File processing method and electronic device

Abstract

The present application relates to a file processing method and electronic device. The method includes: using a custom function implemented on the Endpoint Security framework to obtain the path name of the process used to open the current file and the path name of the current file; when it is determined that the process and the current file meet the preset conditions and the current file is an encrypted file, calling the es_respond_flags_result function provided by the Endpoint Security framework to set the process to not have the permission to open the current file; sending the path name of the process and the path name of the current file to the redirection service process; the custom function returns, and returns the processing operation of the current file to the process, triggering the process to generate the first prompt information of the failure to open the current file; decrypting the current file based on the redirection service process, and calling the process to continue to open the decrypted file. The present application solves the problem that there are limitations on the operating system's scheme for opening encrypted files, and it will cause the stability of the related application or operating system to decrease.

Description

Technical Field

[0001] The present application relates to the field of file processing, and in particular to a file processing method and electronic device. Background Art

[0002] In data security systems, when opening encrypted files, in order not to affect the user experience, redirection is usually used to open them, that is, to hide the technical details of the decryption operation so that users can get the same experience as when opening plaintext files. The following methods are usually used:

[0003] The kernel layer system call hook technology implements redirection and encryption and decryption operations by hooking the system kernel layer's sys_open, sys_close and other system call functions. Modifying the system call table will cause the stability of related applications or operating systems to decrease. Some systems have a system call table write protection mechanism, which limits the implementation of this hook.

[0004] Application layer hook technology implements redirection and encryption and decryption operations by hooking the application programming interface open, close and other functions provided by the operating system. The code needs to be inserted into the host program, which will lead to a decrease in the stability of the operation of the related application, and the programming implementation process is complicated. Different central processing unit (CPU) architectures need to be adapted separately.

[0005] In view of the problem that in a data security system, the operating system has limitations on the scheme for opening encrypted files, which may cause the stability of related applications or the operating system to decrease, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a file processing method and electronic device, which at least solve the problem that in a data security system, the operating system has limitations on the scheme for opening encrypted files, and this may lead to a decrease in the stability of the operation of related applications or the operating system.

[0007] According to one aspect of an embodiment of the present application, a file processing method is provided, including: using a custom function implemented on an Endpoint Security framework to obtain the path name of a process used to open a current file and the path name of the current file; when it is determined that the process and the current file meet preset conditions and the current file is an encrypted file, calling the es_respond_flags_result function provided by the Endpoint Security framework to set the process to not have permission to open the current file; sending the path name of the process and the path name of the current file to a redirection service process; the custom function returns, and returns the processing operation of the current file to the process, triggering the process to generate a first prompt message of failure to open the current file; decrypting the current file based on the redirection service process, and calling the process to continue opening the decrypted file.

[0008] Optionally, before decrypting the current file based on the redirection service process, the method further includes: determining the type of the first prompt information; using the redirection service process to call the system's CGEventPost function and CFRelease function according to the type of the first prompt information to simulate sending the keyboard enter key or the keyboard escape key to eliminate the first prompt information in real time.

[0009] Optionally, opening the decrypted file includes: using the path name of the process and the redirected file path name after the current file is decrypted as execution parameters of the system function; calling the system function to execute an open file instruction to open the decrypted file.

[0010] Optionally, determining whether the process and the current file meet preset conditions includes: if the text processing software process set includes the process, determining that the process meets the preset conditions; if the file extension name set includes the current file, determining that the current file meets the preset conditions.

[0011] Optionally, determining whether the current file is an encrypted file includes: obtaining the number of bytes of the current file, and determining whether the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file; if the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file, parsing the file header of the current file; if the bytes obtained by parsing the file header of the current file include target bytes, determining that the current file is an encrypted file; if the bytes obtained by parsing the file header of the current file do not include the target bytes, determining that the current file is not an encrypted file.

[0012] Optionally, the method further includes: generating a second prompt message when there is no permission to decrypt the current file, wherein the second prompt message is used to prompt the user that the user does not have the permission to view the current file.

[0013] Optionally, the method further includes: when it is determined that the current file is not an encrypted file, setting the process to have permission to open the current file, and allowing the process to continue to execute the operation of opening the current file.

[0014] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including: a processor, and a memory for storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the above method.

[0015] According to another aspect of an embodiment of the present application, a non-transitory machine-readable medium storing computer instructions is also provided, where the computer instructions are used to enable a computer to execute the above method.

[0016] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which is used to enable the computer to execute the above method when the computer program is executed by a processor of the computer.

