File protection method, device, equipment, storage medium and program product

Abstract

Embodiments of the present invention provide a file protection method, apparatus, device, storage medium, and program product. The method includes: if the first file currently being operated on is a file with a hard link, determining whether a tree structure corresponding to the first file path contains a node for the first file; if the tree structure corresponding to the first file path contains a node for the first file, performing target processing on the current operation; all nodes in the tree structure are file nodes with hard links. The method of the embodiments of the present invention provides security protection for operations on files with hard links, resulting in a high level of security.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a file protection method, apparatus, device, storage medium and program product. Background Art

[0002] The rapid development of computer networks and mobile internet applications has brought great convenience to social work and life, but the threats and losses caused by various network security issues are also increasing. For example, ransomware can destroy or encrypt files through write operations.

[0003] While implementing the present invention, the inventors discovered that ransomware can write to files via hard links. Therefore, how to protect against such write operations via hard links is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] In response to the problems in the prior art, embodiments of the present invention provide a file protection method, apparatus, device, storage medium, and program product.

[0005] Specifically, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a file protection method, comprising:

[0007] If the first file currently being operated is a file with a hard link, determining whether the tree structure corresponding to the first file path contains a node of the first file;

[0008] If the tree structure corresponding to the first file path contains a node of the first file, target processing is performed on the current operation; the nodes in the tree structure are all file nodes with hard links.

[0009] Furthermore, determining whether the tree structure corresponding to the first file path contains a node of the first file includes:

[0010] Matching the node identifier of the first file with the node identifier of the node in the tree structure corresponding to the first file path;

[0011] If the node identifier of the first file matches the node identifier of a node in the tree structure, it is determined that the tree structure contains the node of the first file.

[0012] Furthermore, before determining whether the tree structure corresponding to the first file path of the first file contains the node of the first file, the method further includes:

[0013] Determining whether a first file path of the first file matches at least one preset second file path;

[0014] If there is a second file path that matches the first file path, performing target processing on the current operation;

[0015] If there is no match, it is determined whether the first file is a file with a hard link.

[0016] Furthermore, before performing target processing on the current operation, the method further includes:

[0017] Determining whether the path of the process corresponding to the current operation matches the path of the access subject in the preset rule corresponding to the second file path;

[0018] If there is no match, target processing is performed on the current operation.

[0019] Furthermore, the performing target processing on the current operation includes:

[0020] The current operation is reported or intercepted according to a preset strategy.

[0021] Furthermore, the method further comprises:

[0022] When the hard link identifier of the second file changes, determining a third file path corresponding to the second file;

[0023] Add or delete a node of the second file in the tree structure corresponding to the third file path.

[0024] Furthermore, the adding or deleting a node of the second file in the tree structure corresponding to the third file path includes:

[0025] If the hard link identifier of the second file is greater than a preset value, adding a node of the second file in the tree structure corresponding to the third file path;

[0026] If the hard link identifier of the second file is equal to a preset value, the node of the second file is deleted in the tree structure corresponding to the third file path.

[0027] Furthermore, before determining whether the tree structure corresponding to the first file path of the first file contains a node of the first file, the method further includes:

[0028] Obtaining a file with a hard link under the first file path;

[0029] A tree structure corresponding to the first file path is established based on the files with hard links under the first file path.

[0030] In a second aspect, an embodiment of the present invention further provides a file protection device, comprising:

[0031] a determination module configured to determine whether a node of the first file is included in a tree structure corresponding to the first file path if the first file currently being operated is a file having a hard link;

[0032] The processing module is configured to perform target processing on the current operation if the tree structure corresponding to the first file path contains a node of the first file; the nodes in the tree structure are all file nodes with hard links.

[0033] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the file protection method described in the first aspect are implemented.

[0034] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the file protection method described in the first aspect.

[0035] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the file protection method described in the first aspect.

