Import file inspection method, inspection system and computing device

Abstract

The present invention discloses an imported file inspection method, inspection system and computing device. The method is executed in an operating system, and a shared data volume and a container connected to the shared data volume are arranged on the operating system. The method includes: detecting whether a target file imported from the outside is newly added to the shared data volume through the container; if so, inspecting the target file, generating an inspection result file, and storing the inspection result file in the shared data volume; determining whether the target file passes the inspection according to the inspection result file; and if the inspection passes, saving the target file and the inspection result file in the shared data volume in a predetermined directory of the operating system. According to the technical solution of the present invention, the inspection function of externally imported files is implemented based on the operating system to ensure the security and integrity of files imported from the outside into the system.

Description

[0001] This application is a divisional application of invention patent application 2021112918974 filed on November 3, 2021. Technical Field

[0002] The present invention relates to the technical field of computers and operating systems, and in particular to an imported file checking method, a checking system and a computing device. Background Art

[0003] Currently, the operating system does not have a solution for checking and filtering externally imported files. Imported files are generally checked through third-party applications, such as 360 Terminal Security Protection System and 360 Security Guard.

[0004] For files imported from outside, existing operating systems lack functions such as integrity verification, installation testing, and dependency analysis for imported files. Although some Linux system developers have provided some inspection and filtering solutions for external file import systems, these inspection and filtering solutions require the use of applications specified by the developer to implement inspections on imported files. All inspection processes are encapsulated in the developer's own applications, and are not encapsulated in the operating system, and cannot be provided to all developers who can obtain system APIs.

[0005] Therefore, an inspection system and method are needed to solve the problems existing in the prior art. Summary of the invention

[0006] To this end, the present invention provides an imported file inspection method, an inspection system and a computing device to solve or at least alleviate the above problems.

[0007] According to one aspect of the present invention, there is provided a method for checking imported files, which is executed in an operating system, on which a shared data volume and a container connected to the shared data volume are arranged, and the method comprises the steps of: detecting, through the container, whether a target file imported from the outside is newly added to the shared data volume; if so, checking the target file, generating a check result file, and storing the check result file in the shared data volume; determining whether the target file passes the check based on the check result file; and if the check passes, saving the target file and the check result file in the shared data volume in a predetermined directory of the operating system.

[0008] Optionally, in the imported file checking method according to the present invention, if it is detected that a target file imported from the outside is newly added to the shared data volume, it also includes the steps of: checking whether the target file in the shared data volume is executed in the container; if so, generating a container restart file, and storing the container restart file in the shared data volume.

[0009] Optionally, the imported file checking method according to the present invention further includes the step of: when monitoring that a container restart file is newly added in the shared data volume, restarting the container according to the newly added container restart file.

[0010] Optionally, in the imported file checking method according to the present invention, the step of checking the target file includes: checking the integrity of the target file to generate integrity information, and checking the size of the target file to generate file size information; determining the target file type; if the target file type is an installation package file, performing a security check and an installation dependency check on the target file to generate security information and installation dependency information; if the target file type is an executable file, performing a security check on the target file to generate security information; and generating a check result file based on one or more of the integrity information, file size information, security information, and installation dependency information.

[0011] Optionally, the imported file checking method according to the present invention further includes the step of: if the target file check fails, deleting the target file and the check result file in the shared data volume.

[0012] Optionally, in the imported file inspection method according to the present invention, the step of saving the target file and the inspection result file in the shared data volume in a predetermined directory of the operating system includes: obtaining the target file and the inspection result file from the shared data volume; determining whether the information in the inspection result file corresponding to the target file contains one or more attribute information in the file saving attribute list, and if so, saving the inspection result file and the target file in a predetermined directory of the operating system.

[0013] Optionally, in the imported file checking method according to the present invention, the step of determining whether the target file has passed the check based on the check result file includes: when monitoring that a new check result file is added to the shared data volume, determining whether the target file has passed the check based on the new check result file.

