Tamper-proof data protection method and system

Abstract

The present application relates to a kind of tamper-proof data protection method and system, the method runs in computer system kernel, comprising the following steps: 1) access instruction to data is obtained, the access instruction includes access object path and access process information;2) it is judged whether the access object path exists in the protection path whitelist list maintained or the sub-path of certain path in the protection path whitelist list, if yes, then step 3) is executed, if no, then allow to call signal is generated;3) according to the access process information, it is judged whether the current access process exists in the process whitelist list maintained, if yes, then allow to call signal is generated, if no, then access signal is generated to refuse.The present application has the advantages of effectively protecting against human destruction and malicious programs such as ransomware, compared with the prior art.

Description

Technical Field

[0001] This invention relates to data protection technology in the field of computer storage, and in particular to a data protection method and system for preventing tampering. Background Technology

[0002] With the rapid development of computer and network technologies, most enterprises now use computers and networks to operate their core businesses, and the resulting data has become a core asset of these enterprises. The loss, damage, or leakage of any core data can have serious negative impacts on a company.

[0003] In recent years, ransomware has emerged in endless streams and is difficult to defend against. Once infected, there is basically no solution; either the ransom is paid for data recovery, or the data is lost or publicly disclosed. Current ransomware detection and removal functions identify and eliminate ransomware by recognizing its signature values ​​and behaviors, which suffers from limitations such as slow updates to the virus signature database, low recognition rate, and false positives. Furthermore, antivirus vendors' solutions focus on protecting the process security of production systems and cannot be held responsible for data security.

[0004] A search of Chinese invention patent CN110457920A reveals a data encryption method and device. The method includes the following steps: a client host enters a password to open an encrypted disk, allowing an application to access the data on the disk; before access, an encryption server implements access control permissions on the accessing application; the stored data is encrypted and written to a storage device; the client host sends a request to close the encrypted disk, and the encrypted disk is closed. This method enhances the reliability and compatibility of data protection to some extent, but its data protection verification procedures are not comprehensive enough. In cases where malicious human error or accidental operations (such as RM-RF) cause data corruption on the backup system, it cannot be protected by existing data protection schemes.

[0005] Therefore, an innovative and effective method is needed to protect enterprise systems from malicious programs and human sabotage, thus becoming the last solid barrier for enterprise data protection. Summary of the Invention

[0006] The purpose of this invention is to overcome the defects of the prior art and provide a data protection method and system that prevents tampering, effectively protecting against human sabotage and malicious programs such as ransomware.

[0007] The objective of this invention can be achieved through the following technical solutions:

[0008] A data protection method to prevent tampering, which runs in the computer system kernel, includes the following steps:

[0009] 1) Obtain the access instruction for the data, which includes the access object path and access process information;

[0010] 2) Determine whether the access object path exists in the maintained protected path whitelist or a sub-path of a path in the protected path whitelist. If yes, proceed to step 3); otherwise, generate an allow call signal.

[0011] 3) Determine whether the current access process exists in the maintained process whitelist based on the access process information. If it does, generate an allow call signal; otherwise, generate an access denial signal.

[0012] The protected path whitelist is obtained through the following steps:

[0013] Obtain the absolute path of the protected object and its corresponding protection permissions, and generate the corresponding interface verification code;

[0014] The interface verification code is verified. If the verification is successful, a registration verification code is generated.

[0015] The registration verification code is verified. If the verification is successful, the absolute path of the corresponding protected object is added to the protection path whitelist. The protection path whitelist is stored in the computer system kernel. Each path in the protection path whitelist has the corresponding protection permission.

[0016] The process whitelist is obtained through the following steps:

[0017] Obtain the process information that needs to be registered and generate the corresponding interface verification code;

[0018] The interface verification code is verified. If the verification is successful, a registration verification code is generated.

[0019] The registration verification code is verified. If the verification is successful, the corresponding process information that needs to be registered is added to the process whitelist, which is stored in the computer system kernel.

[0020] Furthermore, the protected objects include files, directories, or devices.

