Safety inspection method and safety inspection device

Abstract

The present application provides a security inspection method and security inspection device, which relate to the field of information security. The method performs security inspections during the acquisition and dissemination of sensitive information, thereby preventing the leakage of sensitive information in website servers and improving the security of website servers. The method is applied to a website server deployed with a Linux operating system, and includes: upon detecting that a first process has been created, obtaining a parent process identifier of the first process; determining whether the parent process identifier is equal to a software process identifier in the website server; if the parent process identifier is equal to the software process identifier, obtaining a file path of the first process; determining whether the file path of the first process belongs to a first whitelist; and if the file path of the first process belongs to the first whitelist, running the first process.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a security inspection method and a security inspection device. Background Art

[0002] A web server is a computer that provides website services. It can run the Linux operating system, which contains web server software and application software. Users can access the web server through application software such as a browser and access the data provided by the website.

[0003] Website server software and application software may have security vulnerabilities. For example, a website server open to the Internet can be accessed by any user, files on the website server can be read by any user, and the website server allows various application software to run. Attackers can exploit security vulnerabilities to steal sensitive information from the website server or control the website server, resulting in the leakage of sensitive information on the website server and affecting the security of the website server. Summary of the Invention

[0004] The present application provides a security check method and a security check device, which perform security checks during the process of acquiring and disseminating sensitive information, which is beneficial to preventing the leakage of sensitive information in website servers and improving the security of website servers.

[0005] In a first aspect, the present application provides a security checking method, which is applied to a website server deployed with a Linux operating system, the method comprising: when it is detected that a first process is created, obtaining the parent process identifier of the first process; determining whether the parent process identifier is equal to the software process identifier in the website server; when the parent process identifier is equal to the software process identifier, obtaining the file path of the first process; determining whether the file path of the first process belongs to a first whitelist; and when the file path of the first process belongs to the first whitelist, running the first process.

[0006] The security check method provided in the embodiment of the present application performs a security check on the first process when the program is running. When the parent process identifier of the first process is equal to the software process identifier in the website server and the file path of the first process belongs to the first whitelist, the first process is run. By performing a security check on the parent process identifier and the file path of the first process, it is helpful to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0007] In combination with the first aspect, in some implementations of the first aspect, the method further includes: running the first process when the parent process identifier is not equal to the software process identifier.

[0008] In combination with the first aspect, in some implementations of the first aspect, the method further includes: prohibiting the first process from running if the file path of the first process does not belong to the first whitelist.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the above method also includes: when a first request to open a first file is detected, obtaining the permission requested by the first request; determining whether the permission requested by the first request includes read permission; if the permission requested by the first request includes read permission, obtaining the path of the first file; determining whether the path of the first file belongs to a second whitelist; and if the path of the first file belongs to the second whitelist, opening the first file.

[0010] The security check method provided in the embodiment of the present application performs a security check on the opening of a file. When the permission requested in the first request to open the first file includes read permission and the path of the first file belongs to the second whitelist, the first process is opened. By performing a security check on the permission requested in the first request to open the first file and the path of the first file, it is beneficial to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0011] In combination with the first aspect, in some implementations of the first aspect, the method further includes: opening the first file if the permission requested by the first request does not include read permission.

[0012] In combination with the first aspect, in some implementations of the first aspect, the method further includes: prohibiting the opening of the first file if the path of the first file does not belong to the second whitelist.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the above method also includes: when a second request to send a first message is detected, obtaining the content of the first message; determining whether the content of the first message belongs to the blacklist; and sending the first message if the content of the first message does not belong to the blacklist.

[0014] The security check method provided in the embodiment of the present application performs a security check on message sending. When the content of the first message does not belong to the blacklist, the first message is sent. By performing a security check on the content of the first message, it is helpful to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0015] In a second aspect, the present application provides a security inspection device, which includes an acquisition module, a judgment module, and a processing module. The acquisition module is configured to acquire the parent process identifier of the first process when detecting that the first process has been created; the judgment module is configured to determine whether the parent process identifier is equal to the software process identifier in the website server; the acquisition module is further configured to: acquire the file path of the first process if the parent process identifier is equal to the software process identifier; the judgment module is further configured to: determine whether the file path of the first process belongs to a first whitelist; and the processing module is configured to run the first process if the file path of the first process belongs to the first whitelist.