[0014] Optionally, in the imported file checking method according to the present invention, the operating system also includes a supervision module connected to the container and the shared data volume, and the supervision module is suitable for: monitoring whether new files are added to the shared data volume, and determining the type of the new files; if the type of the new files is an inspection result file, determining whether the target file has passed the inspection based on the inspection result file; if the type of the new files is a container restart file, restarting the container according to the newly added container restart file.

[0015] Optionally, in the imported file checking method according to the present invention, the container includes a detection module and a file checking module, and the step of detecting whether a new target file imported from the outside is added to the shared data volume includes: detecting whether a new file is added to the shared data volume through the detection module, and determining the type of the new file; if the type of the new file is a target file, calling the file checking module to check the target file.

[0016] According to one aspect of the present invention, there is provided an inspection system, which is arranged on an operating system and includes: a shared data volume; a container, connected to the shared data volume, suitable for detecting whether a target file imported from the outside is newly added to the shared data volume, and if so, inspecting the target file, generating an inspection result file, and storing the inspection result file in the shared data volume; a supervision module, connected to the shared data volume and the container, suitable for determining whether the target file has passed the inspection based on the inspection result file in the shared data volume; and a file export module, connected to the supervision module and the shared data volume, suitable for saving the target file and the inspection result file in the shared data volume in a predetermined directory of the operating system after the target file has passed the inspection.

[0017] Optionally, in the inspection system according to the present invention, the container is further adapted to: check whether the target file in the shared data volume is executed in the container; if so, generate a container restart file and store the container restart file in the shared data volume.

[0018] Optionally, in the inspection system according to the present invention, the supervision module is further adapted to: when monitoring that a container restart file is newly added in the shared data volume, restart the container according to the newly added container restart file to initialize the container.

[0019] Optionally, in the inspection system according to the present invention, the container is further suitable for: checking the integrity of the target file to generate integrity information, and checking the size of the target file to generate file size information; determining the target file type; if the target file type is an installation package file, performing a security check and an installation dependency check on the target file to generate security information and installation dependency information; if the target file type is an executable file, performing a security check on the target file to generate security information; and generating an inspection result file based on one or more of the integrity information, file size information, security information, and installation dependency information.

[0020] Optionally, in the inspection system according to the present invention, the file export module is further adapted to: obtain the target file and the inspection result file from the shared data volume; determine whether the information in the inspection result file corresponding to the target file contains one or more attribute information in the file saving attribute list, and if so, save the inspection result file and the target file in a predetermined directory of the operating system.

[0021] Optionally, in the inspection system according to the present invention, the supervision module is suitable for: monitoring whether new files are added to the shared data volume, and determining the type of the new files; if the type of the new files is an inspection result file, determining whether the target file has passed the inspection based on the inspection result file; if the type of the new files is a container restart file, restarting the container based on the newly added container restart file.

[0022] Optionally, in the inspection system according to the present invention, the container includes: a detection module, suitable for detecting whether new files are added to the shared data volume and determining the type of the new files; a file inspection module, suitable for inspecting the target file when the type of the new file is a target file.

[0023] According to one aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for being executed by the at least one processor, and the program instructions include instructions for executing the import file checking method as described above.

[0024] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the imported file checking method as described above.

[0025] According to the technical solution of the present invention, a method and system for checking imported files are provided. By constructing a checking system including containers and shared data volumes on the operating system, the function of checking external imported files is integrated into the operating system. Based on this, by importing files (external files) downloaded by third-party applications into the shared data volume, the files in the shared data volume can be checked based on the checking system. Only after the inspection is passed will the files be saved in a predetermined directory of the operating system to ensure that only files that have passed the inspection can be imported into the operating system. In this way, the security and integrity of files imported from the outside into the system can be ensured.

[0026] Furthermore, after the external file is checked and passed, it is also determined whether the file meets the import conditions based on the file save attribute list, and the file will be imported into the system only when the import conditions are met. In this way, the filtering function of external imported files is realized.

[0027] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0029] Figure 1 A schematic diagram of an inspection system 100 according to an embodiment of the present invention is shown;

[0030] Figure 2 A schematic diagram of a computing device 200 according to an embodiment of the present invention is shown;

[0031] Figure 3 A flow chart of an imported file checking method 300 according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0032] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0033] Figure 1 A schematic diagram of an inspection system 100 according to an embodiment of the present invention is shown. The inspection system 100 is suitable for executing the imported file inspection method according to the present invention, so as to inspect and filter the files imported externally into the operating system.