[0021] Furthermore, if the protected object is a file or directory, then in the step of obtaining the whitelist of protected paths, if the registration verification code is successfully verified, the corresponding partition and disk information will be obtained simultaneously.

[0022] Furthermore, the process information includes the process PID and process name.

[0023] Furthermore, the interface verification code, registration verification code, or the interface verification code is generated using SSL encryption authentication.

[0024] This invention also provides a tamper-proof data protection system, including a configuration module, a parameter verification module, a user-mode interaction module, and a system call verification driver module, wherein...

[0025] The system call verification driver module is used to obtain access instructions for data. The access instructions include access object path and access process information. It determines whether the access object path exists in the maintained protected path whitelist or a sub-path of a path in the protected path whitelist. If the determination result is yes, it determines whether the current access process exists in the maintained process whitelist based on the access process information. If yes, it generates an allowed call signal; otherwise, it generates an access denied signal.

[0026] The protected path whitelist and process whitelist are obtained collaboratively by the configuration module, parameter verification module, user-mode interaction module, and system call verification driver module. Specifically:

[0027] The configuration module obtains the absolute path of the protected object and its corresponding protection permissions, calls the parameter verification module to generate a corresponding interface verification code, and transmits the absolute path and interface verification code to the user-mode interaction module. The user-mode interaction module calls the parameter verification module to verify the interface verification code. If the verification is successful, it calls the parameter verification module to generate a registration verification code, and transmits the absolute path and registration verification code to the system call verification driver module. The system call verification driver module verifies the registration verification code. If the verification is successful, it adds the absolute path of the corresponding protected object to the protection path whitelist. Each path in the protection path whitelist has the corresponding protection permissions.

[0028] The user-mode program that needs to register calls the parameter verification module to generate the corresponding interface verification code, and simultaneously transmits its own process information and the interface verification code to the user-mode interaction module; the user-mode interaction module calls the parameter verification module to verify the interface verification code, and after successful verification, calls the parameter verification module to generate a registration verification code, and simultaneously transmits the process information and the registration verification code to the system call verification driver module; the system call verification driver module verifies the registration verification code, and after successful verification, adds the corresponding process information that needs to be registered to the process whitelist list;

[0029] The system call verification driver module is built into the computer system kernel.

[0030] Furthermore, the protected objects include files, directories, or devices.

[0031] Furthermore, if the protected object is a file or directory, the user-mode interaction module generates a verification code for verification and simultaneously obtains the corresponding partition and disk information.

[0032] Furthermore, the process information includes the process PID and process name.

[0033] Furthermore, the configuration module and the user-mode interaction module call the parameter verification module through SSL encrypted authentication.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. This invention achieves accurate and efficient protection of files through dual-layer verification of paths and processes and built-in system call verification driver. There is no problem of malicious programs being missed. Moreover, it only needs to be installed and configured once and no further updates are required.

[0036] 2. This invention uses SSL encryption authentication to generate verification codes, which has high reliability.

[0037] 3. This invention can be applied to various situations, including ransomware or other malicious operations, human malicious operations, or accidental operations. When ransomware or other malicious processes search for, encrypt, delete, or damage files in a computer system, they cannot legally register their process ID (PID) and process name with the kernel system call verification driver module. Therefore, they cannot access protected files, directories, or devices, and thus cannot damage, encrypt, or leak data in the computer system. Human operations, primarily performed via the command line, also cannot legally register the shell process and its corresponding command process with the kernel system call verification driver module. Therefore, they also lack the permission to access protected files, directories, and devices, thereby preventing malicious or accidental operations. Attached Figure Description

[0038] Figure 1 This is a system structure diagram of the present invention;

[0039] Figure 2 This is a flowchart of the whitelist registration process for the protected path of this invention;

[0040] Figure 3 This is a flowchart of the whitelist registration process for the present invention;

[0041] Figure 4 This is a flowchart illustrating the tamper-proof data access process of the present invention. Detailed Implementation

