the operating system are restricted, and IMA is fixedly started, and then the tag information is authenticated based on the security protection policy configured in IMA.

[0108] Specifically, IMA can be set as a fixed startup item of the operating system in the following manner: in the make menuconfig selection interface of the operating system, modify the kernel command line type to always use the default kernel command string, that is, set IMA as the default startup item of the operating system.

[0109] In actual application, the electronic device can also limit the timing of authenticating the tag information by controlling the operation mode of the security protection strategy.

[0110] Based on this, in some embodiments, authenticating the tag information based on the security protection policy includes:

[0111] Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system;

[0112] When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

[0113] Here, the operation mode of the security protection policy includes the following modes: off mode (off), enforced protection mode (enforce), and installation mode (fix). Usually, the security protection policy is set to fix mode during development. If the measurement is wrong, there will be an error in the kernel log of the operating system. After the development is completed, the security protection policy is set to enforce mode. If the operating system can run and no error is found in the kernel log, it means that the enabling is successful.

[0114] In actual application, each time the operating system is started, the security protection policy does not need to be reconfigured, but the pre-configured security protection policy can be started by default.

[0115] Specifically, the configuration file of the operating system, such as the GRUB configuration file, is set to ima_tcb ima_appraise_tcb ima_appraise=fix security=selinux selinux=0, restart the operating system, scan all system files in the operating system, each system file corresponds to a measurement initial value, and then the GRUB configuration file is set to ima_tcb ima_appraise_tcb ima_appraise=enforce security=selinux selinux=1. At this time, the operation mode of the security protection policy is in the forced protection mode, and SELinux in the operating system is started.

[0116] It should be noted that, in the embodiment of the present invention, the mandatory access control mechanism of SELinux and the security protection policy configured in IMA will not become invalid due to the restart of the operating system.

[0117] Here, the tag information at least includes the security context of the system file; and the authenticating the tag information based on the security protection policy includes:

[0118] Parsing the security protection policy to obtain the security context of the process of the target application scenario;

[0119] Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file;

[0120] Correspondingly, when the tag information is authenticated, determining the target system file to which the process of the target application scenario has access rights from the acquired system file includes:

[0121] When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated;

[0122] The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

[0123] In actual application, the security context of the system file configured based on the mandatory access control mechanism of the operating system is used to perform access control on the process of the target application scenario, that is, the process of the target application scenario is restricted to only access the target system file, and the target system file is the system file corresponding to the security context that has passed the authentication. It can be seen that the solution of the embodiment of the present invention does not require any modification to the kernel source code of the operating system, nor does it require the addition of additional measurement processes or kernel modules. It only uses the SELinux security model integrated in the kernel of the operating system to configure the security context of the system file to achieve access control on the process of the target application scenario.

[0124] In actual application, the electronic device can also assign operating permissions after accessing the target system files to the processes of the target application scenario.

[0125] Based on this, in some embodiments, after the electronic device determines the target system file to which the process of the target application scenario has access rights from the acquired system file, the method further includes: allocating the operation rights that the process of the target application scenario has after accessing the target system file;

[0126] Based on the operation authority, the operation of the process of the target application scenario on the target system file is controlled.

[0127] Here, the operation of the process of the target application scenario on the target system file may include at least one of the following operations: adding, deleting, checking, and modifying operations performed on the target system file.

[0128] It should be noted that in actual application, in SELinux, SELinux policies can be configured for the processes of the target application scenario, and the SELinux policies only allow the processes of the target application scenario to perform operations with the minimum permissions on the target system files. In other words, the processes of the target application scenario can only perform the corresponding operations assigned to the target system files in the SELinux policy, and cannot perform other unassigned operations.

[0129] Step 204: verify the integrity of the determined target system file.

[0130] In actual application, after the electronic device determines that the process of the target application scenario can only access the target system file, it can also verify the integrity of the target system file.

[0131] Based on this, in some embodiments, the checking the integrity of the determined target system file includes:

[0132] When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value;

[0133] Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file;

[0134] Compare the first Hash value with the second Hash value to obtain a comparison result;

[0135] When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with;

[0136] When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

[0137] In the embodiment of the present invention, the MD5 message digest algorithm (also referred to as the MD5 algorithm) may be used to perform a hash operation on the target system file on which the operation is performed to obtain a first hash value.