[0034] The inspection system 100 resides in a computing device, where the computing device is a host computer running an operating system, and the operating system is a system that needs to be protected by inspecting external imported files.

[0035] The inspection system 100 is deployed on an operating system of a computing device. It can be understood that an operating system includes a kernel and a user space arranged on the kernel. Here, the inspection system 100 is arranged in the kernel of the operating system. The user space of the operating system can arrange one or more applications. It should be noted that the present invention does not specifically limit the type of operating system. For example, the operating system can be implemented as a Linux operating system or a Windows operating system.

[0036] like Figure 1 As shown, the inspection system 100 includes a container 130 running on an operating system, a shared data volume 150, a supervision module 110, and a file export module 160 arranged on the operating system. Among them, the container 130, the supervision module 110, and the file export module 160 are all connected to the shared data volume 150. The supervision module 110 is also connected to the container 130 and the file export module 160 respectively.

[0037] It should be noted that the supervision module 110 is a boot service program, through which the file changes in the shared data volume and the management container 130 can be monitored. The shared data volume 150 is a data volume (the operating system directory can be mapped into the container), which is a file system that enables the operating system of the computing device to share data with the container 130. The container is an independent virtual operating system that is started based on the container image, and the virtual operating system runs on the operating system of the computing device (host). Here, the container image encapsulates the operating environment of the operating system and is pre-integrated in the operating system of the computing device.

[0038] In one embodiment, the supervision module 110 may be configured to automatically start after the computing device is turned on. After starting, the supervision module 110 may modify the configuration information of the container based on the creation information of the shared data volume, so as to mount the shared data volume 150 to the container 130, so that the container 130 can access the files in the shared data volume 150. In addition, the supervision module 110 may create a container based on the container image and start the container, so that the container 130 runs on the operating system.

[0039] According to an embodiment of the present invention, the container 130 can detect whether a target file imported from outside is newly added to the shared data volume 150. Specifically, the container detects file changes in the shared data volume, and when it detects that a file is newly added to the shared data volume, it determines the type of the newly added file. If the type of the newly added file is a target file, it is detected that a target file imported from outside is newly added to the shared data volume.

[0040] It should be noted that the target file is a file imported from the outside into the shared data volume on the operating system through an interface, which may include installation package files, executable files, ordinary files, etc. The interface is an interface (API) provided by the operating system that can be called by one or more applications (third-party applications) when downloading files. The interface is called to check the downloaded external files. Specifically, one or more applications can call the interface when downloading files so as to import the downloaded files into the shared file volume 150 on the operating system. After one or more applications download the files, the files imported into the shared file volume are the target files to be checked. The application that calls the interface can be implemented as a mailbox, various social applications, etc., for example, and the present invention is not limited to the specific type of application.

[0041] If it is detected that a target file imported from the outside is newly added to the shared data volume 150 , the container 130 will check the target file, generate a check result file, and output and store the check result file in the shared data volume 150 .

[0042] According to one embodiment, Figure 1 As shown, the container 130 includes a detection module 131 and a file inspection module 132. The detection module 131 in the container 130 can detect whether a target file imported from the outside is newly added to the shared data volume. The file inspection module 132 in the container 130 can inspect the target file, generate an inspection result file, and output and store the inspection result file in the shared data volume 150.

[0043] Specifically, the container 130 first detects whether a new file is added to the shared data volume through the detection module 131, and determines the type of the new file. When it is determined that the type of the new file is a target file, the file checking module 132 is called to check the target file.

[0044] The supervision module 110 can determine whether the target file has passed the inspection based on the inspection result file. Specifically, the supervision module 110 is connected to the shared data volume 150 and can monitor whether a new inspection result file is added to the shared data volume 150. When the inspection result file is added to the shared data volume, the supervision module 110 determines whether the target file has passed the inspection based on the inspection result file.

