A method for fast matching of file paths

Abstract

The application discloses a method for quick matching of file paths, which comprises the following steps: setting mandatory access control, marking the security attributes of users and files; creating a state machine dictionary tree by using an AC algorithm, dividing a one-dimensional array into a two-dimensional sparse matrix type array, and including multiple continuous state nodes in each state machine node dictionary, and dividing each state node into multiple block pointer arrays; when it is found that all state items in a certain block pointer array are NULL, setting the pointer corresponding to the block pointer array as NULL, and directly exiting the AC algorithm when a node with NULL state is encountered; after the AC automatic machine scans the file path, determining whether the current file is an object configuration item in the mandatory access control according to the confidentiality level of the file path. The AC algorithm is optimized, a part of data is scanned only, and the object configuration item of the mandatory access control can be accurately found, so that the purpose of being loaded into the kernel context and stably and quickly running can be achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control data security, and particularly relates to a method for quickly matching a file path. BACKGROUND

[0002] In the field of security, there is a function of mandatory access control, which requires a set of files (directories) as objects. When each process accesses a file, it must pass through an object matching program to determine whether the file (directory and file under the directory) marked with security is accessed. The object matching program is processed in series in the system call process of the current process, and the specific situation is related to the design of the operating system. For example, windows is processed in the file filtering subsystem, and linux is processed in the lsm subsystem. In order to not affect the speed of process accessing files, the matching speed should be as fast as possible. The operating system kernel provides some algorithm libraries for multi-mode data search, generally including red-black trees and hash buckets, which are used for accurate matching. However, since the mandatory access control also needs to match the subdirectories of the object directory (subfiles), the existing data search algorithm library is not applicable. SUMMARY

[0003] The present application provides a method for quickly matching a file path, comprising:

[0004] Setting mandatory access control, under which users and files are marked with fixed security attributes;

[0005] Using the AC algorithm to create a dictionary tree of state machines, dividing a one-dimensional array into a two-dimensional sparse matrix type array, and including multiple continuous state nodes in the dictionary of each level of state machine node, dividing each state node into multiple block pointer arrays, and managing the array by one of the block pointer arrays;

[0006] When it is found that all state items in a block pointer array are NULL, the pointer corresponding to the block pointer array is set to NULL to indicate that the block pointer array has no valid state array. When the AC algorithm is used for multiple matching, if a state is NULL, the AC algorithm is directly exited;

[0007] After the AC automatic machine scans the file path, it is determined whether the current file is a guest configuration item in the mandatory access control according to the confidentiality level of the file path.

[0008] The method for quickly matching a file path as described above, wherein the mandatory access control is used to manage the information classification and classes in the system to ensure that each user can only access the information marked as accessible by him, which is an access constraint mechanism.

[0009] The method for fast matching of file paths as claimed in claim 1, wherein, under the mandatory access control, the user or other subject and the file or other object are marked with fixed security attributes, and the system detects the security attributes to determine whether the user has the right to access the file when each access occurs.

[0010] The method for fast matching of file paths as claimed in claim 1, wherein, the object of the mandatory access control is used as a pattern item to construct a finite state machine, and the full path of the current file accessed by the process is scanned as text.

[0011] The method for fast matching of file paths as claimed in claim 1, wherein, by optimizing the AC algorithm, when the pattern item of the state machine is scanned, a user-defined match processing function is called, and the secret level of the object of the mandatory access control corresponding to the pattern item is taken out in the match processing function.

[0012] The method for fast matching of file paths as claimed in claim 1, wherein, if the next pattern item is found in the continuous scanning, the user-defined match processing function is continuously called, the secret level of the object of the mandatory access control corresponding to the pattern item is taken out in the match processing function, and the secret level of the object of the last time is overwritten.

[0013] The method for fast matching of file paths as claimed in claim 1, wherein, if the end of the state is found in the continuous scanning of the next state, the AC algorithm is exited, and the deep and accurate scanning is completed.

[0014] The application further provides a computer readable storage medium, wherein the computer readable storage medium contains one or more program instructions, and the one or more program instructions are used to execute the method for fast matching of file paths as claimed in any one of the above claims by a processor.

[0015] The application has the following beneficial effects: the AC algorithm is optimized, only a part of data is scanned, the object configuration item of the mandatory access control is accurately found, and the purpose of being loaded into the kernel context to stably and quickly run is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0017] Figure 1 is a flow chart of the method for fast matching of file paths provided by the embodiment of the present application;

[0018] Figure 2 is a schematic diagram of a process of transforming a one-dimensional 256-length array into a two-dimensional sparse matrix;

[0019] Figure 3 is a schematic diagram of block pointer array management;

[0020] Figure 4 is a schematic diagram of AC state machine scanning a file path name. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0022] Embodiment one

[0023] As shown in the figure, the embodiment one of the present application provides a method for fast matching of file paths, comprising: Figure 1

[0024] Step 110, setting a mandatory access control, under which a user and a file are marked with fixed security attributes;

[0025] The mandatory access control is used to manage the classification of information in a system to ensure that each user can only access the information marked as accessible by him, which is an access constraint mechanism. That is, under the mandatory access control, a user (or other subject) and a file (or other object) are marked with fixed security attributes (such as security level, access permission, etc.), and the system detects the security attributes to determine whether a user has the right to access the file at each access.