[0042] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0043] This invention provides a data protection method to prevent tampering. The method runs in the computer system kernel and includes the following steps: 1) Obtaining an access instruction for data, which includes the access object path and access process information; 2) Determining whether the access object path exists in a maintained protected path whitelist or a subpath of a path in the protected path whitelist. If yes, proceed to step 3); otherwise, generate an allow signal; 3) Determining whether the current accessing process exists in a maintained process whitelist based on the access process information. If yes, generate an allow signal; otherwise, generate an access denial signal. In other words, in this method, if the transmitted file path is not within the protected scope or the current process is in the process whitelist, it is allowed to call the actual system functions. The protected path whitelist and process whitelist can be dynamically maintained.

[0044] In the above method, both the protected path whitelist and the process whitelist are obtained through verification codes. Specifically, the protected path whitelist is obtained through the following steps: obtaining the absolute path of the protected object and its corresponding protection permissions, and generating a corresponding interface verification code; verifying the interface verification code, and generating a registration verification code upon successful verification; verifying the registration verification code, and adding the absolute path of the corresponding protected object to the protected path whitelist upon successful verification. This protected path whitelist is stored in the computer system kernel, and each path in the protected path whitelist has the corresponding protection permissions. The process whitelist is obtained through the following steps: obtaining the process information to be registered, and generating a corresponding interface verification code; verifying the interface verification code, and generating a registration verification code upon successful verification; verifying the registration verification code, and adding the corresponding process information to be registered to the process whitelist upon successful verification. This process whitelist is stored in the computer system kernel.

[0045] In one specific implementation, the above method can be achieved through, for example... Figure 1 The data protection system shown is a tamper-proof system. The system consists of a user-mode configuration module 1, a parameter verification module 2, and a user-mode interaction module 3, as well as a kernel-mode module including a system call verification driver module 4. Through the cooperation of these modules, the system implements the protection path whitelist registration process, the process whitelist registration process, and the system call legality detection process.

[0046] like Figure 2 As shown, the protection path whitelist registration process includes the following steps:

[0047] S101. Pass the absolute path of the file, directory or device to be protected to the configuration module. The configuration module calls the parameter verification module to generate the interface verification code. If the interface verification code is successfully generated, the protected path and the interface verification code are passed to the user-mode interaction module.

[0048] S102. The user-mode interaction module calls the parameter verification module to verify the interface verification code. After successful verification, the parameter verification module is called to generate the registration verification code. If the registration verification code is successfully generated, the protected path and the registration verification code are registered to the system call verification driver module.

[0049] S103. After entering kernel mode, the system calls the verification driver module to obtain the registration information, first verify the registration verification code, and then add the relevant protection path to the protection path whitelist after successful verification.

[0050] like Figure 3 As shown, the process whitelist registration process specifically includes the following steps:

[0051] S201. The user-mode program calls the parameter verification module to generate the interface verification code. If the interface verification code is successfully generated, the process pid, process name and interface verification code are passed to the user-mode interaction module.

[0052] S202. The user-mode interaction module calls the parameter verification module to verify the interface verification code. After the verification is successful, the parameter verification module is called to generate the registration verification code. If the registration verification code is successfully generated, the process pid, process name and registration verification code are registered to the system call verification driver module.

[0053] S203. After entering kernel mode, the system calls the verification driver module to obtain the registration information. First, it verifies the registration verification code. After successful verification, it adds the relevant process PID and process name to the process whitelist.

[0054] like Figure 4 As shown, the system call validity check process specifically includes the following steps:

[0055] S301. When a user-mode program accesses a file, it will invoke a system call provided by the operating system.

[0056] S302. Enter kernel mode and pass the file path, process PID and other information to the system kernel. This information will first be passed to the system call verification driver module.

[0057] S303. The system call verification driver module will check whether the transmitted file path is in the protected path list and its subpaths. If it is, then step S304 will be executed. If it is not, then the call to the real system function will be allowed.

[0058] S304. Check if the process PID and process name of the currently accessing process are in the process whitelist. If not, reject the system call and return an error code directly to the user-mode program. If the current process is in the process whitelist, allow it to call the actual system functions.