[0045] If the target file passes the check, the target file and the check result file in the shared data volume 150 that pass the check are exported through the file export module 160 and saved in a predetermined directory of the operating system. Here, the predetermined directory can be a directory selected by the application when calling the interface to download the file, and the present invention does not make specific restrictions on the predetermined directory. In addition, if the target file fails the check, the file export module 160 will delete the target file and the check result file in the shared data volume 150, so that they will not be imported into the operating system.

[0046] According to one embodiment, when calling the file checking module 132 to check the target file, the container 130 also checks whether the target file in the shared data volume is executed in the container 130 through the file checking module 132. If it is checked that the target file in the shared data volume 150 is installed and executed in the container 130, a container restart file is generated in the container 130, and the container restart file is stored in the shared data volume 130.

[0047] The monitoring module 110 can monitor whether a new container restart file is added to the shared data volume 150. When a new container restart file is detected in the shared data volume, the container 130 is restarted according to the new container restart file to initialize the container. Specifically, the monitoring module 110 restarts the container by shutting down the currently running container, deleting the container, recreating a new container based on the container image, and loading the new container.

[0048] After startup, the supervision module 110 can monitor the directory of the shared data volume 150, wherein the monitoring module 110 monitors whether a new file is added to the directory of the shared data volume 150. When a new file is detected, the type of the new file is determined. If the type of the new file is a check result file, it is determined whether the target file has passed the check according to the check result file. If the type of the new file is a container restart file, the container is restarted according to the newly added container restart file.

[0049] In addition, if the monitoring module 110 monitors that the type of the newly added file in the shared data volume is the target file, the target file is ignored and no processing is performed. Correspondingly, if the detection module 131 in the container 130 detects that the type of the newly added file in the shared data volume is the inspection result file or the container restart file, the detected inspection result file or container restart file is ignored and no processing is performed. In addition, when the monitoring module 110 and the detection module 131 in the container 130 detect that the file in the shared data volume is reduced, the file change is ignored and no processing is performed.

[0050] According to an embodiment of the present invention, the file checking module 132 in the container 130 may check the target file according to the following steps:

[0051] First, the integrity of the target file can be checked to generate integrity information. Here, the integrity check is to check whether the target file is accurate.

[0052] Subsequently, the size of the target file is checked to generate file size information. Here, checking the size of the target file can determine the size of the storage space occupied by the target file.

[0053] Next, the type of the target file is checked to determine the target file type. Here, the target file type includes, for example, an installation package file, an executable file, and a common file. The installation package file is a software installation package, which is a collection of files that can be decompressed by itself, and contains all the files of the software installation package. An executable file is a file that can be downloaded and executed by the operating system, such as a script file, an ELF file, etc. Common files include, for example, text files, Office files, PDF files, audio and video files, etc.

[0054] If the target file type is an installation package file, a security check and an installation dependency check can be performed on the target file to generate corresponding security information and installation dependency information. If the target file type is an executable file, a security check is performed on the target file to generate security information. Here, the security check is to determine whether the executable file has been compiled with security hardening by reading the symbol table of the executable file.

[0055] Next, a check result file is generated based on one or more of the integrity information, file size information, security information, and installation dependency information. Here, the check result file contains all attribute information of the target file, which is a summary of the integrity information, file size information, security information, and installation dependency information generated during the aforementioned check process.

[0056] It should be noted that the integrity of the target file and the size of the target file are checked for all types of target files. When the target file type is an installation package file, since a security check and an installation dependency check are also performed during the inspection process, the inspection result file finally generated after the inspection of the target file (installation package file) is completed contains integrity information, file size information, security information, and installation dependency information. When the target file type is an executable file, since a security check is also performed during the inspection process, the inspection result file finally generated after the inspection of the target file (executable file) is completed contains integrity information, file size information, and security information. In addition, when the target file type is an ordinary file, only an integrity check and a file size check are performed. Therefore, the inspection result file finally generated after the inspection of the target file (ordinary file) is completed contains integrity information and file size information.

[0057] In one embodiment, the supervision module 110 is respectively connected to the file export module 160 and the shared data volume 150. After determining that the target file in the shared data volume 150 has passed the inspection, the supervision module 110 calls the file export module 160, obtains the target file that has passed the inspection and the corresponding inspection result file from the shared data volume 150 through the file export module 160, and saves the target file that has passed the inspection and the corresponding inspection result file in a predetermined directory of the operating system, thereby importing the target file into the operating system.