[0036] The file protection method, apparatus, device, storage medium and program product provided by the embodiments of the present invention, if the first file currently being operated is a file with a hard link, and the tree structure corresponding to the first file path contains a node of the first file, it means that the first file is subject to the rules corresponding to the first file path, and the current operation is targeted for processing; because the nodes in the tree structure are all file nodes with hard links, it is possible to prevent illegal modifications to the first file with hard links, thereby improving the security of file protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 This is one of the flowcharts of the file protection method provided by an embodiment of the present invention;

[0039] Figure 2This is a schematic diagram of a tree structure in an embodiment of the present invention;

[0040] Figure 3 This is the second flowchart of the file protection method provided by the embodiment of the present invention;

[0041] Figure 4 This is the third flowchart of the file protection method provided by the embodiment of the present invention;

[0042] Figure 5 This is the fourth flowchart of the file protection method provided by the embodiment of the present invention;

[0043] Figure 6 This is a schematic structural diagram of an embodiment of a file protection device of the present invention;

[0044] Figure 7 It is a schematic structural diagram of an electronic device embodiment of the present invention. DETAILED DESCRIPTION

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0046] First, some vocabulary and application scenarios involved in the embodiments of the present invention are introduced.

[0047] Inode is used to record file attributes. One file corresponds to one inode. Inode is equivalent to the file's identification ID. When searching for a file, you must first find the inode before you can read the file's contents.

[0048] Hard links are multiple files pointing to the same inode, with the following characteristics:

[0049] 1. Multiple files with the same inode are hard-linked files to each other. Creating a hard link is equivalent to adding an entry to the file entity.

[0050] 2. For hard-link files, the file entity will be deleted only when the source file and all corresponding hard-link files are deleted.

[0051] 3. Regardless of modifying the source file or any of the hard-linked files, the data of other files will be changed.

[0052] The method of the embodiment of the present invention can be applied in security protection scenarios, especially to protect files and ensure file security.

[0053] The goal of ransomware protection is to prevent critical files from being modified or encrypted. The protection targets specific files. A commonly used protection solution is to monitor file opening in the kernel, so that protected files can only be opened to specific entities. For files with hard links, modifying the hard-linked file will also modify the source file and other hard-linked files. Therefore, the embodiments of the present invention prevent illegal programs from modifying and encrypting protected files by increasing the monitoring of hard links.

[0054] In the file protection method of an embodiment of the present invention, a protected file with a hard link is added to a node of a tree structure. If the file currently being operated belongs to the tree structure, security protection is performed on the file, that is, the current operation is reported or intercepted, etc., thereby improving the security of file protection.

[0055] The following combination Figure 1-Figure 5 The technical solution of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0056] Figure 1 This is one of the flowcharts of the file protection method provided by the embodiment of the present invention. Figure 1 As shown, the method provided in this embodiment includes:

[0057] Step 101: If the first file currently being operated is a file with a hard link, determine whether a tree structure corresponding to a first file path of the first file contains a node of the first file.

[0058] Specifically, the current operation includes: a file opening operation, a write operation, a delete operation, etc. If the first file of the current operation is a file with a hard link, it is very likely that it is a file that needs security protection.

[0059] The files with hard links that need to be protected can be recorded in advance. For example, the nodes of the files with hard links are represented by nodes in a tree structure. The identifier of the node can be the inode of the file. For the convenience of processing, the nodes of the files with hard links under the same file path can be recorded in the same tree structure, such as Figure 2 The tree structure corresponding to a certain file path is shown. The tree structure corresponding to the first file path is searched through the identifier of the first file to determine whether the tree structure contains a node of the first file.

[0060] The first file may be a source file or a hard link file.

[0061] Step 102: If the tree structure corresponding to the first file path contains a node of the first file, target processing is performed on the current operation; the node in the tree structure is a file node with a hard link.

[0062] Specifically, if the tree structure corresponding to the first file path contains a node for the first file, it means that the current first file is subject to the current security protection rules, that is, the current operation needs to be targeted, such as reported or intercepted.

[0063] Optionally, a tree structure can be created for each file path in advance. The nodes in the tree structure are file nodes with hard links, and the corresponding files are protected files. Each node in the tree structure is identified by a universally unique identifier (UUID). The UUID includes: inode and bdev.

