A process handling method and apparatus

Abstract

This application provides a process processing method and apparatus. The method, applied to a client, includes: real-time monitoring of the loading behavior of components within a process; determining whether the component is a third-party unrelated component; if so, identifying file operations initiated by the third-party unrelated component; and setting the file object of the file operation to a state where encryption / decryption functionality is not used. Compared to existing technologies that employ the same strategy for both trusted and untrusted third-party unrelated components, this application offers greater flexibility and security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for processing processes. Background Technology

[0002] With the development of information technology, existing transparent encryption and decryption schemes, considering the ease of policy configuration and maintenance, as well as operational stability, are basically managed on a process-by-process basis. That is, once a process is running, if it is determined to be a trusted process (meaning a process that needs to apply encryption and decryption functions), the same policy applies to the behavior of all components of that process. In other words, the identification of trusted processes is basically based on the specific values ​​of the corresponding executable program (such as EXE in Windows), and then the behavior of all components of the entire process (such as DLL in Windows) is regarded as the behavior of that process, and is uniformly managed according to the policy of the corresponding executable program.

[0003] However, many functional components unrelated to these software programs, such as input methods and interface enhancement plugins (hereinafter collectively referred to as: third-party unrelated components), may be injected into other software to run. The behavior of these plugins is actually unrelated to the injected software and does not actually require application encryption or decryption. However, because these components are attached to this trusted process and executed, the behavior of these components will also be controlled by the policies of the trusted process in which they reside.

[0004] Because third-party unrelated components can be injected into trusted and untrusted processes, if these processes, which apply different strategies, exhibit the same behavior, such as reading and writing the same files, and if the component creates some encrypted files in the trusted process, then attempting to operate on these files in the untrusted process may result in the inability to parse them properly, causing the third-party unrelated component to malfunction or the injected software to crash. Summary of the Invention

[0005] In order to solve the above-mentioned technical problems, or at least partially solve the above-mentioned technical problems, this application provides a process processing method and apparatus.

[0006] In a first aspect, embodiments of this application provide a process processing method, the method being applied to a client, comprising:

[0007] Monitor the loading behavior of components in the process in real time to determine whether the component is an unrelated third-party component;

[0008] If so, then identify the file operation initiated by the unrelated third-party component;

[0009] The file object to be operated on is set to a state where encryption and decryption functions are not used.

[0010] In an optional embodiment of this application, determining whether the component is an unrelated third-party component includes:

[0011] Get the feature values ​​of the loaded component;

[0012] The feature value is matched with the feature value in the feature library. Based on whether the feature value matches the feature value in the feature library, it is determined whether the component is an irrelevant component.

[0013] In an optional embodiment of this application, identifying the file operation initiated by the third-party unrelated component includes:

[0014] Obtain the address space of the unrelated third-party component;

[0015] The file operation initiated by the third-party unrelated component is determined based on the address space.

[0016] In an optional embodiment of this application, before determining whether the component is an unrelated third-party component by monitoring the loading behavior of the real-time monitoring component, the method further includes:

[0017] Create a feature library of third-party unrelated components; the feature library of third-party unrelated components includes feature values ​​of third-party unrelated components.

[0018] In an optional embodiment of this application, the feature value includes at least the following file feature elements: file name, file attributes, copyright, version, signature, and file content.

[0019] In an optional embodiment of this application, the method further includes:

[0020] The feature library is updated based on the collected file feature elements and the file feature elements issued by the server.

[0021] In an optional embodiment of this application, it further includes:

[0022] Scan the currently running trusted processes and record the address space of each thread component;

[0023] Based on the address space, a trusted process operation file is determined, and based on the state of the file, it is determined whether it has gone through the process of determining whether it is an unrelated component thread;

[0024] If so, and it has been determined to be an unrelated component thread, then the trusted process policy will not be applied; if it has been determined to be a related component thread, then if the policy determines that encryption is required, and the operation type is to create a new file or overwrite the original file, then the call stack information of the operation will be obtained, and the address in the stack will be traced back.