[0058] In one embodiment, the generated inspection result file is passed to the shared data volume 150 so that the file export module 160 can determine whether the corresponding target file meets the import conditions based on the inspection result file in the shared data volume 150. Only when the import conditions are met will the target file be imported into the predetermined directory of the operating system so as to filter the external imported files.

[0059] Specifically, the file export module 160 includes a file saving attribute list that can be configured by the user, and the file saving attribute list includes one or more attribute information that can be configured by the user according to actual needs. After obtaining the target file that has passed the inspection and the corresponding inspection result file from the shared data volume 150, it is determined whether the information in the inspection result file corresponding to the target file contains one or more attribute information in the file saving attribute list. If the inspection result file contains one or more attribute information in the file saving attribute list, it is determined that the import condition is met, and the inspection result file and the target file are saved in a predetermined directory of the operating system. Otherwise, if the information in the inspection result file does not contain one or more attribute information in the file saving attribute list, the import condition is not met, and the file export module 160 directly deletes the inspection result file and the target file. In this way, the filtering function of external imported files is realized based on the file saving attribute list.

[0060] In one embodiment, the computing device on which the checking system 100 resides may be implemented as a computing device 200 , so that the imported file checking method of the present invention may be executed in the computing device 200 .

[0061] Figure 2 A schematic diagram of a computing device 200 according to one embodiment of the present invention is shown.

[0062] like Figure 2 As shown, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.

[0063] Depending on the desired configuration, the processor 204 can be any type of processing, including but not limited to: a microprocessor (UP), a microcontroller (UC), a digital information processor (DSP), or any combination thereof. The processor 204 can include one or more levels of cache such as a primary cache 210 and a secondary cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.

[0064] Depending on the desired configuration, the system memory 206 can be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 206 may include an operating system 220, one or more applications 222, and program data 224. The application 222 is actually a plurality of program instructions, which are used to instruct the processor 204 to perform corresponding operations. In some embodiments, the application 222 can be arranged to cause the processor 204 to operate using the program data 224 on the operating system.

[0065] Computing device 200 also includes storage device 232 , which includes removable storage 236 and non-removable storage 238 .

[0066] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to the basic configuration 202 via the bus / interface controller 230. At least a portion of the operating system 220, the application 222, and the data 224 may be stored on the removable storage 236 and / or the non-removable storage 238, and when the computing device 200 is powered on or the application 222 is to be executed, it is loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204.

[0067] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include an image processing unit 248 and an audio processing unit 250. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which may be arranged to facilitate communication with one or more other computing devices 262 via a network communication link via one or more communication ports 264.

[0068] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be performed in the signal in a manner that encodes information. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0069] In an embodiment according to the present invention, the computing device 200 is configured to execute the imported file checking method 300 according to the present invention. The operating system of the computing device 200 includes a plurality of program instructions for executing the imported file checking method 300 of the present invention, so that the imported file checking method 300 of the present invention can be executed in the operating system of the computing device 200.

[0070] According to one embodiment of the present invention, the inspection system 100 is deployed on the operating system of the computing device 200, and specifically, the inspection system 100 is arranged in the kernel of the operating system of the computing device 200. The inspection system 100 includes a container 130 running on the operating system, and a shared data volume 150, a supervision module 110, and a file export module 160 arranged on the operating system, wherein the container 130, the supervision module 110, and the file export module 160 are all connected to the shared data volume 150. The inspection system 100 includes a plurality of program instructions for executing the imported file inspection method 300, and these program instructions can instruct the processor 204 to execute the imported file inspection method 300 of the present invention, so that the operating system of the computing device 200 can implement the inspection of the files imported into the external system by executing the imported file inspection method 300 of the present invention.

[0071] It should be noted that the present invention does not impose any specific limitation on the type of operating system. For example, the operating system may be implemented as a Linux operating system or a Windows operating system.