[0026] Step 120, using an AC algorithm to create a dictionary tree of a state machine, dividing a one-dimensional array into a two-dimensional sparse matrix type array, including multiple consecutive state nodes in a dictionary of each level of state machine node, dividing each state node into multiple block pointer arrays, and managing the arrays by one of the block pointer arrays;

[0027] The multi-mode Aho-Corasick automaton (AC automaton) matching algorithm realizes multiple pattern matching by constructing a finite state automaton in one scan of a text, which is more efficient. The object of the mandatory access control is used as a pattern item to construct a finite state machine, and the full path of the current file accessed by the process is the text to be scanned. After one scan in the AC automaton, it can be found whether the current file is an object file in the mandatory access control or a sub-file (sub-directory) in the object directory.​

[0028] Since the AC automaton algorithm needs to occupy a large amount of storage space for the construction of the dictionary tree, each state machine has a 256-length dictionary tree, which requires a large block of memory to be applied. With the increase in the number of state machines, the number of continuous large memory blocks to be applied also increases. Since the matching component is in the driver, the number of continuous large memory blocks in Linux is relatively small, and there may be a failure to apply. The mandatory access control module is limited by the total memory of the driver, which seriously affects the number of patterns. Moreover, the AC automaton can scan the scanned text once and match the pattern item from the beginning multiple times, taking the pattern item as a substring of the scanned text. For file path matching, multiple times of matching the pattern item from the beginning will cause errors. For example, the pattern item is / r / a / l / , the scanned text is / z / x / r / a / l / , and when the scan reaches / z and / z / x, the AC algorithm finds that the next state is NULL, and then returns to the start node of the state machine to start again. When / z / x / r / a / l / is found, the pattern item is successfully matched. The file path / z / x / r / a / l / is processed as / r / a / l / , which does not meet the requirements of file path matching.

[0029] Therefore, in order to solve the problem of excessive memory occupation, when creating the dictionary tree of the AC algorithm, the original one-dimensional 256-length array is changed to a two-dimensional sparse matrix type array. The original AC algorithm allocates a 256-length dictionary tree for each state, and in use, it is found that most of the state items on the tree are NULL. The optimization scheme is to divide the 256 array into 16 16-length blocks. A 16-length block pointer array is used for management. When it is found that all state items in a block are NULL, the pointer corresponding to the block is NULL. This is used to indicate that the block data has no valid state array. See the transformation process in Figure 1 This transformation has two benefits. First, it reduces the use of large memory, greatly reduces the failure to apply for memory, and at the same time increases the stability of the system. Second, by using a sparse matrix, the memory usage of the state machine node dictionary tree is reduced as a whole. In actual tests, the memory usage is effectively reduced by more than 65%.

[0030] Figure 2 The process of transforming a one-dimensional 256-length array into a two-dimensional sparse matrix is shown in the figure. Each level of the state machine node dictionary has 256 continuous state nodes. As can be seen in the figure, a state dictionary has a large number of invalid empty nodes, white squares represent invalid empty nodes, which have actual memory, and black squares represent valid state nodes. Figure 3The block pointer array management diagram divides 256 blocks into 16 groups, each group having 16 blocks, and if the current group has no valid state node, no memory is applied to the group, and if a management group is added, the original 256 block memory becomes a management group and a 16 block memory.

[0031] Step 130: When it is found that all state items in a block pointer array are NULL, a pointer corresponding to the block pointer array is set to NULL to indicate that the block pointer array has no valid state array.

[0032] Step 140: When the AC algorithm is used for multiple matches, if a node with a NULL state is encountered, the AC algorithm is directly exited.

[0033] Step 150: After the AC automatic machine scans a file path, whether the current file is a subject configuration item in the mandatory access control is determined according to the confidentiality level of the file path.