[0016] In combination with the second aspect, in some implementations of the second aspect, the processing module is further configured to: run the first process when the parent process identifier is not equal to the software process identifier.

[0017] In combination with the second aspect, in some implementations of the second aspect, the processing module is further configured to: prohibit the execution of the first process if the file path of the first process does not belong to the first whitelist.

[0018] In combination with the second aspect, in certain implementations of the second aspect, the above-mentioned acquisition module is also used to: when a first request to open the first file is detected, obtain the permission requested by the first request; the above-mentioned judgment module is also used to: determine whether the permission requested by the first request includes read permission; the acquisition module is also used to: when the permission requested by the first request includes read permission, obtain the path of the first file; the above-mentioned judgment module is also used to: determine whether the path of the first file belongs to the second whitelist; the processing module is also used to: when the path of the first file belongs to the second whitelist, open the first file.

[0019] In combination with the second aspect, in some implementations of the second aspect, the processing module is further configured to: open the first file when the permission requested by the first request does not include read permission.

[0020] In combination with the second aspect, in some implementations of the second aspect, the processing module is further configured to: prohibit opening the first file if the path of the first file does not belong to the second whitelist.

[0021] In combination with the second aspect, in certain implementations of the second aspect, the above-mentioned acquisition module is also used to: obtain the content of the first message when a second request to send the first message is detected; the above-mentioned judgment module is also used to judge whether the content of the first message belongs to the blacklist; the above-mentioned device also includes a sending module, and the sending module is used to: send the first message when the content of the first message does not belong to the blacklist.

[0022] In a third aspect, the present application provides a security inspection device, comprising a processor and a memory. The processor is configured to read instructions stored in the memory to execute the method in any possible implementation of the first aspect.

[0023] Optionally, there are one or more processors and one or more memories.

[0024] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0025] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips. The embodiments of the present application do not limit the type of memory and the setting method of the memory and the processor.

[0026] The security inspection device in the third aspect mentioned above can be a chip, and the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0027] In a fourth aspect, the present application provides a computer-readable medium, which stores a computer program (also referred to as code, or instructions) which, when executed on a computer, enables the computer to execute a method in any possible implementation of any of the above aspects.

[0028] In a fifth aspect, the present application provides a computer program product, which includes: a computer program (also referred to as code, or instructions), which, when executed, enables a computer to execute a method in any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0030] Figure 1 A schematic flow chart of a security inspection method provided in an embodiment of the present application;

[0031] Figure 2 A schematic flow chart of another security inspection method provided in an embodiment of the present application;

[0032] Figure 3 A schematic flow chart of another security inspection method provided in an embodiment of the present application;

[0033] Figure 4 A schematic block diagram of a security inspection device provided in an embodiment of the present application;

[0034] Figure 5 A schematic block diagram of another security inspection device provided in an embodiment of the present application.

[0035] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0036] The technical solution in this application will be described below with reference to the accompanying drawings.

[0037] In order to facilitate understanding of the embodiments of the present application, relevant terms in the embodiments of the present application are first introduced.

[0038] 1. Linux operating system

[0039] Linux, full name GNU / Linux, is a free to use and free to disseminate UNIX-like operating system. It is a multi-user, multi-tasking operating system based on the Portable Operating System Interface (POSIX), supporting multi-threading and multiple central processing units (CPUs).

[0040] The Linux operating system can run Unix tools, applications, and network protocols, and supports both 32-bit and 64-bit hardware. Inheriting Unix's network-centric design philosophy, Linux is a stable, multi-user network operating system.

[0041] 2. Linux Security Module

[0042] The Linux Security Module (LSM) is a security access control framework provided by the Linux operating system. It supports "restricted" access control decisions. Developers can complete relevant security checks by implementing functions at preset hook points.

[0043] Once developed, LSM can be compiled with the kernel and run in kernel mode. When a user process attempts to read or write files, run programs, or perform network transmission, if the relevant hook function has been implemented, it will be called to perform a security check to determine whether the current request complies with the security policy and whether to allow or deny it.

[0044] 3. Website Server

[0045] A website server is a server that stores websites in an internet data center. It's primarily used for publishing and hosting websites on the internet and is the foundational hardware for network applications.

[0046] A web server can have the following characteristics:

[0047] 1) The website server only provides "authorized" data to users, that is, users cannot access any file data in the website server at will.