[0072] Figure 3 The flowchart of the imported file checking method 300 according to one embodiment of the present invention is shown. The method 300 is suitable for being executed in the checking system 100 deployed on the operating system of a computing device (such as the aforementioned computing device 200).

[0073] like Figure 3 As shown, the method 300 starts at step S310 .

[0074] In step S310 , the container 130 detects whether a target file imported from outside is newly added to the shared data volume.

[0075] Specifically, the container detects file changes in the shared data volume. When it detects that a new file is added to the shared data volume, it determines the type of the new file. If the type of the new file is a target file, it is detected that a target file imported from the outside is added to the shared data volume.

[0076] It should be noted that the target file is a file imported from the outside into the shared data volume on the operating system through an interface, which may include installation package files, executable files, ordinary files, etc. The interface is an interface (API) provided by the operating system that can be called by one or more applications when downloading files. In other words, one or more applications can call the interface when downloading files to import the downloaded files into the shared file volume 150 on the operating system. After one or more applications download the files, the files imported into the shared file volume are the target files to be checked. The application that calls the interface can be implemented as a mailbox, various social applications, etc., for example, and the present invention is not limited to the specific type of application.

[0077] If it is detected that a target file imported from outside is newly added to the shared data volume, step S320 is executed. In step S320, the target file is checked, a check result file is generated, and the check result file is stored in the shared data volume.

[0078] According to an embodiment of the present invention, the container 130 includes a detection module 131 and a file checking module 132. The detection module 131 in the container 130 may execute step S310 to detect whether a target file imported from the outside is newly added to the shared data volume. The file checking module 132 in the container 130 may execute step S320 to check the target file, generate a check result file, and output and store the check result file in the shared data volume 150.

[0079] Specifically, the container 130 first detects whether a new file is added to the shared data volume through the detection module 131, and determines the type of the new file. If the type of the new file is a target file, the file checking module 132 is called to check the target file.

[0080] Subsequently, in step S330, the supervision module 110 determines whether the target file has passed the inspection according to the inspection result file. Specifically, the supervision module 110 is connected to the shared data volume 150, and can monitor whether a new inspection result file is added to the shared data volume. When the inspection result file is added to the shared data volume, the supervision module 110 determines whether the target file has passed the inspection according to the inspection result file.

[0081] Finally, in step S340, if it is determined that the target file has passed the inspection, the target file and the inspection result file that have passed the inspection in the shared data volume 150 are exported through the file export module 160 and saved in a predetermined directory of the operating system. In this way, after the target file is inspected, the target file that has passed the inspection is imported into the operating system. Here, the predetermined directory can be the directory selected by the application when calling the interface to download the file, and the present invention does not make any specific restrictions on the predetermined directory.

[0082] In addition, if the target file fails to pass the check, the target file and the check result file in the shared data volume 150 are deleted. In this way, the target file that fails the check will not be imported into the operating system.

[0083] In one implementation, the supervision module 110 can be configured to automatically start after the computing device is turned on. Before executing the method 300, the shared data volume 150 and the container 130 are pre-created on the operating system through the supervision module 110. Among them, after starting, the supervision module 110 can modify the configuration information of the container based on the creation information of the shared data volume, so as to mount the shared data volume 150 to the container 130, so that the container 130 can access the files in the shared data volume 150. In addition, the supervision module 110 can create a container based on the container image and start the container so that the container 130 runs on the operating system.

[0084] According to one embodiment, if it is detected that a target file imported from the outside is newly added to the shared data volume, when the container 130 calls the file checking module 132 to check the target file, it also checks whether the target file in the shared data volume is executed in the container through the file checking module 132. If it is checked that the target file in the shared data volume is installed and executed in the container, a container restart file is generated in the container 130 and the container restart file is stored in the shared data volume 130.

[0085] Subsequently, the container 130 is restarted according to the container restart file to initialize the container 130. Here, the supervision module 110 can also monitor whether a new container restart file is added to the shared data volume 150. When a new container restart file is detected in the shared data volume, the container 130 is restarted according to the newly added container restart file to initialize the container. Specifically, the supervision module 110 restarts the container by shutting down the currently running container, deleting the container, recreating a new container based on the container image, and loading the new container.