[0017] Beneficial effects of the embodiments of the present application:

[0018] In an embodiment of the present application, a file processing method is provided, which uses a custom function implemented on the Endpoint Security framework to obtain the path name of the process used to open the current file and the path name of the current file; when it is determined that the process and the current file meet the preset conditions and the current file is an encrypted file, the es_respond_flags_result function provided by the EndpointSecurity framework is called to set the process to not have the permission to open the current file; the path name of the process and the path name of the current file are sent to the redirection service process; the custom function returns, and the processing operation of the current file is returned to the process, triggering the process to generate a first prompt message that the opening of the current file failed; the current file is decrypted based on the redirection service process, and the process is called to continue to open the decrypted file. By using the public programming framework and related interfaces provided by the operating system at the application layer to implement the file redirection operation, the purpose of opening the encrypted file can be achieved by simple programming, thereby achieving the technical effect of improving the stability of the operation of related applications and operating systems in the process of opening the encrypted file in the data security system.

[0019] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flowchart of a method for processing a file according to an embodiment of the present application;

[0022] Figure 2 is a structural block diagram of a file processing device according to an embodiment of the present application;

[0023] Figure 3 Schematic diagram of the structure of the electronic device of this embodiment. DETAILED DESCRIPTION

[0024] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0025] In the related art, there are limitations on the scheme of opening encrypted files by the operating system, and this may lead to the problem of reduced stability of the operation of related applications or operating systems. In order to solve this problem, a related solution is provided in the embodiment of the present application, which is described in detail below.

[0026] Figure 1 is a flowchart of a method for processing a file according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0027] Step S102, using a custom function implemented on the Endpoint Security framework to obtain the path name of the process used to open the current file and the path name of the current file.

[0028] The Endpoint Security Framework for macOS allows developers to monitor system events to detect malicious activity, including events such as file creation, file opening, file renaming, directory traversal, process creation, session login, etc.

[0029] The Endpoint Security framework is very easy to use. First, call es_new_client() to create an ES client and define the event processing function of the ES client. Second, call es_subscribe() to subscribe to the event type of interest. Then, when the subscribed event occurs, the system will call the defined event processing function, and the event processing function can be used to handle various events.

[0030] In this step, first, write a system extension component based on the Endpoint Security framework, register the ES_EVENT_TYPE_AUTH_OPEN system event to the system, and implement a custom open function, defined as static void handle_open_worker(es_client_t *client, const es_message_t *msg), which is the custom function mentioned in the above step S102.

[0031] ES_EVENT_TYPE_AUTH_OPEN is a custom system event type used to identify that a file open operation requires authentication or authorization. When an application attempts to open a file, the system triggers this event type and allows the listener registered for the event to decide whether to allow the operation to proceed.

[0032] The main purpose of registering the ES_EVENT_TYPE_AUTH_OPEN system event with the system is to monitor and control the file opening operation. This mechanism is usually used in the Endpoint Security framework to enhance system security and prevent unauthorized file access.

[0033] Next, in the handle_open_worker function, the path name of the process that opens the current file is obtained through the parameter msg->process->executable->path.data, and the path name of the current file is obtained through msg->event.close.target->path.data.

[0034] Step S104, when it is determined that the process and the current file meet the preset conditions and the current file is an encrypted file, the es_respond_flags_result function provided by the Endpoint Security framework is called to set the process to not have the permission to open the current file.

[0035] According to an optional embodiment of the present application, determining whether a process and a current file meet preset conditions is achieved by the following method: if a text processing software process set includes a process, determining that the process meets the preset conditions; if a file extension name set includes the current file, determining that the current file meets the preset conditions.

[0036] In the embodiment of the present application, the text processing software process set is used to determine whether a process is a process to be processed, and the file extension name set is used to determine whether a file is a file to be processed. This is equivalent to using a whitelist mechanism, where the processes included in the text processing software process set are a whitelist, and it is determined whether the text processing software process set includes the process. If so, it is determined that the process meets the preset conditions (i.e., the above-mentioned determination that the process is a process to be processed).

[0037] Similarly, the files included in the file extension name set are whitelisted, and it is determined whether the file extension name set includes the current file. If so, it is determined that the current file meets the preset conditions (that is, the above-mentioned judgment file is a file to be processed).

[0038] When it is determined that both the process and the file need to be processed, it is further determined whether the current file is an encrypted file.

[0039] As an optional embodiment of the present application, determining whether the current file is an encrypted file includes the following steps: obtaining the number of bytes of the current file, and determining whether the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file; if the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file, parsing the file header of the current file; if the bytes obtained by parsing the file header of the current file include the target bytes, determining that the current file is an encrypted file; if the bytes obtained by parsing the file header of the current file do not include the target bytes, determining that the current file is not an encrypted file.