[0048] 2) The website server only needs to run programs related to ensuring the normal operation of the website and daily operation and maintenance. Not running other programs will not affect the normal operation of the server.

[0049] 3) When the website server is running, it only needs to read and write to specific directories.

[0050] 4. Socket

[0051] Socket is an abstraction layer between the application layer and the transport layer. It abstracts the complex operations of the Transmission Control Protocol / Internet Protocol (TCP / IP) layer into several simple interfaces for the application layer to call implemented processes to communicate in the network.

[0052] 5. Security baseline

[0053] A security baseline is a detailed description of how to configure and manage a computer. It implements trusted computer components on a computer and describes all relevant configuration settings for secure operation.

[0054] Elements of a security baseline include:

[0055] 1) Service and application settings, for example: only specified users have the right to start services or run applications.

[0056] 2) Configuration of operating system components, for example, all sample files that come with Internet Information Services (IIS) must be deleted from the computer.

[0057] 3) Permissions and rights allocation, for example: only administrators have the right to change operating system files.

[0058] 4) Management rules, for example: the administrator password on the computer should be changed every 30 days.

[0059] The website server can run a Linux operating system, and the website server software and application software can run on the operating system. The website server software can be software such as WebLogic, and the application software can be any software that allows access to the website server. For example, users can access the website server through application software such as a browser and obtain data provided by the website.

[0060] Website server software and application software may have security vulnerabilities. For example, a website server open to the Internet can be accessed by any user, files on the website server can be read arbitrarily, and the website server allows various application software to run. Attackers can exploit security vulnerabilities to steal sensitive information from the website server or control the website server, causing the leakage of sensitive information and affecting the security of the website server, which is not conducive to the user experience.

[0061] Among them, sensitive information may include keys stored in the website server, network card and interface information of the Linux operating system, data of the Linux operating system when the software is running, etc.

[0062] For example, an attacker designs an application software program containing a virus. When a website server runs the application software containing the virus, the attacker can obtain sensitive information in the website server through the application software containing the virus, resulting in the leakage of sensitive information in the website server.

[0063] For example, files in the website server are allowed to be read arbitrarily, and an attacker can obtain sensitive information in the website server by reading files in the website server, resulting in leakage of sensitive information in the website server.

[0064] Currently, website servers can perform network traffic analysis based on host-based intrusion detection systems (HIDS) to block or issue alarms for potential threats contained in the network traffic.

[0065] Specifically, an agent can be deployed in the website server to detect the security status of the website server and detect abnormal network traffic in the website server environment. After the agent is deployed in the website server, it needs to communicate with the system server for unified management.

[0066] In this approach, the agent focuses on detecting intrusions. If an intrusion is detected in the network traffic of a website server environment, sensitive information may have been leaked. Furthermore, in a large and complex website server environment, an agent needs to be deployed on each server, and each server needs to be connected to the system server. This results in a high number of deployment operations and the risk of cross-virtual local area network (VLAN) access.

[0067] In view of this, in the field of information security, the embodiments of the present application provide a security inspection method and a security inspection device to perform security inspections during the process of acquiring and disseminating sensitive information, which is beneficial to preventing the leakage of sensitive information in website servers and improving the security of website servers.

[0068] Before introducing the security inspection method and security inspection device provided in the embodiments of the present application, the following points are explained.

[0069] First, the first, second, and various numerical numbers in the embodiments shown below are merely distinctions for ease of description and are not intended to limit the scope of the embodiments of the present application, for example, to distinguish between different whitelists, different messages, and so on.

[0070] Second, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

[0071] Figure 1 This is a schematic flow chart of a security checking method 100 provided in an embodiment of the present application. The method 100 can be applied to a website server deployed with a Linux operating system.

[0072] The website server may implement the method 100 based on the above-mentioned Linux security module.

[0073] Exemplarily, the website server may implement method 100 through the task_alloc and bprm_set_creds functions in the LSM hook function.

[0074] The method 100 may include the following steps:

[0075] S101: When it is detected that a first process is created, obtain a parent process identifier of the first process.

[0076] The first process is the process when the website server runs the program. When the website server detects that the first process is created, it can obtain the parent process identifier of the first process through the parameter struct task_struct in the task_alloc function.

[0077] It should be understood that each process has a unique process identifier represented by a non-negative integer.

[0078] A process can be created by another process. The process that creates the process is the parent process, and the process being created is the child process. The first process mentioned above is the child process.