[0034] Figure 4 To cooperate with the above example, a process diagram for depth-precise matching of the confidentiality level of a subject configuration is shown in the AC state machine scanning file path name diagram. In the AC automatic machine, there is a mode / r / a / 1 / , and the subject file path to be scanned is " / r / a / 1 / x.txt", and through the optimized AC algorithm, / r / a / 1 / is scanned as the mode item of the state machine, and a user-defined match processing function is called, and in the match processing function, the subject confidentiality level and other specific information of the mandatory access control corresponding to the mode item can be obtained. In this way, the subject confidentiality level and other specific information of the mandatory access control are found through one scan. In another example, in the AC automatic machine, there is a mode / r / a / and another mode / r / a / 1 / , which correspond to different subject confidentiality levels of the mandatory access control, and the subject file path to be scanned is " / r / a / 1 / x.txt", and through the optimized AC algorithm, / r / a / is scanned, a user-defined match processing function is called, and the subject confidentiality level of the mandatory access control of the mode / r / a / is obtained as the subject confidentiality level of " / r / a / 1 / x.txt". Since the scanning can continue, when / r / a / 1 / is scanned, the custom match processing function is called, the subject confidentiality level of the mandatory access control of the mode / r / a / 1 / is obtained, and the subject confidentiality level of " / r / a / 1 / x.txt" is overwritten. When the next state is scanned, it is found that the state is ended, and the AC algorithm is exited, so the depth-precise matching is completed.

[0035] Corresponding to the above embodiment, the embodiment of the application provides a device for fast matching of a file path, comprising at least one memory and at least one processor.

[0036] The memory is configured to store one or more program instructions.

[0037] The processor is configured to execute the one or more program instructions to perform a method for fast matching of file paths.

[0038] Corresponding to the above-mentioned embodiments, the embodiments of the present application provide a computer readable storage medium, the computer readable storage medium comprising one or more program instructions, the one or more program instructions being used to cause a processor to perform a method for fast matching of file paths.

[0039] The embodiments disclosed in the present application provide a computer readable storage medium, the computer readable storage medium storing computer program instructions, when the computer program instructions are executed on a computer, the computer program instructions causing the computer to perform the above-mentioned method for fast matching of file paths.

[0040] In the embodiments of the present application, the processor can be an integrated circuit chip having a processing capability of signals. The processor can be a general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0041] The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can be any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware coding processor for execution, or can be executed by a combination of hardware and software modules in the coding processor. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The processor reads the information in the storage medium and combines the hardware to complete the steps of the above-mentioned method.

[0042] The storage medium can be a memory, for example, can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0043] The non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory.

[0044] The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous Dynamic RAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM).

[0045] The storage media described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memory.

[0046] Those skilled in the art should be aware that the functions described in the embodiments of the present application can be implemented in combination of hardware and software in one or more of the above examples. When the software is applied, the corresponding functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on the computer readable medium. The computer readable medium includes a computer storage medium and a communication medium, wherein the communication medium includes any medium that facilitates the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0047] The above detailed description of the specific embodiments of the present application is further intended to illustrate the purposes, technical solutions, and beneficial effects of the present application. It should be understood that the above detailed description is only a specific embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. A method for fast matching of file paths, characterized in that, The application relates to a computer readable storage medium and a method for fast matching of a file path. The application comprises the following steps: Setting mandatory access control under which users and files are marked with fixed security attributes; Using an AC algorithm to create a dictionary tree of a state machine, dividing a one-dimensional array into a two-dimensional sparse matrix type array, and including multiple continuous state nodes in a dictionary of each level state machine node, and dividing each state node into multiple block pointer arrays, and performing array management by one of the block pointer arrays; When it is found that all state items in a block pointer array are NULL, a pointer corresponding to the block pointer array is set to NULL to indicate that the block pointer array has no valid state array; when the AC algorithm is used for multiple times of matching, if a state is NULL, the AC algorithm is directly exited; 2. The method for fast matching of file paths according to claim 1, wherein, After the AC automatic machine scans a file path, whether the current file is a mandatory access control object configuration item is determined according to a confidential level of the file path.

3. The method for fast matching of file paths according to claim 2, wherein, Mandatory access control is used for managing information in a system in a classified manner to ensure that each user can only access information marked as accessible by the user.

4. The method for fast matching of file paths according to claim 3, wherein, Under mandatory access control, users or other subjects and files or other objects are marked with fixed security attributes, and the system detects the security attributes to determine whether a user has the right to access a file each time access occurs.

5. The method for fast matching of file paths according to claim 1, wherein, The object of mandatory access control is used as a pattern item to construct a finite state machine, and a full path of a current file accessed by a process is scanned as text.

6. The method for fast matching of file paths according to claim 5, wherein, When the AC algorithm is optimized, a user-defined match processing function is called when a pattern item of the state machine is scanned, and a confidential level of the mandatory access control object corresponding to the pattern item is taken out in the match processing function.

7. The method for fast matching of file paths according to claim 6, wherein, If the next pattern item is found in the subsequent scanning, the user-defined match processing function is continuously called, the confidential level of the mandatory access control object corresponding to the pattern item is taken out in the match processing function, and the previous confidential level of the mandatory access control object is overwritten.

8. A computer-readable storage medium, characterized in that, If the end of the state is found in the subsequent scanning, the AC algorithm is exited, and the deep and accurate scanning is completed. The computer readable storage medium comprises one or more program instructions for executing the method for fast matching of a file path according to any one of claims 1-7 by a processor.

Images