[0040] To determine whether a file is an encrypted file, first obtain the number of bytes of the content contained in the current file, and determine whether the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file. Generally, the number of bytes of an encrypted file is fixed, such as 512. If the number of bytes of the current file does not meet the characteristics of the number of bytes of an encrypted file, it can be directly determined that the current file is not an encrypted file. If the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file, further parse the information in the file header to preliminarily determine whether the current file is an encrypted file.

[0041] Encrypted files usually contain some specific tags or metadata in the file header, which can help identify whether the file is encrypted. It should be noted that different encryption algorithms and tools may have different file header formats, so the specific judgment method needs to be determined according to the specific situation.

[0042] When determining whether a file is an encrypted file, the first few bytes of the file are generally read, which usually contain the identification information of the file, and these bytes are compared to see if they match the known encrypted file header.

[0043] Taking GPG encrypted files as an example, the file header of this type of encrypted file usually starts with "Version: 1". If the file header contains "Version: 1", it is considered to be a GPG encrypted file.

[0044] The file header of an AES encrypted file depends on the specific encryption tool and format. For example, some AES encryption tools may include specific tags or metadata in the file header. If the file header contains a specific AES encryption tag, it is considered an AES encrypted file.

[0045] If it is detected that the current file is an encrypted file, the Endpoing Security framework interface es_respond_flags_result(client, msg, 0, true) is called to set the process running in the operating system (that is, the software used to open the current file) to not have the permission to open the current file.

[0046] Step S106, sending the path name of the process and the path name of the current file to the redirection service process.

[0047] If it is determined that the current file is an encrypted file, the path name of the current process and the path name information of the current file acquired in step S102 are sent to the redirection service process.

[0048] The redirection service process is an operation related to a network or local file system, and it involves redirecting the input and output streams of a certain process to another location, such as a file, a network port or other processes. In an embodiment of the present application, the redirection service process is used to redirect files.

[0049] Step S108, the custom function returns and returns the processing operation of the current file to the process, triggering the process to generate the first prompt information of failure to open the current file.

[0050] In this step, the custom function returns a null value, and returns the opening processing operation of the current file to the operating system and the above process, and triggers the above process to generate a prompt message to prompt the user that he does not have the authority to operate the current file.

[0051] Step S110, decrypt the current file based on the redirection service process, and call the process to continue opening the decrypted file.

[0052] After the encrypted file is decrypted, the process mentioned above is called to continue opening the decrypted file.

[0053] The above method provided in the embodiment of the present application realizes the file redirection operation by using the public programming framework and related interfaces provided by the operating system at the application layer, thereby achieving the purpose of opening the encrypted file by using simple programming, thereby achieving the technical effect of improving the stability of the relevant application programs and the operating system in the process of opening the encrypted file in the data security system.

[0054] According to an optional embodiment of the present application, step S106 is executed to determine the type of the first prompt information before decrypting the current file based on the redirection service process; according to the type of the first prompt information, the redirection service process is used to call the system's CGEventPost function and CFRelease function to simulate sending the keyboard Enter key or the keyboard Escape key to eliminate the first prompt information in real time.

[0055] As mentioned above, when the current file is detected to be an encrypted file, the process running in the operating system is set to not have the permission to open the current file, triggering the process to generate the first prompt information of failure to open the current file. This will bring a problem. When the user tries to open the encrypted file, since the process does not have the permission to open the current file, a dialog box or prompt window (i.e. the above-mentioned first prompt information) indicating that the file opening failed will pop up on the screen, which will bring a poor user experience.

[0056] First, the types of prompt information are different. Some types of prompt information will disappear automatically after being generated. Such prompt information does not need to be processed and will not affect the user experience. However, some types of prompt information will not disappear automatically, such as the dialog box or prompt window that pops up on the screen when the file fails to be opened, which will bring a poor user experience.

[0057] To solve this problem, in an embodiment of the present application, after the redirection service process receives the path name of the process and the path name of the file sent by the customized EndpoingSecurity system extension component, it first simulates sending the keyboard enter key or the keyboard escape key (i.e., the "Esc" key in the upper left corner of the keyboard) by calling the operating system API (CGEventPost and CFRelease) to eliminate in real time the information prompt window given to the user by the process currently opening the file after failing to open the file, so as to improve the user experience.

[0058] The timing of canceling the window has a great impact on the user experience. If the simulated key (Enter key or Escape key) is sent too quickly, it may not be canceled because the prompt window has not been displayed; if the simulated key is sent too slowly, the user will see the prompt window. The best state is that the prompt window flashes for a while and the user cannot perceive it. The specific implementation method is to perform a suitable delay processing on the sending of the simulated key.