[0079] The first process may be a minimum command set required for normal operation of the website, and does not include some non-essential commands (eg, ifconfig) that are commonly used by attackers.

[0080] S102: Determine whether the parent process ID is equal to the software process ID in the website server.

[0081] The software process ID in the website server is the process ID of the website server software. If the website server software is WebLogic, the software process ID in the website server is the process ID of WebLogic.

[0082] There can be one or more website server software, which is not limited in the embodiments of the present application.

[0083] When there are multiple website server software, the software process identifiers in the website server may be the process identifiers of the multiple website server software.

[0084] The website server determines whether the parent process identifier is equal to the software process identifier in the website server, that is, determines whether the first process is created by the process of the website server software.

[0085] S103: When the parent process identifier is equal to the software process identifier, obtain the file path of the first process.

[0086] The first process is the process when the website server runs a program, and the file path of the first process is the file path of the program run by the website server.

[0087] When the parent process ID is equal to the software process ID, that is, when the first process is created by the process of the website server software, the website server can obtain the file path of the first process through the struct linux_binprm parameter in the bprm_set_creds function.

[0088] Optionally, when the parent process identifier is not equal to the software process identifier, the first process is run.

[0089] When the parent process identifier is not equal to the software process identifier, that is, when the first process is not created by the process of the website server software, the first process is run.

[0090] S104: Determine whether the file path of the first process belongs to the first whitelist.

[0091] The first whitelist includes multiple file paths. The file paths in the first whitelist are preset. Exemplarily, the file paths in the first whitelist can be determined by an administrator of the website server or based on a security baseline.

[0092] The website server determines whether the file path of the first process belongs to the first whitelist, that is, determines whether the multiple file paths in the first whitelist include the file path of the first process.

[0093] When the multiple file paths in the first whitelist include the file path of the first process, the website server may determine that the first process is less likely to have a security vulnerability. When the multiple file paths in the first whitelist do not include the file path of the first process, the website server may determine that the first process has a security vulnerability. S105: If the file path of the first process is in the first whitelist, run the first process.

[0094] In a case where the file path of the first process belongs to the first whitelist, that is, the multiple file paths in the first whitelist include the file path of the first process, the website server may run the first process.

[0095] Optionally, if the file path of the first process does not belong to the first whitelist, the first process is prohibited from running.

[0096] In a case where the file path of the first process does not belong to the first whitelist, that is, the multiple file paths in the first whitelist do not include the file path of the first process, the website server may prohibit the first process from running.

[0097] Optionally, the above-mentioned first whitelist can also be the first blacklist. The website server can determine whether the file path of the first process belongs to the first blacklist. If the file path of the first process belongs to the first blacklist, the first process is prohibited from running; if the file path of the first process does not belong to the first blacklist, the first process is run.

[0098] The security check method provided in the embodiment of the present application performs a security check on the first process when the program is running. When the parent process identifier of the first process is equal to the software process identifier in the website server and the file path of the first process belongs to the first whitelist, the first process is run. By performing a security check on the parent process identifier and the file path of the first process, it is helpful to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0099] Figure 2 This is a schematic flow chart of another security checking method 200 provided in an embodiment of the present application. This method 200 can be applied to a website server deployed with a Linux operating system.

[0100] The website server may implement the method 200 based on the above-mentioned Linux security module.

[0101] Exemplarily, the website server may implement method 200 through the file_permission function in the LSM hook function.

[0102] The method 200 may include the following steps:

[0103] S201: When a first request to open a first file is detected, obtain the permission requested by the first request.

[0104] The first request to open the first file may be requested by a user using the website server, or by an attacker, or by a process running in the above method 100, and this embodiment of the present application does not limit this.

[0105] The first file may be a minimum set required for normal operation of the website and may not include some system files (eg, proc).

[0106] The permissions requested in the first request may include read permissions, write permissions, and execute permissions, which are not limited in this embodiment of the present application.

[0107] When the website server detects the first request to open the first file, it can obtain the permission requested by the first request through the mask parameter in the file_permission function.

[0108] For example, the permissions requested by the first request obtained by the website server include read permission and write permission.

[0109] S202: Determine whether the permission requested in the first request includes read permission.

[0110] S203: When the permission requested by the first request includes read permission, obtain the path of the first file.