[0025] If a certain address is in the address space of an unrelated component, then the component that generated the file is considered to be unrelated, and the file will not be encrypted.

[0026] Secondly, embodiments of this application provide a process processing apparatus, including:

[0027] The judgment module is used to monitor the loading behavior of components in the process in real time and determine whether the component is an unrelated third-party component.

[0028] The identification module is used to identify file operations initiated by the aforementioned unrelated third-party components;

[0029] The setting module is used to set the file object of the file operation to a state where encryption and decryption functions are not used.

[0030] Thirdly, embodiments of this application provide a process processing device, characterized in that it includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0031] Memory, used to store computer programs;

[0032] A processor, when executing a program stored in memory, implements the steps of the process processing method described in any of the above embodiments.

[0033] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the process processing method as described in any of the above embodiments.

[0034] In summary, this application provides a process processing method and apparatus. In this method, the client monitors the loading behavior of components in the process in real time and determines whether the component is a third-party unrelated component. If it is a third-party unrelated component, the file operation initiated by the third-party unrelated component is identified. The file object of the file operation is set to a state where encryption and decryption functions are not used. Therefore, in this application, third-party unrelated components are detected and processed separately for each process. Compared with the prior art, which uses the same strategy for third-party unrelated components of both trusted and untrusted processes, this method has higher flexibility and security. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A flowchart illustrating a process processing method provided in an embodiment of this application;

[0038] Figure 2 This is a schematic diagram of the scenario structure of a process processing system provided as an example of this application;

[0039] Figure 3 A structural block diagram of a process processing apparatus provided in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of the structure of a process processing device provided in an embodiment of this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0042] In related technologies, because third-party unrelated components can be injected into trusted and untrusted processes, these components may exhibit similar behaviors in processes applying different strategies, such as reading and writing the same files. If a component creates encrypted files in a trusted process, attempting to access these files in an untrusted process may result in the inability to parse the files correctly, causing the third-party unrelated component to malfunction or the injected software to crash. Based on this, this application provides a process management method and apparatus.

[0043] To facilitate understanding of the embodiments of this application, further explanations and descriptions will be provided below in conjunction with the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of this application.

[0044] Figure 1 A flowchart illustrating a process processing method provided in this application embodiment; see reference. Figure 1 As shown, the process processing method provided in this embodiment, applied to the client, includes the following steps S110-S130:

[0045] S110. The client monitors the loading behavior of components in the software process in real time and determines whether the component is an unrelated third-party component.

[0046] The aforementioned third-party unrelated components refer to components that are not related to the actual function of the software, or components that are not necessary for realizing the function of the software.

[0047] In step S110 above, determining whether the component is an unrelated third-party component includes the following steps A10-A20:

[0048] Step A10: Obtain the feature values ​​of the loaded component;

[0049] Step A20: Match the feature value with the feature value in the feature library, and determine whether the component is an irrelevant component based on whether it matches the feature value in the feature library.

[0050] The aforementioned third-party unrelated component feature library includes feature values ​​of third-party unrelated components. These feature values ​​include at least the following file feature elements: file name, file attributes, copyright, version, signature, and file content of the third-party unrelated component.

[0051] In one embodiment of this application, before step S110 above, and before determining whether the component is an unrelated third-party component by monitoring the loading behavior of the real-time monitoring component, the method further includes the following step C10:

[0052] Step C10: Create a third-party unrelated component feature library. In this embodiment, a third-party unrelated component feature library is pre-configured in the client. The feature values ​​of the unrelated components contained in this third-party unrelated component feature library can initially be manually added and set, and the feature library is subsequently updated based on the server's distribution or the collection of client data.

[0053] Therefore, in this embodiment of the application, the above method further includes the following steps:

[0054] The feature library is updated based on the collected file feature elements and the file feature elements issued by the server.

[0055] This ensures the accuracy and real-time performance of the feature values ​​contained in the feature library of third-party unrelated components.

[0056] S120. If so, then identify the file operation initiated by the third-party unrelated component.