[0138] In actual application, the operation performed on the target system file may refer to operations such as modification and deletion of the target system file.

[0139] By adopting the technical solution of the embodiment of the present invention, without modifying the operating system kernel, access control is performed on the process of the target application scenario by utilizing the label information configured based on the mandatory access control mechanism of the operating system, that is, the process of the target application scenario is restricted to only access the target system file, and the target system file is the system file corresponding to the authenticated label information. In this way, a secure update of a specific target system file is achieved, thereby preventing the illegal tampering of the system file after the operating system is escalated by root, thereby ensuring the security and integrity of the target system file and improving the accuracy of the integrity check of the target system file.

[0140] In order to implement the file integrity verification method of the embodiment of the present invention, the embodiment of the present invention also provides a file integrity verification device, see Figure 4 , Figure 4 A schematic diagram of the structure of a file integrity verification device provided by an embodiment of the present invention, the device comprising:

[0141] The acquisition unit 41 is used to acquire a system file corresponding to the target application scenario when receiving an access request of a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system;

[0142] An authentication unit 42, configured to authenticate the tag information based on a security protection policy;

[0143] A first determining unit 43 is configured to determine, from the acquired system files, a target system file to which the process of the target application scenario has access rights when the tag information is authenticated;

[0144] The verification unit 44 is used to verify the integrity of the determined target system file.

[0145] In some embodiments, the tag information includes at least a security context of the system file;

[0146] The authentication unit is specifically used for:

[0147] Parsing the security protection policy to obtain the security context of the process of the target application scenario;

[0148] Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file;

[0149] The first determining unit is specifically configured to:

[0150] When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated;

[0151] The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

[0152] In some embodiments, the verification unit is specifically used to:

[0153] When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value;

[0154] Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file;

[0155] Compare the first Hash value with the second Hash value to obtain a comparison result;

[0156] When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with;

[0157] When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

[0158] In some embodiments, the apparatus further comprises:

[0159] an allocating unit, configured to allocate, to the process of the target application scenario, the operation permission after accessing the target system file, after the first determining unit determines the target system file to which the process of the target application scenario has access rights from the acquired system file;

[0160] A control unit is used to control the operation of the process of the target application scenario on the target system file based on the operation authority.

[0161] In some embodiments, the authentication unit is specifically used to:

[0162] Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system;

[0163] When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

[0164] In some embodiments, the apparatus further comprises:

[0165] A generating unit, used to generate an image file of the operating system;

[0166] The second determination unit is used to perform a hash operation on the image file of the operating system to obtain a third hash value; and based on the third hash value as a reference value for starting the electronic device, determine whether the electronic device has a trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

[0167] Here, in actual application, the image file of the operating system is stored in the virtual memory disk of the electronic device.

[0168] In actual application, the acquisition unit 41 can be implemented by a communication interface in the file integrity verification device; the authentication unit 42, the first determination unit 43 and the verification unit 44 can be implemented by a processor in the file integrity verification device combined with the communication interface.

[0169] It should be noted that the file integrity verification device provided in the above embodiment only uses the division of the above program modules as an example when performing file integrity verification. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the file integrity verification device provided in the above embodiment and the file integrity verification method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0170] Based on the hardware implementation of the above program modules, and in order to implement the file integrity verification method of the embodiment of the present invention, the embodiment of the present invention also provides a file integrity verification device, see Figure 5 , Figure 5 A schematic diagram of the structure of a file integrity verification device provided by an embodiment of the present invention, wherein the file integrity verification device 500 includes:

[0171] Communication interface 501, capable of exchanging information with other devices;

[0172] The processor 502 is connected to the communication interface 501 and is used to execute the method provided by one or more technical solutions of the electronic device side when running the computer program. The computer program is stored in the memory 503.

[0173] Specifically, the communication interface 501 is used to obtain a system file corresponding to the target application scenario when receiving an access request from a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system;

[0174] Processor 502 is used to authenticate the tag information based on the security protection policy; when the tag information is authenticated, determine the target system file to which the process of the target application scenario has access rights from the acquired system files; and verify the integrity of the determined target system file.