[0111] The path of the first file is the path where the first file is stored in the website server, for example, D:\Central Data\Continuous Integration Project\Information and Sharing.

[0112] When the permission requested by the first request includes read permission, the website server can obtain the path of the first file through the struct file parameter in the file_permission function.

[0113] Optionally, if the permission requested by the first request does not include read permission, the first file is opened.

[0114] In a case where the permission requested by the first request does not include the read permission, the website server may determine that the first file is small and may have a security vulnerability, and may open the first file.

[0115] S204: Determine whether the path of the first file belongs to the second whitelist.

[0116] The second whitelist includes multiple paths. The paths in the second whitelist are preset. Exemplarily, the paths in the second whitelist can be determined by an administrator of the website server or based on a security baseline.

[0117] The website server determines whether the path of the first file belongs to the second whitelist, that is, determines whether the multiple paths in the second whitelist include the path of the first file.

[0118] When multiple paths in the second whitelist include the path of the first file, the website server can determine that the first file is small and may have a security vulnerability; when multiple paths in the second whitelist do not include the path of the first file, the website server can determine that the first file has a security vulnerability.

[0119] S205: When the path of the first file belongs to the second whitelist, open the first file.

[0120] In the case that the path of the first file belongs to the second whitelist, that is, the multiple paths in the second whitelist include the path of the first file, the website server can open the first file.

[0121] Optionally, if the path of the first file does not belong to the second whitelist, opening the first file is prohibited.

[0122] In the case that the path of the first file does not belong to the second whitelist, that is, the multiple paths in the second whitelist do not include the path of the first file, the website server may prohibit opening the first file.

[0123] Optionally, the above-mentioned second whitelist can also be a second blacklist. The website server can determine whether the path of the first file belongs to the second blacklist. If the path of the first file belongs to the second blacklist, the first file is prohibited from being opened; if the file path of the first process does not belong to the second blacklist, the first file is opened.

[0124] The security check method provided in the embodiment of the present application performs a security check on the opening of a file. When the permission requested in the first request to open the first file includes read permission and the path of the first file belongs to the second whitelist, the first process is opened. By performing a security check on the permission requested in the first request to open the first file and the path of the first file, it is beneficial to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0125] Figure 3 This is a schematic flowchart of another security checking method 300 provided in an embodiment of the present application. This method 300 can be applied to a website server deployed with a Linux operating system.

[0126] The website server may implement the method 300 based on the above-mentioned Linux security module.

[0127] Exemplarily, the website server may implement method 300 through the socket_sendmsg function in the LSM hook function.

[0128] The method 300 may include the following steps:

[0129] S301: When a second request to send a first message is detected, obtain content of the first message.

[0130] The first message may be a socket message.

[0131] The second request for sending the first message may be requested by a user using the website server, or by an attacker, or may be requested in the above-mentioned method 100 or method 200, and this embodiment of the present application does not limit this.

[0132] When detecting the second request to send the first message, the website server may obtain the content of the first message, for example, the content of the first message is a process identifier, a memory map, or a stack.

[0133] S302: Determine whether the content of the first message belongs to the blacklist.

[0134] The blacklist includes multiple pieces of information, such as process identifiers, memory mapping, and stack information. The embodiment of the present application does not limit the number of pieces of information in the blacklist.

[0135] The information in the blacklist is preset. Exemplarily, the information in the blacklist can be determined by an administrator of the website server or based on a security baseline.

[0136] The information in the blacklist can be changed dynamically, that is, the information in the blacklist can be added or deleted dynamically.

[0137] For example, the administrator of the website server can add information to the blacklist to prevent more messages from being sent.

[0138] Exemplarily, based on the security baseline, the website server can reduce the information in the blacklist, that is, the website server determines based on the security baseline that the information in the blacklist is safe information and has as small a security vulnerability as possible, and can be deleted from the blacklist.

[0139] The website server determines whether the content of the first message belongs to the blacklist, that is, determines whether the multiple information in the blacklist includes the content of the first message.

[0140] When multiple information in the blacklist includes the content of the first message, the website server can determine that the first message has a security vulnerability; when multiple information in the blacklist does not include the content of the first message, the website server can determine that the first message has a security vulnerability as small as possible.

[0141] S303: If the content of the first message does not belong to the blacklist, send the first message.

