Target file redirection method and device, and computer equipment

Abstract

The present application discloses a target file redirection method and device, and a computer device. The method comprises: obtaining a target file to be opened from a first interface; when the target file is in an encrypted state, using a second interface preset in the system kernel to obtain an open file obtained by decrypting the target file; when a closing instruction is received at a third interface and the target file is a redirected file, using a fourth interface preset in the system kernel to close the open file, the first interface is a file opening file_open function interface of the system kernel Linux security module LSM framework, the second interface is a file opening filp_open function interface of the system kernel application programming interface api interface, the third interface is a file security resource release file_free_security function interface of the system kernel LSM framework, and the fourth interface is a file closing filp_close function interface of the system kernel api interface.

Description

Technical Field

[0001] The present application relates to a field, and in particular, to a target file redirection method and device, and a computer device. Background Art

[0002] In data security systems, when processing users' operations to open encrypted files, in order not to affect the user experience, it is usually opened by redirection, that is, the technical details of the decryption operation are hidden, so that the user can get the same experience as when opening a plaintext file. The following methods are usually used: kernel layer system call hook technology, which implements redirection and decryption operations by hooking the sys_open system call function of the kernel layer of the system. However, the above method will modify the system call table, which will lead to a decrease in the stability of the operation of related applications or operating systems. At the same time, some systems have a system call table write protection mechanism, which limits the implementation of this hook. In addition, the application layer hook technology implements redirection and decryption operations by hooking the application programming interface open function provided by the operating system. The need to insert code into the host program will lead to a decrease in the stability of the operation of related applications, as well as a complex programming implementation process and the problem of redirection file path exposure. Summary of the invention

[0003] The embodiments of the present application provide a method and apparatus for redirecting a target file, and a computer device, so as to at least solve the technical problem that file redirection is prone to failure due to a write protection mechanism for a system call table.

[0004] According to one aspect of an embodiment of the present application, a target file redirection method is provided, comprising: obtaining a target file to be opened from a first interface; when the target file is in an encrypted state, using a second interface preset in a system kernel to obtain an open file obtained after decrypting the target file; when a closing instruction is received at a third interface and the target file is a redirected file, using a fourth interface preset in the system kernel to close the open file, wherein the first interface is a file opening file_open function interface of a system kernel Linux security module LSM framework, the second interface is a file opening filp_open function interface of a system kernel application programming interface api interface, the third interface is a file security resource releasing file_free_security function interface of a system kernel LSM framework, and the fourth interface is a file closing filp_close function interface of a system kernel api interface.

[0005] Optionally, a second interface preset in the system kernel is used to obtain an open file obtained after decrypting the target file, including: obtaining file parameters of the target file from the first interface, and obtaining the storage path of the target file from a data member of the file parameters of the target file; determining whether the target file is in an encrypted state according to the storage path, and if the target file is not in an encrypted state, executing an opening program for the target file by the system kernel; if the target file is in an encrypted state, decrypting the target file to a specified directory to obtain a plaintext file, and using the second interface to open the plaintext file to obtain an open file.

[0006] Optionally, a second interface is used to open a plaintext file to obtain an open file, including: archiving and saving multiple data members in the file parameters of the target file obtained from the first interface to obtain archive values ​​corresponding to the multiple data members; opening the plaintext file, assigning multiple data members in the file object of the plaintext file to data members with the same name as the file parameters of the target file to obtain an open file.

[0007] Optionally, the method also includes: obtaining file parameters when the target file is closed from a third interface, and obtaining a storage path of the target file from the file parameters when the target file is closed; determining whether the target file is a redirected file based on the storage path; if the target file is not a redirected file, the system kernel executes a closing program for the target file.

[0008] Optionally, after closing the open file using the fourth interface preset in the system kernel, the method further includes: restoring current values ​​of multiple data members in the file parameters of the target file to archived values, and continuing to execute the closing operation of the target file by the system kernel.

[0009] According to another aspect of an embodiment of the present application, a target file redirection device is also provided, including: an acquisition module, used to acquire a target file to be opened from a first interface; an opening module, used to, when the target file is in an encrypted state, use a second interface preset in the system kernel to acquire an open file obtained after decrypting the target file; a closing module, used to, when a closing instruction is received on a third interface and the target file is a redirected file, use a fourth interface preset in the system kernel to close the open file, wherein the first interface is a file opening file_open function interface of a system kernel Linux security module LSM framework, the second interface is a file opening filp_open function interface of a system kernel application programming interface api interface, the third interface is a file security resource releasing file_free_security function interface of a system kernel LSM framework, and the fourth interface is a file closing filp_close function interface of a system kernel api interface.