[0086] In one implementation, the supervision module 110 may monitor whether a new file is added to the shared data volume 150, and determine the type of the new file. If the type of the new file is a check result file, determine whether the target file has passed the check according to the check result file. If the type of the new file is a container restart file, restart the container according to the new container restart file.

[0087] In addition, if the monitoring module 110 monitors that the type of the newly added file in the shared data volume is the target file, the target file is ignored and no processing is performed. Correspondingly, if the detection module 131 in the container 130 detects that the type of the newly added file in the shared data volume is the inspection result file or the container restart file, the detected inspection result file or container restart file is ignored and no processing is performed. In addition, when the monitoring module 110 and the detection module 131 in the container 130 detect that the file in the shared data volume is reduced, the file change is ignored and no processing is performed.

[0088] According to an embodiment of the present invention, when it is detected that a target file imported from outside is newly added to a shared data volume, the target file may be checked according to the following steps:

[0089] First, the integrity of the target file can be checked to generate integrity information. Here, the integrity check is to check whether the target file is accurate.

[0090] Subsequently, the size of the target file is checked to generate file size information. Here, checking the size of the target file can determine the size of the storage space occupied by the target file.

[0091] Next, the type of the target file is checked to determine the target file type. Here, the target file type includes, for example, an installation package file, an executable file, and a common file. The installation package file is a software installation package, which is a collection of files that can be decompressed by itself, and contains all the files of the software installation package. An executable file is a file that can be downloaded and executed by the operating system, such as a script file, an ELF file, etc. Common files include, for example, text files, Office files, PDF files, audio and video files, etc.

[0092] If the target file type is an installation package file, a security check and an installation dependency check can be performed on the target file to generate corresponding security information and installation dependency information. If the target file type is an executable file, a security check is performed on the target file to generate security information. Here, the security check is to determine whether the executable file has been compiled with security hardening by reading the symbol table of the executable file.

[0093] Next, a check result file is generated based on one or more of the integrity information, file size information, security information, and installation dependency information. Here, the check result file contains all attribute information of the target file, which is a summary of the integrity information, file size information, security information, and installation dependency information generated during the aforementioned check process.

[0094] It should be noted that the integrity of the target file and the size of the target file are checked for all types of target files. When the target file type is an installation package file, since a security check and an installation dependency check are also performed during the inspection process, the inspection result file finally generated after the inspection of the target file (installation package file) is completed contains integrity information, file size information, security information, and installation dependency information. When the target file type is an executable file, since a security check is also performed during the inspection process, the inspection result file finally generated after the inspection of the target file (executable file) is completed contains integrity information, file size information, and security information. In addition, when the target file type is an ordinary file, only an integrity check and a file size check are performed. Therefore, the inspection result file finally generated after the inspection of the target file (ordinary file) is completed contains integrity information and file size information.

[0095] According to one embodiment, the file export module 160 is connected to the shared data volume 150. The file export module 160 can obtain the target file that has passed the inspection and the corresponding inspection result file from the shared data volume 150, and save the target file that has passed the inspection and the corresponding inspection result file in a predetermined directory of the operating system, thereby importing the target file into the operating system.

[0096] In one embodiment, the generated inspection result file is passed to the shared data volume 150 so that the file export module 160 can determine whether the corresponding target file meets the import conditions based on the inspection result file in the shared data volume 150. When the import conditions are met, the target file can be imported into the operating system to filter the external imported files.

[0097] Specifically, the file export module 160 includes a file saving attribute list that can be configured by the user, and the file saving attribute list includes one or more attribute information that can be configured by the user according to actual needs. After obtaining the target file that has passed the inspection and the corresponding inspection result file from the shared data volume 150, it is also determined whether the information in the inspection result file corresponding to the target file contains one or more attribute information in the file saving attribute list. If the inspection result file contains one or more attribute information in the file saving attribute list, it is determined that the import condition is met, and the inspection result file and the target file are saved in a predetermined directory of the operating system. Otherwise, if the information in the inspection result file does not contain one or more attribute information in the file saving attribute list, the import condition is not met, and the file export module 160 directly deletes the inspection result file and the target file. In this way, the filtering function of external imported files is realized based on the file saving attribute list.