[0142] In the case that the content of the first message does not belong to the blacklist, that is, the website server determines that the multiple information in the blacklist does not include the content of the first message, the first message can be sent.

[0143] Optionally, if the content of the first message belongs to the blacklist, sending of the first message is prohibited.

[0144] In the case that the content of the first message does not belong to the blacklist, that is, the website server determines that the multiple information in the blacklist includes the content of the first message, the sending of the first message may be prohibited.

[0145] Optionally, the above-mentioned second whitelist can also be a second blacklist. The website server can determine whether the path of the first file belongs to the second blacklist. If the path of the first file belongs to the second blacklist, the first file is prohibited from being opened; if the file path of the first process does not belong to the second blacklist, the first file is opened.

[0146] The security check method provided in the embodiment of the present application performs a security check on message sending. When the content of the first message does not belong to the blacklist, the first message is sent. By performing a security check on the content of the first message, it is helpful to prevent the leakage of sensitive information in the website server and improve the security of the website server.

[0147] The above methods 100, 200, and 300 can all be executed by a website server. In one possible implementation, the website server can execute any one of the above methods 100, 200, or 300, that is, the website server can independently use the above methods 100, 200, or 300.

[0148] In another possible implementation, the website server may execute at least two of the above methods 100, 200, or 300. For example, the website server may execute the above methods 100 and 200. Alternatively, the website server may execute the above methods 100, 200, and 300.

[0149] The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0150] Combined with the above Figures 1 to 3 , describes in detail the security inspection method provided by the embodiment of the present application, and will be combined with Figure 4 and Figure 5 , describe in detail the security inspection device provided in the embodiments of the present application.

[0151] Figure 4 A security inspection device 400 provided in an embodiment of the present application is shown. The device 400 includes an acquisition module 410, a judgment module 420, and a processing module 430. The acquisition module 410 is configured to: upon detecting that a first process has been created, acquire the parent process identifier of the first process; the judgment module 420 is configured to: determine whether the parent process identifier is equal to the software process identifier in the website server; the acquisition module 410 is further configured to: if the parent process identifier is equal to the software process identifier, acquire the file path of the first process; the judgment module 420 is further configured to: determine whether the file path of the first process is on a first whitelist; and the processing module 430 is configured to: run the first process if the file path of the first process is on the first whitelist.

[0152] Optionally, the processing module 430 is further configured to: run the first process when the parent process identifier is not equal to the software process identifier.

[0153] Optionally, the processing module 430 is further configured to: prohibit the execution of the first process if the file path of the first process does not belong to the first whitelist.

[0154] Optionally, the acquisition module 410 is also used to: when a first request to open the first file is detected, obtain the permission requested by the first request; the judgment module 420 is also used to: determine whether the permission requested by the first request includes read permission; the acquisition module 410 is also used to: when the permission requested by the first request includes read permission, obtain the path of the first file; the judgment module 420 is also used to: determine whether the path of the first file belongs to the second whitelist; the processing module 430 is also used to: when the path of the first file belongs to the second whitelist, open the first file.

[0155] Optionally, the processing module 430 is further configured to: open the first file if the permission requested in the first request does not include the read permission.

[0156] Optionally, the processing module 430 is further configured to: prohibit opening the first file if the path of the first file does not belong to the second whitelist.

[0157] Optionally, the acquisition module 410 is also used to: obtain the content of the first message when a second request to send the first message is detected; the judgment module 420 is also used to: judge whether the content of the first message belongs to the blacklist; the above-mentioned device 400 also includes a sending module, which is used to: send the first message when the content of the first message does not belong to the blacklist.

[0158] It should be understood that the device 400 here is embodied in the form of a functional module. The term "module" here can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combined logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art will understand that the device 400 can be specifically the website server in the above-mentioned embodiment, or the function of the website server in the above-mentioned embodiment can be integrated in the device 400, and the device 400 can be used to execute the various processes and / or steps corresponding to the website server in the above-mentioned method embodiment. To avoid repetition, they will not be described here.

[0159] The apparatus 400 has the function of implementing the corresponding steps performed by the website server in the above-mentioned method 100, method 200, or method 300. The above-mentioned functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions. For example, the above-mentioned acquisition module can be a communication interface, such as a transceiver interface.