[0057] In step S120 above, identifying file operations initiated by the third-party unrelated component includes the following steps B10-B20:

[0058] Step B10: Obtain the address space of the third-party unrelated component;

[0059] Step B20: Determine the file operation initiated by the third-party unrelated component based on the address space.

[0060] In this embodiment, the file operation initiated by the third-party unrelated component is determined through the address space of the third-party unrelated component, and the file object of the file operation is set to a state where it is not encrypted or decrypted.

[0061] S130. Set the file object of the file operation to a state where encryption and decryption functions are not used.

[0062] In one embodiment of this application, the method described above further includes the following steps D10-D40:

[0063] Step D10: Scan the currently running trusted processes and record the address space of each thread component;

[0064] Step D20: Determine the trusted process operation file based on the address space, and determine whether the file has undergone the process of determining whether it is an unrelated component thread based on the file's status;

[0065] Step D30: If it is, and it has been determined to be an unrelated component thread, then the trusted process policy will not be applied; if it has been determined to be a related component thread, then if encryption is required according to the policy, and the operation type is to create a new file or overwrite the original file, then the call stack information of the operation will be obtained, and the address in the stack will be traced back.

[0066] Step D40: If a certain space address is in the address space of an unrelated component, then the file is considered to have been generated by an unrelated component, and the file is not encrypted.

[0067] Figure 2 This is a schematic diagram of the scenario structure of a process processing system provided as an example in this application; see reference. Figure 2 As shown, in this system, the server will configure policies and send process management policies to the client. The client runs software, which may contain one or more processes.

[0068] Figure 3 A structural block diagram of a process processing apparatus provided in an embodiment of this application; see reference. Figure 3 As shown, the processing device 300 for this process includes:

[0069] The judgment module 310 is used to monitor the loading behavior of components in the process in real time and determine whether the component is an unrelated third-party component.

[0070] The identification module 320 is used to identify file operations initiated by the third-party unrelated component;

[0071] The setting module 330 is used to set the file object of the file operation to a state where encryption and decryption functions are not used.

[0072] Optionally, the aforementioned judgment module 310 is specifically used for:

[0073] Get the feature values ​​of the loaded component;

[0074] The feature value is matched with the feature value in the feature library. Based on whether the feature value matches the feature value in the feature library, it is determined whether the component is an irrelevant component.

[0075] Optionally, the aforementioned identification module 320 is specifically used for:

[0076] Obtain the address space of the unrelated third-party component;

[0077] The file operation initiated by the third-party unrelated component is determined based on the address space.

[0078] Optionally, the aforementioned device 300 further includes:

[0079] Create a module for creating a feature library of third-party unrelated components.

[0080] Optionally, the third-party unrelated component feature library includes feature values ​​of third-party unrelated components, and the feature values ​​include at least the following file feature elements: file name, file attributes, copyright, version, signature, and file content.

[0081] Optionally, the above-mentioned device further includes:

[0082] An update module (not shown in the figure) is used to update the feature library based on the collected file feature elements and the file feature elements issued by the server.

[0083] Optionally, the above-mentioned device further includes:

[0084] The scanning module (not shown in the figure) is used to scan trusted processes that are currently running and record the address space of each thread component.

[0085] Based on the address space, a trusted process operation file is determined, and based on the state of the file, it is determined whether it has gone through the process of determining whether it is an unrelated component thread;

[0086] If so, and it has been determined to be an unrelated component thread, then the trusted process policy will not be applied; if it has been determined to be a related component thread, then if the policy determines that encryption is required, and the operation type is to create a new file or overwrite the original file, then the call stack information of the operation will be obtained, and the address in the stack will be traced back.

[0087] If a certain address is in the address space of an unrelated component, then the component that generated the file is considered to be unrelated, and the file will not be encrypted.

[0088] Figure 4 This is a schematic diagram of the structure of a process processing device provided in an embodiment of this application; see reference. Figure 4 As shown, it includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114. The processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114. The memory 113 is used to store computer programs. When the processor 111 executes the program stored in the memory 113, it implements the steps of the process processing method provided in any of the aforementioned method embodiments.