[0064] The bdev file system is designed to establish a correlation between the external representation and internal implementation of block device files. The bdev file system is a "pseudo" file system that is only used by the kernel and does not need to be mounted on the global file system tree.

[0065] According to the method of this embodiment, if the first file currently being operated is a file with a hard link, and the tree structure corresponding to the first file path contains a node of the first file, it means that the first file is subject to the rules corresponding to the first file path, and the current operation is targeted. Since the nodes in the tree structure are all file nodes with hard links, illegal modifications and other operations can be prevented on the first file with a hard link, thereby improving the security of file protection.

[0066] In one embodiment, the following operations may be performed before step 101:

[0067] Determining whether a first file path of the first file matches at least one preset second file path;

[0068] If there is a second file path that matches the first file path, target processing is performed on the current operation;

[0069] If there is no match, it is determined whether the first file is a file with a hard link.

[0070] Specifically, at least one security protection rule may be pre-configured, and each security protection rule may specify at least one second file path that needs to be protected, that is, the files under these second file paths need to be protected.

[0071] If the first file path of the first file being operated on matches a second file path, the first file requires security protection, and the current operation is processed, such as reporting or interception. If there is no match, it indicates that the file is not protected by the current security protection rules. Further determination can be made as to whether it is a hard-linked file requiring security protection. If so, the process is processed.

[0072] To ensure efficiency, the inode number of the first file can be matched with the inode number included in the file path to be protected by the security protection rule. When the inode number matches successfully, the file path matching the first file can be obtained.

[0073] For example, if the value of the parameter i_count in inode is greater than 1, it can be considered as a file with a hard link.

[0074] In one embodiment, before performing target processing on the current operation, the method further includes:

[0075] Determine whether the path of the process corresponding to the current operation matches the path of the access subject in the preset rule corresponding to the second file path;

[0076] If there is no match, target processing is performed on the current operation.

[0077] Specifically, the access subject may refer to the process accessing the current first file. If the path of the process corresponding to the current operation matches the path of the access subject in the preset rule corresponding to the second file path, that is, the access subject is allowed to access in the preset rule, then the current operation is directly released, that is, there is no need to process the current operation; if there is no match, it means that the process corresponding to the current operation is not the access subject allowed to access in the preset rule, then target processing is performed.

[0078] In the above implementation, by matching the first file path of the currently operated first file with the preset second file path to determine whether the first file is a protected file, the security of file protection can be improved.

[0079] For example, Figure 3 As shown, the method includes the following steps:

[0080] 1. The current file matches a certain rule;

[0081] Specifically, assuming that the current file is file 1, a rule matching file 1 is searched through the UUID of file 1 or the inode included in the UUID. Assume that the rule is rule 1.

[0082] 2. Regular characters fail to match the file path of this rule;

[0083] Specifically, the path of the access subject in rule 1 is / usr / bin / vim, which can access files under the path / home / AAA.wps. If the operation on the current file triggers security protection, first obtain the file path of the current file to be opened, and then perform string matching on the file path that can be accessed as specified in the rule. If the match is successful, that is, the file path of file 1 is / home / AAA.wps, then check whether the access path of the process corresponding to the current operation is the same as / usr / bin / vim. If they are the same, the current operation is released, that is, there is no need to perform security protection on the file. If they are not the same, target processing is performed, such as reporting or interception; if the match fails, it means that file 1 is not protected by rule 1, and it is necessary to determine whether it is a protected hard link file.

[0084] 3. Determine whether the current file is a hard link file, that is, whether the value of the parameter i_count in the inode is greater than 1, that is, whether inode->i_count is greater than 1;

[0085] 4. If inode->i_count>1, query the tree structure of the file path based on the UUID of the current file;

[0086] 5. If the file node exists in the tree structure, it means that the current file is protected, that is, security protection is required, and the current operation is handled accordingly;

[0087] 6. If it is not a hard link file, or the node of the file does not exist in the tree structure, the current operation is allowed.