[0160] Figure 5 A security inspection device 500 provided in an embodiment of the present application is shown. The device 500 includes a processor 510, a communication interface 520, and a memory 530. The processor 510, the communication interface 520, and the memory 530 communicate with each other via an internal connection path. The memory 530 is used to store instructions, and the processor 510 is used to execute the instructions stored in the memory 530 to control the communication interface to send and / or receive signals.

[0161] The apparatus 500 is configured to execute the various processes and steps in the security check method. Specifically, the processor 510 is configured to: upon detecting that a first process has been created, obtain the parent process identifier of the first process; determine whether the parent process identifier is equal to the software process identifier in the website server; if the parent process identifier is equal to the software process identifier, obtain the file path of the first process; determine whether the file path of the first process is on a first whitelist; and if the file path of the first process is on the first whitelist, run the first process.

[0162] It should be understood that the apparatus 500 can be used to execute the various steps and / or processes corresponding to the website server in the above-mentioned method embodiment. Optionally, the memory 530 may include read-only memory and random access memory, and provide instructions and data to the processor 510. A portion of the memory 530 may also include non-volatile random access memory. For example, the memory 530 may also store device type information. The processor 510 can be used to execute the instructions stored in the memory 530, and when the processor 510 executes the instructions stored in the memory 530, the processor 510 is used to execute the various steps and / or processes of the above-mentioned method embodiment corresponding to the website server.

[0163] It should be understood that in the embodiment of the present application, the processor 510 of the apparatus 500 may be a central processing unit (CPU), and the processor 510 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0164] During implementation, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or by instructions in the form of software. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software units in the processor. The software unit can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor executes the instructions in the memory, and in combination with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not given here.

[0165] The present application provides a computer-readable storage medium, which is used to store a computer program. The computer program is used to implement the method corresponding to the website server in the above embodiment.

[0166] The present application provides a computer program product, which includes a computer program (also referred to as code or instruction). When the computer program runs on a computer, the computer can execute the method corresponding to the website server in the above embodiment.

[0167] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0168] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0171] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0172] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0173] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A security inspection method, characterized in that: include: When detecting that a first process is created, obtaining a parent process identifier of the first process; Determine whether the parent process identifier is equal to the software process identifier in the website server; When the parent process identifier is equal to the software process identifier, obtaining a file path of the first process; Determining whether the file path of the first process belongs to a first whitelist; If the file path of the first process belongs to the first whitelist, running the first process; The method further comprises: When the parent process identifier is not equal to the software process identifier, the first process is run.

2. The method according to claim 1, characterized in that The method further comprises: If the file path of the first process does not belong to the first whitelist, the running of the first process is prohibited.

3. The method according to claim 1, characterized in that The method further comprises: When a first request to open a first file is detected, obtaining the permission requested by the first request; Determining whether the permission requested by the first request includes read permission; When the permission requested by the first request includes a read permission, obtaining a path of the first file; Determining whether the path of the first file belongs to a second whitelist; In a case where the path of the first file belongs to the second whitelist, the first file is opened.

4. The method according to claim 3, characterized in that The method further comprises: In a case where the permission requested by the first request does not include the read permission, the first file is opened.

5. The method according to claim 3 or 4, characterized in that The method further comprises: If the path of the first file does not belong to the second whitelist, opening the first file is prohibited.

6. The method according to claim 1, characterized in that The method further comprises: When detecting a second request to send a first message, obtaining content of the first message; Determining whether the content of the first message belongs to the blacklist; In a case where the content of the first message does not belong to the blacklist, the first message is sent.

7. A safety inspection device, characterized in that: include: an acquisition module, configured to acquire a parent process identifier of a first process when detecting that the first process is created; A judgment module, used to judge whether the parent process identifier is equal to the software process identifier in the website server; The acquisition module is further configured to: acquire the file path of the first process when the parent process identifier is equal to the software process identifier; The judgment module is further configured to: judge whether the file path of the first process belongs to a first whitelist; A processing module, configured to run the first process if the file path of the first process belongs to the first whitelist; The processing module is further configured to run the first process when the parent process identifier is not equal to the software process identifier.

8. A safety inspection device, characterized in that: include: A processor is coupled to a memory, wherein the memory is used to store a computer program, and when the processor calls the computer program, the device is caused to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes instructions for implementing the method according to any one of claims 1 to 6.

10. A computer program product, comprising computer program code, characterized in that: When the computer program code is executed on a computer, the computer is caused to implement the method according to any one of claims 1 to 6.

Images