[0059] The aforementioned interface verification code refers to the interface provided by the user-mode interaction module. When the application calls this interface, it needs to pass in an interface verification code. The interface verification code can be generated by the parameter verification module. After receiving the interface verification code, the user-mode interaction module will call the parameter verification module to verify the validity of the verification code, so as to prevent unauthorized programs from calling the functions of the interaction module.

[0060] The aforementioned registration verification code refers to the code generated by the parameter verification module when the user-mode interaction module registers with the driver. This code, along with other parameters, is then passed to the system to verify the driver module. Upon receiving the verification code, the driver module verifies it; successful verification confirms a legitimate registration. This registration verification code prevents unauthorized programs from accessing the system to verify the driver module's registration information.

[0061] The aforementioned protection permissions refer to the application's access permissions to protected paths, which can be divided into read permissions and write permissions. When only write permissions are set, only processes in the process whitelist have the permission to perform write operations on that path, while all processes have the permission to perform read operations on that path. Read permissions are similar.

[0062] In the above process, the configuration module and the user-space interaction module call the parameter verification module through SSL encryption authentication to prevent unauthorized program calls. SSL authentication encryption refers to a widely used client / server encryption authentication technology, which is a publicly available authentication encryption technology.

[0063] The parameter verification module generates a checksum by using the MD5 algorithm to generate the corresponding checksum based on the parameters passed from the external program (such as process PID, process name, etc., which are encrypted with SSL authentication during transmission to prevent access by unauthorized programs).

[0064] The system calls mentioned above refer to the basic operational functions provided by the operating system kernel to user space. It is a general concept, and user-mode programs enter kernel space through system calls to access corresponding system resources.

[0065] When using the above system, the system call verification driver module, user-mode interaction module, configuration module, and parameter verification module are installed on the machine requiring tamper protection. Files, directories, and devices requiring protection are registered to the system call verification driver module through the configuration module. Related user-mode processes in the system are modified so that their process ID (PID) and process name are registered to the system call verification driver module upon startup. When a program needs to access a file, it enters the kernel via a system call. Before invoking the actual system function, the system call verification driver module checks whether the file accessed by the system call is in the protected path list. If it is, it checks whether the current process is in the process whitelist. If so, access to the corresponding file resource is allowed; otherwise, access is directly denied, thus achieving the purpose of preventing data tampering.

[0066] In a specific implementation, if a data protection system equipped with the aforementioned anti-tampering measures encounters ransomware or other malicious programs, the protection process is as follows: When ransomware or other malicious processes search for, encrypt, delete, or damage files in the computer system, they enter the kernel through system calls. First, they encounter the check of the system call verification driver module. If the system call verification driver module finds that the process PID and process name of the current process are not in the process whitelist, the system call verification driver module directly rejects the access operation. Therefore, these malicious programs cannot access the protected files, directories, and devices, and thus cannot damage, encrypt, or leak the data of the computer system.

[0067] In a specific implementation, in a data protection system equipped with the aforementioned anti-tampering measures, the protection process in case of malicious human intervention or accidental operation is as follows:

[0068] Human intervention typically involves directly executing operations like `rm -rf` from a backend server to delete or damage data on a computer system. During these operations, a system call is required to enter the kernel. Once inside the kernel, the system call verification driver module checks the process and finds that the current process's process ID (PID) and process name are not in the process whitelist. Therefore, the system call verification driver module directly rejects the access operation. Thus, even malicious or accidental human intervention cannot access protected files, directories, or devices, and therefore cannot damage, encrypt, or leak data on the computer system.