[0088] In one embodiment, before step 101, the file protection method further includes:

[0089] Get the file with hard link under the first file path;

[0090] According to the files with hard links under the first file path, a tree structure corresponding to the first file path is established.

[0091] Specifically, the first file path is a / b / c. Assume that among the multiple files included in path a, file 1 is a hard-linked file. Then, the root node of the tree structure is the node of file 1, and the node of file 1 is represented by the UUID of file 1. If among the multiple files included in path a / b, file 2 and file 3 are hard-linked files, the nodes of file 2 and file 3 are leaf nodes of the root node of the tree structure, and so on, forming a tree structure.

[0092] In the above implementation, the tree structure formed by the nodes of the files with hard links can be used to determine whether the file being currently operated is subject to a certain protection rule, and then the current operation can be processed accordingly, which has higher security.

[0093] In one embodiment, step 102 may be implemented by the following steps:

[0094] Matching the node identifier of the first file with the node identifier of the node in the tree structure corresponding to the first file path;

[0095] If the node identifier of the first file matches the node identifier of a node in the tree structure, it is determined that the tree structure contains a node of the first file.

[0096] Specifically, the node identifier uuid1 of the first file is matched with the node identifier of the node in the tree structure corresponding to the first file path. If the tree structure includes the node identifier uuid1 of a certain node, it is determined that the tree structure contains the node of the first file, which means that the hard link file is subject to the security protection rules corresponding to the current first file path.

[0097] In the above implementation, the node identifier of the first file is matched with the node identifier in the tree structure to determine whether the tree structure contains the node of the first file. The implementation is simple and efficient.

[0098] In one embodiment, step 102 may be implemented as follows:

[0099] Report or intercept the current operation according to the preset strategy.

[0100] Specifically, when establishing a tree structure (or security protection rules), corresponding policies can be configured, such as under what circumstances to report and under what circumstances to directly intercept. For example, based on the priority of the file type, files with high priority can be directly intercepted, or different paths can correspond to corresponding processing operations. That is, when it is determined that the first file of the current operation is a hard link file and is a node in the tree structure, corresponding processing is performed. For example, if the priority of the current first file is higher, it is directly intercepted.

[0101] For example, the files under file path a are reported, and the files under file path b are intercepted.

[0102] In the above implementation, when it is identified that an operation is being performed on a file in a hard link manner, the security of file protection is improved by reporting or intercepting the current operation.

[0103] In one embodiment, the file protection method further includes:

[0104] When the hard link identifier of the second file changes, determining a third file path corresponding to the second file;

[0105] Add or delete a node of the second file in the tree structure corresponding to the third file path.

[0106] Specifically, when the hard link identifier of the second file changes, the third file path corresponding to the second file is determined; the hard link identifier can be the number of hard links of the inode,

[0107] Add or delete a node of the second file in the tree structure corresponding to the third file path.

[0108] Specifically, if the hard link identifier of the second file, such as the parameter i_count in the inode, changes, becomes larger or smaller, it means that the second file has a newly created hard link, or a hard link has been deleted. Therefore, the tree structure corresponding to the third file path to which the second file belongs is processed, such as adding or deleting nodes, so that accurate judgment can be obtained when the tree structure is used subsequently. That is, if an operation is performed on a file under the third file path, it can be accurately determined whether the operation is processed accordingly, that is, reported or intercepted, etc., thereby improving the security of file protection.

[0109] Optionally, if the hard link identifier of the second file is greater than a preset value, adding a node of the second file in the tree structure corresponding to the third file path;

[0110] If the hard link identifier of the second file is equal to a preset value, the node of the second file is deleted in the tree structure corresponding to the third file path.

[0111] Specifically, if the hard link identifier of the second file, such as the parameter i_count in the inode, the value of this parameter is greater than the preset value, then the node of the second file is added in the tree structure corresponding to the third file path. If the hard link identifier of the second file, the parameter i_count in the inode, the value of this parameter is equal to the preset value, then the node of the second file is deleted in the tree structure corresponding to the second file path. The preset value is, for example, 1.