[0089] For example, the client monitors the loading behavior of components in the process in real time to determine whether the component is a third-party unrelated component; if it is a third-party unrelated component, the file operation initiated by the third-party unrelated component is identified; the file object of the file operation is set to a state where encryption and decryption functions are not used. Thus, in this application, the detection and processing of third-party unrelated components are performed separately for each process. Compared with the prior art, which uses the same strategy for third-party unrelated components in both trusted and untrusted processes, this approach has higher flexibility and security.

[0090] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the process processing method provided in any of the foregoing method embodiments.

[0091] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0092] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for processing a process, characterized in that, The method is applied to the client and includes: Monitor the loading behavior of components in the process in real time to determine whether the component is an unrelated third-party component; If so, then identify the file operation initiated by the unrelated third-party component; The file object to be operated on is set to a state where encryption and decryption functions are not used; The step of determining whether the component is an unrelated third-party component includes: Get the feature values ​​of the loaded component; The feature value is matched with the feature value in the feature library. Based on whether the feature value matches the feature value in the feature library, it is determined whether the component is an irrelevant component. Setting the file object for the file operation to a state where encryption / decryption functionality is not used specifically includes the following steps: Scan the currently running trusted processes and record the address space of each thread component; Based on the address space, a trusted process operation file is determined, and based on the state of the file, it is determined whether it has gone through the process of determining whether it is an unrelated component thread; If so, and it has been determined to be an unrelated component thread, then the trusted process strategy will not be applied; if it has been determined to be a related component thread, then if encryption is required according to the strategy, and the operation type is to create a new file or overwrite the original file, then the call stack information of the operation will be obtained, and the address in the stack will be traced back. If a certain address is in the address space of an unrelated component, then the component that generated the file is considered to be unrelated, and the file will not be encrypted.

2. The method according to claim 1, characterized in that, The identification of file operations initiated by the third-party unrelated component includes: Obtain the address space of the unrelated third-party component; The file operations initiated by the third-party unrelated component are determined based on the address space.

3. The method according to claim 1, characterized in that, Before determining whether a component is an unrelated third-party component based on its loading behavior during the real-time monitoring process, the method further includes: Create a feature library of third-party unrelated components; wherein the feature library of third-party unrelated components includes feature values ​​of third-party unrelated components.

4. The method according to claim 3, characterized in that, The feature value includes at least the following file feature elements: file name, file attributes, copyright, version, signature, and file content.

5. The method according to claim 1, characterized in that, The method further includes: The feature library is updated based on file feature elements collected by the client from third-party unrelated components and file feature elements issued by the server.

6. A process processing apparatus, characterized in that, include: The judgment module is used to monitor the loading behavior of components in the process in real time and determine whether the component is an unrelated third-party component. The identification module is used to identify file operations initiated by the aforementioned unrelated third-party components; The setting module is used to set the file object of the file operation to a state where encryption and decryption functions are not used; The step of determining whether the component is an unrelated third-party component includes: Get the feature values ​​of the loaded component; The feature value is matched with the feature value in the feature library. Based on whether the feature value matches the feature value in the feature library, it is determined whether the component is an irrelevant component. The setting module is also used for: Scan the currently running trusted processes and record the address space of each thread component; Based on the address space, a trusted process operation file is determined, and based on the state of the file, it is determined whether it has gone through the process of determining whether it is an unrelated component thread; If so, and it has been determined to be an unrelated component thread, then the trusted process strategy will not be applied; if it has been determined to be a related component thread, then if encryption is required according to the strategy, and the operation type is to create a new file or overwrite the original file, then the call stack information of the operation will be obtained, and the address in the stack will be traced back. If a certain address is in the address space of an unrelated component, then the component that generated the file is considered to be unrelated, and the file will not be encrypted.

7. A process processing device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the process processing method according to any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the process processing method as described in any one of claims 1-5.

Images