[0010] According to another aspect of the embodiment of the present application, a computer device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned target file redirection method.

[0011] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned target file redirection method when executed by a processor.

[0012] In an embodiment of the present application, a method of presetting a function interface in the system kernel and modifying kernel file object data members is adopted, and the redirection operation of the target file is completed through the operation of multiple function interfaces, thereby achieving the purpose of avoiding modification of the system call table, thereby achieving the technical effect of improving the stability of system operation, and further solving the technical problem of easy failure of file redirection caused by adding a write protection mechanism to the system call table. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0014] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a target file redirection method according to an embodiment of the present application;

[0015] Figure 2 is a flow chart of a target file redirection method according to an embodiment of the present application;

[0016] Figure 3 It is a structural diagram of a target file redirection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] In the related art, since the file redirection is realized by hooking, the system call table needs to be modified. Therefore, there is a problem that the system operation stability is reduced during the file redirection process. In order to solve this problem, a relevant solution is provided in the embodiment of the present application, so that the above problem can be solved), which is described in detail below.

[0020] According to an embodiment of the present application, a method embodiment of a target file redirection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0021] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a target file redirection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0022] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0023] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the target file redirection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the target file redirection method described above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0024] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0025] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0026] In the above operating environment, the present application embodiment provides a target file redirection method, such as Figure 2 As shown, the method comprises the following steps:

[0027] Step S202, obtaining a target file to be opened from the first interface;

[0028] Step S204, when the target file is in an encrypted state, using a second interface preset in the system kernel to obtain an open file obtained by decrypting the target file;

[0029] Step S206, when the third interface receives a close instruction and the target file is a redirected file, the fourth interface preset in the system kernel is used to close the open file, wherein the first interface is the file open file_open function interface of the system kernel Linux security module LSM framework, the second interface is the file open filp_open function interface of the system kernel application programming interface api interface, the third interface is the file security resource release file_free_security function interface of the system kernel LSM framework, and the fourth interface is the file close filp_close function interface of the system kernel api interface.

[0030] Through the above steps, it is possible to achieve the method of presetting a function interface in the system kernel and modifying the kernel file object data members, and complete the redirection operation of the target file through the operation of two function interfaces, thereby achieving the purpose of avoiding modifying the system call table, thereby achieving the technical effect of improving the stability of system operation, and further solving the technical problem of easy failure of file redirection caused by adding a write protection mechanism to the system call table.

[0031] In step S204 and step S206, the target file is the file to be opened, and the open file is the file obtained after decrypting the target file. It can be understood that the storage location of the open file is different from the storage location of the target file to be opened.

[0032] It should be noted that the first interface includes: the file_open function interface of the system kernel LSM framework (a function interface for monitoring the opening of file objects and authorizing the opening), the second interface includes: the filp_open function interface of the system kernel api interface (a function interface for opening a file and returning a file object), the third interface is the file_free_security function interface of the system kernel LSM framework (a function for releasing file security-related resources), and the fourth interface is the filp_close function interface of the system kernel api interface (a function interface for releasing resources and closing services).

[0033] It should be further explained that the first interface, the second interface, the third interface and the fourth interface can all be implemented through interfaces provided by the kernel, such as interfaces and apis (Application Programming Interfaces) provided by the LSM (Linux Secrity Module) framework.

[0034] In some embodiments of the present application, a second interface preset in the system kernel is used to obtain an open file obtained after decrypting the target file, including: obtaining the file parameters of the target file from the first interface, and obtaining the storage path of the target file from the data member of the file parameters of the target file; determining whether the target file is in an encrypted state according to the storage path, and if the target file is not in an encrypted state, the system kernel executes an opening program for the target file; if the target file is in an encrypted state, decrypting the target file to a specified directory to obtain a plaintext file, and using the second interface to open the plaintext file to obtain an open file.

[0035] Taking the first interface as the file_open function interface of the system kernel LSM framework as an example, the file parameters of the target file passed in by the system are obtained from the file_open function interface (struct file parameters, a data structure used to represent relevant information of the file in the operating system), such as: file name, file size, file permissions, etc. In an optional manner, the struct file parameters can be recorded as origin_file (original file), and the storage path of the target file can be obtained through the data member f_path (used to represent the path of the file) in origin_file. In an optional manner, it is possible to determine whether the target file is in an encrypted state based on the storage path of the target file, for example: determining whether the target file is in an encrypted folder or an encrypted storage device. Another optional manner is to determine the encryption state by parsing the file content header identifier.