[0175] In some embodiments, the tag information includes at least the security context of the system file; the processor 502 is specifically configured to:

[0176] Parsing the security protection policy to obtain the security context of the process of the target application scenario;

[0177] Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file;

[0178] The processor 502 is further specifically configured to:

[0179] When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated;

[0180] The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

[0181] In some embodiments, the processor 502 is specifically configured to:

[0182] When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value;

[0183] Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file;

[0184] Compare the first Hash value with the second Hash value to obtain a comparison result;

[0185] When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with;

[0186] When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

[0187] In some embodiments, the processor 502 is further configured to:

[0188] After determining, from the acquired system files, a target system file to which the process of the target application scenario has access rights, assigning to the process of the target application scenario the operation rights that the process has after accessing the target system file;

[0189] Based on the operation authority, the operation of the process of the target application scenario on the target system file is controlled.

[0190] In some embodiments, the processor 502 is specifically configured to:

[0191] Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system;

[0192] When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

[0193] In some embodiments, the processor 502 is further configured to:

[0194] Generate an image file of the operating system;

[0195] Performing a hash operation on the image file of the operating system to obtain a third hash value;

[0196] Based on taking the third hash value as a reference value for starting the electronic device, it is determined whether the electronic device meets the trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

[0197] Here, in actual application, the image file of the operating system is stored in the virtual memory disk of the electronic device.

[0198] It should be noted that the specific processing process of the communication interface 501 and the processor 502 is detailed in the method embodiment and will not be repeated here.

[0199] Of course, in actual application, the various components in the file integrity check device 500 are coupled together through the bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 5 Various buses are labeled as bus system 504 .

[0200] The memory 503 in the embodiment of the present invention is used to store various types of data to support the operation of the file integrity check device 500. Examples of such data include: any computer program used to operate on the file integrity check device 500.

[0201] The method disclosed in the above embodiment of the present invention can be applied to the processor 502, or implemented by the processor 502. The processor 502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 502 or the instruction in the form of software. The above processor 502 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 502 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined to execute. The software module can be located in a storage medium, which is located in the memory 503. The processor 502 reads the information in the memory 503 and completes the steps of the above method in combination with its hardware.

[0202] In an exemplary embodiment, the file integrity verification device 500 can be implemented by one or more application-specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general-purpose processor, controller, microcontroller (MCU), microprocessor or other electronic components to execute the aforementioned method.

[0203] It can be understood that the memory 503 of the embodiment of the present invention can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory.

[0204] Volatile memory can be a random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting explanation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiment of the present invention is intended to include but is not limited to these and any other suitable types of memory.

[0205] In an exemplary embodiment, the embodiment of the present invention further provides a storage medium, namely a computer storage medium, which may be a computer-readable storage medium, for example, a memory 503 storing a computer program, and the computer program may be executed by a processor 502 of a file integrity verification device 500 to complete the steps of the aforementioned file integrity verification method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, FlashMemory, magnetic surface memory, optical disk or CD-ROM; or may be various devices including one or any combination of the above memories.

[0206] In the embodiments of the present invention, the terms "first", "second", etc. are merely used to distinguish similar objects and do not represent a specific order or sequence for the objects. It can be understood that "first", "second", etc. can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present invention described herein can be implemented in an order other than that illustrated or described herein.

[0207] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A file integrity verification method, characterized in that: Applied to electronic equipment, the method comprises: When receiving an access request from a process of a target application scenario, obtaining a system file corresponding to the target application scenario; the file attributes of the system file at least include tag information associated with access control, and the tag information is configured based on a mandatory access control mechanism of the operating system; Authenticating the tag information based on a security protection policy; the security protection policy carries the security context of the process of the target application scenario, and the tag information at least includes the security context of the system file; the operation mode of the security protection policy includes the following modes: shutdown mode, forced protection state mode, and installation mode; When the tag information is authenticated, determining a target system file to which the process of the target application scenario has access rights from the acquired system file; The integrity of the determined target system file is verified.

2. The method according to claim 1, characterized in that The authenticating the tag information based on the security protection strategy includes: Parsing the security protection policy to obtain the security context of the process of the target application scenario; Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file; When the tag information is authenticated, determining the target system file to which the process of the target application scenario has access rights from the acquired system file includes: When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated; The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

3. The method according to claim 1, characterized in that The checking of the integrity of the determined target system file includes: When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value; Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file; Compare the first Hash value with the second Hash value to obtain a comparison result; When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with; When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

4. The method according to claim 1, characterized in that: The method further comprises: After determining, from the acquired system files, a target system file to which the process of the target application scenario has access rights, assigning to the process of the target application scenario the operation rights that the process has after accessing the target system file; Based on the operation authority, the operation of the process of the target application scenario on the target system file is controlled.