[0069] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A data protection method to prevent tampering, characterized in that, This method runs in the computer system kernel and includes the following steps: 1) Obtain the access instruction for the data, which includes the access object path and access process information; 2) Determine whether the access object path exists in the maintained protected path whitelist or a sub-path of a path in the protected path whitelist. If yes, proceed to step 3). If no, generate an allow call signal. 3) Determine whether the current access process exists in the maintained process whitelist based on the access process information. If it does, generate an allow call signal; otherwise, generate an access denial signal. The protected path whitelist is obtained through the following steps: Obtain the absolute path of the protected object and its corresponding protection permissions, and generate the corresponding interface verification code; The interface verification code is verified. If the verification is successful, a registration verification code is generated. The registration verification code is verified. If the verification is successful, the absolute path of the corresponding protected object is added to the protection path whitelist. The protection path whitelist is stored in the computer system kernel. Each path in the protection path whitelist has the corresponding protection permission. The process whitelist is obtained through the following steps: Obtain the process information that needs to be registered and generate the corresponding interface verification code; The interface verification code is verified. If the verification is successful, a registration verification code is generated. The registration verification code is verified. If the verification is successful, the corresponding process information that needs to be registered is added to the process whitelist, which is stored in the computer system kernel. The interface verification code and registration verification code are used to prevent unauthorized programs from calling the computer system.

2. The data protection method against tampering according to claim 1, characterized in that, The protected objects include files, directories, or devices.

3. The data protection method against tampering according to claim 2, characterized in that, If the protected object is a file or directory, then in the step of obtaining the whitelist of protected paths, if the registration verification code is successfully verified, the corresponding partition and disk information will be obtained.

4. The data protection method against tampering according to claim 1, characterized in that, The process information includes the process PID and process name.

5. The data protection method against tampering according to claim 1, characterized in that, The interface verification code, registration verification code, or the interface verification code is generated using SSL encryption authentication.

6. A tamper-proof data protection system, characterized in that, It includes a configuration module, a parameter validation module, a user-mode interaction module, and a system call validation driver module. The system call verification driver module is used to obtain access instructions for data. The access instructions include access object path and access process information. It determines whether the access object path exists in the maintained protected path whitelist or a sub-path of a path in the protected path whitelist. If the determination result is yes, it determines whether the current access process exists in the maintained process whitelist based on the access process information. If yes, it generates an allowed call signal; otherwise, it generates an access denied signal. The protected path whitelist and process whitelist are obtained collaboratively by the configuration module, parameter verification module, user-mode interaction module, and system call verification driver module. Specifically: The configuration module obtains the absolute path of the protected object and its corresponding protection permissions, calls the parameter verification module to generate a corresponding interface verification code, and transmits the absolute path and interface verification code to the user-mode interaction module. The user-mode interaction module calls the parameter verification module to verify the interface verification code. If the verification is successful, it calls the parameter verification module to generate a registration verification code, and transmits the absolute path and registration verification code to the system call verification driver module. The system call verification driver module verifies the registration verification code. If the verification is successful, it adds the absolute path of the corresponding protected object to the protection path whitelist. Each path in the protection path whitelist has the corresponding protection permissions. The user-mode program that needs to register calls the parameter verification module to generate the corresponding interface verification code, and simultaneously transmits its own process information and the interface verification code to the user-mode interaction module; the user-mode interaction module calls the parameter verification module to verify the interface verification code, and after successful verification, calls the parameter verification module to generate a registration verification code, and simultaneously transmits the process information and the registration verification code to the system call verification driver module; the system call verification driver module verifies the registration verification code, and after successful verification, adds the corresponding process information that needs to be registered to the process whitelist list; The system call verification driver module is built into the computer system kernel, and the interface verification code and registration verification code are used to prevent unauthorized programs from calling the computer system.

7. The tamper-proof data protection system according to claim 6, characterized in that, The protected objects include files, directories, or devices.

8. The tamper-proof data protection system according to claim 6, characterized in that, If the protected object is a file or directory, the user-mode interaction module generates a verification code, verifies it, and then obtains the corresponding partition and disk information.

9. The tamper-proof data protection system according to claim 6, characterized in that, The process information includes the process PID and process name.

10. The tamper-proof data protection system according to claim 6, characterized in that, The configuration module and the user-mode interaction module call the parameter verification module through SSL encryption authentication.

Images