[0036] If the target file is not in an encrypted state, it will return directly and hand over the execution action to the system kernel, which will execute the opening program normally. If the target file is in an encrypted state, it will first be decrypted to the specified directory, and then the second interface filp_open provided by the system kernel will be used to open the decrypted plaintext file. The return value of filp_open after successful execution is the struct file structure instance corresponding to the plaintext file, referred to as redirect_file. It can be understood that redirect_file is an open file.

[0037] In some embodiments of the present application, a second interface is used to open a plaintext file to obtain an open file, including: archiving and saving multiple data members in the file parameters of the target file obtained from the first interface to obtain archive values ​​corresponding to the multiple data members; opening the plaintext file, assigning multiple data members in the file object of the plaintext file to data members with the same name as the file parameters of the target file to obtain an open file.

[0038] Specifically, the data members f_path, f_inode (a data structure in the Linux kernel, used to represent metadata information of files or directories, including file permissions, owners, size, creation time, modification time, etc.) and f_mapping (a data structure used to store the mapping space of operating files) in origin_file are archived and saved, and then the data members f_path, f_inode and f_mapping of redirect_file are assigned to the corresponding data members of the same name in origin_file. Finally, the custom file_open function returns 0 (the first return value) and returns the execution of the file opening process to the system kernel.

[0039] After completing the target file opening process, the opened target file also needs to be closed. The specific process is as follows: obtain the file parameters when the target file is closed from the third interface, and obtain the storage path of the target file from the file parameters when the target file is closed; determine whether the target file is a redirected file based on the storage path; if the target file is not a redirected file, the system kernel executes the target file closing program.

[0040] It should be noted that, when the target file is not a redirected file, there is no need to decrypt the target file, and there is no open file. The opened target file can be directly closed.

[0041] After the target file is closed using the fourth interface preset in the system kernel, the current values ​​of multiple data members in the file parameters of the target file are restored to archived values, and the system kernel continues to execute the closing operation of the target file.

[0042] When the third interface is the file_free_security function, the specific closing process is as follows: In the custom file_free_security function, the full path of the target file is obtained through the target file parameter passed in by the system, and it is determined whether this file is a redirected file. If not, it returns directly and returns the execution to the system kernel. If it is, the fourth interface filp_close provided by the kernel is used to close the previously archived redirect_file, and the data members f_path, f_inode, and f_mapping in the passed-in struct file parameter are restored to the archived values. Finally, the custom file_free_security function returns, and the execution of the file closing process is returned to the system kernel.

[0043] The target file redirection method provided by the present application does not need to break through the write protection mechanism in the system kernel, and achieves a redirection effect similar to that of opening a file by hooking sys_open in the system call table.

[0044] The present application embodiment provides a target file redirection device, such as Figure 3 As shown, including:

[0045] The acquisition module 30 is used to acquire the target file to be opened from the first interface;

[0046] The opening module 32 is used to obtain the open file obtained by decrypting the target file using the second interface preset in the system kernel when the target file is in an encrypted state;

[0047] The closing module 34 is used to close the open file using the fourth interface preset in the system kernel when the third interface receives a closing instruction and the target file is a redirected file, wherein the first interface is the file opening file_open function interface of the system kernel Linux security module LSM framework, the second interface is the file opening filp_open function interface of the system kernel application programming interface api interface, the third interface is the file security resource release file_free_security function interface of the system kernel LSM framework, and the fourth interface is the file closing filp_close function interface of the system kernel api interface.

[0048] The opening module 32 includes: an opening submodule, which is used to use the second interface preset in the system kernel to obtain the open file obtained after decrypting the target file, including: obtaining the file parameters of the target file from the first interface, and obtaining the storage path of the target file from the data member of the file parameters of the target file; determining whether the target file is in an encrypted state according to the storage path, and when the target file is not in an encrypted state, the system kernel executes the opening program of the target file; when the target file is in an encrypted state, decrypting the target file to a specified directory to obtain a plaintext file, and using the second interface to open the plaintext file to obtain an open file.

[0049] The opening submodule and the opening unit are used to open a plain text file using a second interface to obtain an open file, including: archiving and saving multiple data members in the file parameters of the target file obtained from the first interface to obtain archive values ​​corresponding to the multiple data members; opening the plain text file, assigning multiple data members in the file object of the plain text file to data members with the same name as the file parameters of the target file to obtain an open file.