[0112] like Figure 4 As shown, monitoring the creation of hard links and inserting new UUID nodes into the red-black tree includes the following steps:

[0113] 1. Determine whether the value of the parameter i_count in inode changes from 1 to 2, that is, inode->i_count changes from 1 to 2;

[0114] 2. If yes, it means that the hard link is a newly created hard link, and traverse the file paths corresponding to all rules;

[0115] 3. Determine the file path corresponding to which rule the newly created hard link belongs to;

[0116] 4. If it is determined that the newly created hard link belongs to a certain file path, a node corresponding to the hard link is added to the tree structure corresponding to the file path.

[0117] like Figure 5 As shown, monitoring the removal of hard links and deleting nodes from the UUID red-black tree includes the following steps:

[0118] 1. Determine whether the value of the parameter i_count in inode changes from 2 to 1, that is, inode->i_count changes from 2 to 1;

[0119] 2. If yes, it means that the hard link is a hard link that needs to be deleted, and traverse the file paths corresponding to all rules;

[0120] 3. Determine the file path corresponding to the rule to which the hard link to be deleted belongs;

[0121] 4. If it is determined that the hard link belongs to a certain file path, the node corresponding to the hard link is deleted from the tree structure corresponding to the file path.

[0122] The value of i_count may also be changed from a value greater than 2 to 1.

[0123] In the above embodiment, by monitoring the hard links, that is, monitoring the creation and deletion of hard links, illegal operations on files through hard links are prevented, thereby improving the security of file protection.

[0124] The file protection device provided by the present invention is described below. The file protection device described below and the file protection method described above can be referenced to each other.

[0125] Figure 6 This is a schematic diagram of the structure of the file protection identification device provided by the present invention. Figure 6 As shown, the file protection device provided in this embodiment includes:

[0126] The determination module 210 is configured to determine whether the tree structure corresponding to the first file path contains a node of the first file if the first file currently being operated is a file with a hard link;

[0127] The processing module 220 is configured to perform target processing on the current operation if the tree structure corresponding to the first file path contains a node of the first file; all nodes in the tree structure are file nodes with hard links.

[0128] Optionally, the processing module 220 is further configured to:

[0129] Matching the node identifier of the first file with the node identifier in the tree structure corresponding to the first file path;

[0130] If a node identifier matching the node identifier of the first file exists in the tree structure, it is determined that the tree structure contains a node of the first file.

[0131] Optionally, the determination module 210 is specifically configured to:

[0132] Determining whether a first file path of the first file matches at least one preset second file path;

[0133] If there is a second file path that matches the first file path, performing target processing on the current operation;

[0134] If there is no match, it is determined whether the first file is a file with a hard link.

[0135] Optionally, the processing module 220 is specifically configured to:

[0136] Determining whether the path of the process corresponding to the current operation matches the path of the access subject in the preset rule corresponding to the second file path;

[0137] If there is no match, target processing is performed on the current operation.

[0138] Optionally, the processing module 220 is specifically configured to:

[0139] The current operation is reported or intercepted according to a preset strategy.

[0140] Optionally, the processing module 220 is further configured to:

[0141] When the hard link identifier of the second file changes, determining a third file path corresponding to the second file;

[0142] Add or delete a node of the second file in the tree structure corresponding to the third file path.

[0143] Optionally, the processing module 220 is specifically configured to:

[0144] If the hard link identifier of the second file is greater than a preset value, adding a node of the second file in the tree structure corresponding to the third file path;

[0145] If the hard link identifier of the second file is equal to a preset value, the node of the second file is deleted in the tree structure corresponding to the third file path.

[0146] Optionally, the processing module 220 is further configured to:

[0147] Obtaining a file with a hard link under the first file path;

[0148] A tree structure corresponding to the first file path is established based on the files with hard links under the first file path.