[0098] According to the imported file inspection scheme of the present invention, by constructing an inspection system including containers and shared data volumes on the operating system, the inspection function of external imported files is integrated into the operating system. Based on this, by importing the files (external files) downloaded by third-party applications into the shared data volume, the files in the shared data volume can be inspected based on the inspection system. Only after the inspection is passed will the files be saved in a predetermined directory of the operating system to ensure that only files that have passed the inspection can be imported into the operating system. In this way, the security and integrity of files imported from the outside to the system can be ensured. Furthermore, after the external file inspection is passed, it is also determined based on the file saving attribute list whether the file meets the import conditions, and the file will be imported into the system only when the import conditions are met. In this way, the filtering function of external imported files is realized.

[0099] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or parts of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0100] In the case where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the import file checking method of the present invention according to the instructions in the program code stored in the memory.

[0101] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0102] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0103] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0104] Similarly, it should be understood that in order to streamline the disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the invention.

[0105] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0106] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0107] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present invention and to form different embodiments.

[0108] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0109] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0110] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A method for checking an imported file is executed in an operating system, wherein a shared data volume and a container connected to the shared data volume are arranged on the operating system, and the method comprises the steps of: Use the container to detect whether a new target file imported from the outside is added to the shared data volume; If yes, check the target file, generate a check result file, and store the check result file in the shared data volume; Determine whether the target file has passed the inspection according to the inspection result file; If the check passes, the target file and the check result file are obtained from the shared data volume, and it is determined whether the information in the check result file corresponding to the target file contains one or more attribute information in the file saving attribute list; if so, it is determined that the import condition is met, and the target file and the check result file are saved in a predetermined directory of the operating system; If not, it is determined that the import condition is not met, and the target file and the inspection result file are deleted; Checking whether the target file in the shared data volume is executed in the container; If yes, generating a container restart file in the container, and storing the container restart file in the shared data volume; When it is monitored that a container restart file is newly added in the shared data volume, the container is restarted according to the newly added container restart file to initialize the container.

2. The method of claim 1, wherein: The step of checking the target file includes: Checking the integrity of the target file to generate integrity information, and checking the size of the target file to generate file size information; Determine the target file type; If the target file type is an installation package file, a security check and an installation dependency check are performed on the target file to generate security information and installation dependency information; If the target file type is an executable file, a security check is performed on the target file to generate security information; A check result file is generated based on the integrity information, file size information, security information and installation dependency information.

3. An inspection system, arranged on an operating system, comprising: Shared data volumes; a container connected to the shared data volume, adapted to detect whether a target file imported from the outside is newly added to the shared data volume, and if so, to check the target file, generate a check result file, and store the check result file in the shared data volume; the container is also adapted to check whether the target file in the shared data volume is executed in the container, and if so, to generate a container restart file, and store the container restart file in the shared data volume, so as to restart the container according to the container restart file; A supervision module, connected to the shared data volume and the container, adapted to determine whether the target file has passed the inspection according to the inspection result file in the shared data volume; and also adapted to: when a container restart file is newly added in the shared data volume, restart the container according to the newly added container restart file, so as to initialize the container; as well as a file export module connected to the supervision module and the shared data volume, adapted to obtain the target file and the inspection result file from the shared data volume after the target file has passed the inspection, determine whether the information in the inspection result file corresponding to the target file contains one or more attribute information in the file saving attribute list, and if so, determine that the import condition is met, and save the target file and the inspection result file in the shared data volume in a predetermined directory of the operating system; If not, it is determined that the import condition is not satisfied, and the target file and the inspection result file are deleted.

4. The inspection system according to claim 3, wherein: The supervision module is suitable for: Monitor whether new files are added to the shared data volume and determine the type of the new files; If the type of the newly added file is a check result file, determining whether the target file has passed the check according to the check result file; If the type of the newly added file is a container restart file, the container is restarted according to the newly added container restart file.

5. A computing device comprising: at least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 2.

6. A readable storage medium storing program instructions, when the program instructions are read and executed by a computing device, the computing device executes the method according to any one of claims 1 to 2.

Images