5. The method according to claim 1, characterized in that The authenticating the tag information based on the security protection strategy includes: Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system; When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

6. The method according to claim 1, characterized in that The method further comprises: Generate an image file of the operating system; Performing a hash operation on the image file of the operating system to obtain a third hash value; Based on taking the third hash value as a reference value for starting the electronic device, it is determined whether the electronic device meets the trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

7. The method according to claim 6, characterized in that The image file of the operating system is stored in the virtual memory disk of the electronic device.

8. A file integrity verification device, characterized in that: Applied to electronic equipment, the device comprises: an acquisition unit, configured to acquire a system file corresponding to the target application scenario upon receiving an access request from a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, the tag information being configured based on a mandatory access control mechanism of the operating system; An authentication unit, configured to authenticate the tag information based on a security protection policy; the security protection policy carries the security context of the process of the target application scenario, and the tag information at least includes the security context of the system file; the operation mode of the security protection policy includes the following modes: shutdown mode, forced protection state mode, and installation mode; A first determining unit is used to determine, from the acquired system files, a target system file to which the process of the target application scenario has access rights when the tag information is authenticated; The verification unit is used to verify the integrity of the determined target system file.

9. The device according to claim 8, characterized in that The authentication unit is specifically used for: Parsing the security protection policy to obtain the security context of the process of the target application scenario; Authenticating the security context of the system file based on a match between the security context of the process of the target application scenario and the security context of the system file; The first determining unit is specifically configured to: When the security context of the process of the target application scenario successfully matches the security context of the system file, determining that the security context of the system file is authenticated; The system file corresponding to the authenticated security context is determined as a target system file that the process of the target application scenario has access rights to.

10. The device according to claim 8, characterized in that The verification unit is specifically used for: When an operation is performed on the target system file, performing a hash operation on the target system file to obtain a first hash value; Obtaining a second Hash value corresponding to the target system file on which the operation is not performed, wherein the second Hash value is stored in an extended attribute of the target system file; Compare the first Hash value with the second Hash value to obtain a comparison result; When the comparison result indicates that the first hash value matches the second hash value successfully, determining that the integrity of the target system file has not been tampered with; When the comparison result indicates that the first hash value fails to match the second hash value, it is determined that the integrity of the target system file is tampered with.

11. The device according to claim 8, characterized in that The device also includes: an allocating unit, configured to allocate, to the process of the target application scenario, the operation permission after accessing the target system file, after the first determining unit determines the target system file to which the process of the target application scenario has access rights from the acquired system file; A control unit is used to control the operation of the process of the target application scenario on the target system file based on the operation authority.

12. The device according to claim 8, characterized in that The authentication unit is specifically used for: Controlling the operation mode of the security protection strategy by changing the parameters of the configuration kernel in the operating system; When the operation mode of the security protection policy is in a mandatory protection state, the tag information is authenticated.

13. The device according to claim 8, characterized in that The device also includes: A generating unit, used to generate an image file of the operating system; The second determination unit is used to perform a hash operation on the image file of the operating system to obtain a third hash value; and based on the third hash value as a reference value for starting the electronic device, determine whether the electronic device has a trusted startup condition; the trusted startup condition is used to determine whether the electronic device is started normally.

14. The device according to claim 13, characterized in that The image file of the operating system is stored in the virtual memory disk of the electronic device.

15. A file integrity verification device, characterized in that: The device comprises: A communication interface, configured to obtain a system file corresponding to a target application scenario upon receiving an access request from a process of the target application scenario; the file attributes of the system file at least include tag information associated with access control, the tag information being configured based on a mandatory access control mechanism of the operating system; A processor is used to authenticate the label information based on a security protection policy; the security protection policy carries the security context of the process of the target application scenario, and the label information at least includes the security context of the system file; the operation mode of the security protection policy includes the following modes: shutdown mode, forced protection state mode, and installation mode; when the label information is authenticated, the target system file to which the process of the target application scenario has access rights is determined from the acquired system files; and the integrity of the determined target system file is verified.

16. A file integrity verification device, characterized in that: The device comprises: a processor and a memory for storing a computer program capable of running on the processor; Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 7.

17. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images