[0149] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0150] Here is an example:

[0151] Figure 7 An example of a physical structure diagram of an electronic device is shown below. Figure 7 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call logic instructions in the memory 830 to execute the following method: if the first file currently being operated is a file with a hard link, then determine the first file path corresponding to the first file from at least one preset file path; if the tree structure corresponding to the first file path contains a node for the first file, then perform target processing on the current operation; and all nodes in the tree structure are file nodes with hard links.

[0152] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0153] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the file protection method provided by the above embodiments is implemented, for example, including: if the first file currently being operated is a file with a hard link, determining the first file path corresponding to the first file from at least one preset file path; if the tree structure corresponding to the first file path contains a node of the first file, performing target processing on the current operation; the nodes in the tree structure are all file nodes with hard links.

[0154] On the other hand, an embodiment of the present invention also provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the file protection method provided by the above-mentioned embodiments, for example, including: if the first file currently being operated is a file with a hard link, determining the first file path corresponding to the first file from at least one preset file path; if the tree structure corresponding to the first file path contains a node of the first file, performing target processing on the current operation; the nodes in the tree structure are all file nodes with hard links.

[0155] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0156] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A file protection method, characterized in that: include: If the first file currently being operated is a file with a hard link, determining whether the tree structure corresponding to the first file path of the first file contains a node of the first file; If the tree structure corresponding to the first file path contains a node for the first file, target processing is performed on the current operation, the target processing including reporting processing or interception processing; the nodes in the tree structure are all file nodes with hard links, and the files corresponding to the file nodes with hard links are protected files; If the first file currently being operated is a file with a hard link, before determining whether the tree structure corresponding to the first file path of the first file contains a node of the first file, the method further includes: Determining whether a first file path of the first file matches at least one preset second file path; If there is a second file path that matches the first file path, performing target processing on the current operation; If there is no match, it is determined whether the first file is a file with a hard link.

2. The method according to claim 1, characterized in that The determining whether the tree structure corresponding to the first file path of the first file contains a node of the first file includes: Matching the node identifier of the first file with the node identifier of the node in the tree structure corresponding to the first file path; If the node identifier of the first file matches the node identifier of a node in the tree structure, it is determined that the tree structure contains the node of the first file.

3. The method according to claim 2, characterized in that Before performing target processing on the current operation, the method further includes: Determining whether the path of the process corresponding to the current operation matches the path of the access subject in the preset rule corresponding to the second file path; If there is no match, target processing is performed on the current operation.

4. The method according to claim 1 or 2, characterized in that The performing target processing on the current operation includes: The current operation is reported or intercepted according to a preset strategy.

5. The method according to claim 1 or 2, characterized in that The method further comprises: When the hard link identifier of the second file changes, determining a third file path corresponding to the second file; Add or delete a node of the second file in the tree structure corresponding to the third file path.

6. The method according to claim 5, characterized in that The adding or deleting a node of the second file in the tree structure corresponding to the third file path includes: If the hard link identifier of the second file is greater than a preset value, adding a node of the second file in the tree structure corresponding to the third file path; If the hard link identifier of the second file is equal to a preset value, the node of the second file is deleted in the tree structure corresponding to the third file path.

7. The method according to claim 1 or 2, characterized in that Before determining whether the tree structure corresponding to the first file path of the first file contains a node of the first file, the method further includes: Obtaining a file with a hard link under the first file path; A tree structure corresponding to the first file path is established based on the files with hard links under the first file path.

8. A file protection device, characterized in that: include: a determination module configured to determine whether a node of the first file is included in a tree structure corresponding to the first file path if the first file currently being operated is a file having a hard link; a processing module configured to perform target processing on the current operation if the tree structure corresponding to the first file path contains a node for the first file, the target processing including reporting processing or interception processing; the nodes in the tree structure are all file nodes with hard links, and the files corresponding to the file nodes with hard links are protected files; The determining module is further configured to determine whether a first file path of the first file matches at least one preset second file path, and if a second file path matching the first file path exists, perform target processing on the current operation; If there is no match, it is determined whether the first file is a file with a hard link.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the file protection method according to any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the file protection method according to any one of claims 1 to 7 are implemented.

11. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the file protection method according to any one of claims 1 to 7.

Images