[0050] The closing module 34 includes: a closing submodule, which is used to obtain the file parameters when the target file is closed from the third interface, and obtain the storage path of the target file from the file parameters when the target file is closed; determine whether the target file is a redirected file according to the storage path; if the target file is not a redirected file, the system kernel executes the closing program of the target file.

[0051] The closing submodule includes: a closing unit, which is used to close the open file after using the fourth interface preset in the system kernel. The method also includes: restoring the current values ​​of multiple data members in the file parameters of the target file to archive values, and the system kernel continues to execute the closing operation of the target file.

[0052] According to another aspect of the embodiment of the present application, a computer device is also provided, including: a memory and a processor, wherein the memory is used to store program instructions; and the processor is connected to the memory and is used to execute the above-mentioned target file redirection method.

[0053] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned target file redirection method when executed by a processor.

[0054] It should be noted that the various modules in the above-mentioned target file redirection device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0055] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0056] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0057] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0058] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0059] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0060] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0061] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A target file redirection method, characterized in that: include: Obtaining a target file to be opened from the first interface; When the target file is in an encrypted state, using a second interface preset in the system kernel to obtain an open file obtained by decrypting the target file; In the case where the third interface receives a close instruction and the target file is a redirected file, the open file is closed using a fourth interface preset in the system kernel, wherein the first interface is a file open file_open function interface of the system kernel Linux security module LSM framework, the second interface is a file open filp_open function interface of the system kernel application programming interface api interface, the third interface is a file security resource release file_free_security function interface of the system kernel LSM framework, and the fourth interface is a file close filp_close function interface of the system kernel api interface; The method uses a second interface preset in the system kernel to obtain an open file obtained by decrypting the target file, including: Acquire the file parameters of the target file from the first interface, and acquire the storage path of the target file from the data member of the file parameters of the target file; Determine whether the target file is in an encrypted state according to the storage path, and if the target file is not in an encrypted state, execute an opening program of the target file by the system kernel; When the target file is in an encrypted state, decrypting the target file to a specified directory to obtain a plaintext file, and using the second interface to open the plaintext file to obtain the open file; Using the second interface to open the plaintext file to obtain the open file includes: Archiving and saving a plurality of data members in the file parameters of the target file obtained from the first interface to obtain archive values ​​corresponding to the plurality of data members; The plain text file is opened, and multiple data members in the file object of the plain text file are assigned to data members with the same names as the file parameters of the target file to obtain the open file.

2. The method according to claim 1, characterized in that The method further comprises: Acquire the file parameters when the target file is closed from the third interface, and acquire the storage path of the target file from the file parameters when the target file is closed; Determine whether the target file is the redirection file according to the storage path; In the case that the target file is not the redirection file, the system kernel executes a closing procedure of the target file.

3. The method according to claim 1, characterized in that: After closing the open file using a fourth interface preset in the system kernel, the method further includes: The current values ​​of the plurality of data members in the file parameters of the target file are restored to the archived values, and the system kernel continues to execute the closing operation of the target file.

4. A target file redirection device, characterized in that: include: An acquisition module, used for acquiring a target file to be opened from the first interface; An opening module, used for obtaining an open file obtained by decrypting the target file using a second interface preset in the system kernel when the target file is in an encrypted state; A closing module is used for, when the third interface receives a closing instruction and the target file is a redirected file, using a fourth interface preset in the system kernel to close the open file, wherein the first interface is a file opening file_open function interface of the system kernel Linux security module LSM framework, the second interface is a file opening filp_open function interface of the system kernel application programming interface api interface, the third interface is a file security resource release file_free_security function interface of the system kernel LSM framework, and the fourth interface is a file closing filp_close function interface of the system kernel api interface; The opening module includes: an opening submodule, which is used to obtain the file parameters of the target file from the first interface, and obtain the storage path of the target file from the data member of the file parameters of the target file; determine whether the target file is in an encrypted state according to the storage path, and if the target file is not in an encrypted state, the system kernel executes the opening program of the target file; if the target file is in an encrypted state, decrypt the target file to a specified directory to obtain a plaintext file, and use the second interface to open the plaintext file to obtain the opened file; The opening submodule includes: an opening unit, which is used to archive and save multiple data members in the file parameters of the target file obtained from the first interface to obtain archive values ​​corresponding to the multiple data members; open the plaintext file, assign multiple data members in the file object of the plaintext file to data members with the same name as the file parameters of the target file, and obtain the open file.

5. A computer device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the target file redirection method described in any one of claims 1 to 3 is executed when the program is run.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to claim 1 are implemented.

Images