[0059] CGEventPost and CFRelease are two API functions used in the macOS operating system, which belong to the Core Graphics and Core Foundation frameworks respectively. These two functions have different uses in different contexts. The following is a detailed introduction to these two functions and their usage:

[0060] The CGEventPost function is used to post an event to the event queue. In macOS, the Core Graphics framework provides low-level access to the graphics system, including window management, event processing, and other functions.

[0061] The CFRelease function is used to reduce the reference count. In the Core Foundation framework, most objects are reference counted, which means that each object has a reference count, and each time a new reference is created, the count is increased by one; each time a reference is released, the count is reduced by one. When the count is zero, the object is destroyed.

[0062] According to another optional embodiment of the present application, executing step S106 to open the decrypted file includes the following steps: using the path name of the process and the redirected file path name after decryption of the current file as execution parameters of the system function; calling the system function to execute the open file instruction to open the decrypted file.

[0063] In an embodiment of the present application, the current file is decrypted, and the open command is executed by calling the operating system API system. The path name of the process and the path name of the decrypted redirected file are used as execution parameters to implement the operation of continuing to open the file, and the decrypted file content is displayed to the user.

[0064] In another optional embodiment of the present application, when it is determined that the current file is not an encrypted file, the process is set to have permission to open the current file, and the process continues to perform the operation of opening the current file.

[0065] If it is detected that the current file is not an encrypted file, the Endpoing Security framework interface es_respond_flags_result(client, msg, 0xffffffff, true) is called to grant the process running in the operating system (that is, the software used to open the file) permission to open the current file, and the opening process is returned to the process running in the operating system, notifying the process to open the current file.

[0066] As an optional embodiment of the present application, when there is no permission to decrypt the current file, a second prompt message is generated, wherein the second prompt message is used to prompt the user that he does not have the permission to view the current file.

[0067] The above technical solution proposed in this application uses the public programming framework and related interfaces provided by the operating system at the application layer to implement file redirection operations. The programming implementation is simple, the versatility is high in CPU architecture, and the operation stability is high.

[0068] Based on the above-mentioned file processing method provided in the embodiment of the present application, the embodiment of the present application also provides a file processing device, such as Figure 2 As shown, the device comprises:

[0069] The acquisition module 20 is used to acquire the path name of the process used to open the current file and the path name of the current file by using a custom function implemented on the Endpoint Security framework.

[0070] The Endpoint Security Framework for macOS allows developers to monitor system events to detect malicious activity, including events such as file creation, file opening, file renaming, directory traversal, process creation, session login, etc.

[0071] The Endpoint Security framework is very easy to use. First, call es_new_client() to create an ES client and define the event processing function of the ES client. Second, call es_subscribe() to subscribe to the event type of interest. Then, when the subscribed event occurs, the system will call the defined event processing function, and the event processing function can be used to handle various events.

[0072] First, write a system extension component based on the Endpoint Security framework, register the ES_EVENT_TYPE_AUTH_OPEN system event to the system, and implement a custom open function, defined as static void handle_open_worker(es_client_t *client, const es_message_t *msg), which is the custom function mentioned in step S102 above.

[0073] ES_EVENT_TYPE_AUTH_OPEN is a custom system event type used to identify that a file open operation requires authentication or authorization. When an application attempts to open a file, the system triggers this event type and allows the listener registered for the event to decide whether to allow the operation to proceed.

[0074] The main purpose of registering the ES_EVENT_TYPE_AUTH_OPEN system event with the system is to monitor and control the file opening operation. This mechanism is usually used in the Endpoint Security framework to enhance system security and prevent unauthorized file access.

[0075] Next, in the handle_open_worker function, the path name of the process that opens the current file is obtained through the parameter msg->process->executable->path.data, and the path name of the current file is obtained through msg->event.close.target->path.data.

[0076] The first processing module 22 is used to call the es_respond_flags_result function provided by the Endpoint Security framework to set the process to not have the permission to open the current file when it is determined that the process and the current file meet the preset conditions and the current file is an encrypted file.

[0077] According to an optional embodiment of the present application, determining whether a process and a current file meet preset conditions is achieved by the following method: if a text processing software process set includes a process, determining that the process meets the preset conditions; if a file extension name set includes the current file, determining that the current file meets the preset conditions.

[0078] In the embodiment of the present application, the text processing software process set is used to determine whether a process is a process to be processed, and the file extension name set is used to determine whether a file is a file to be processed. This is equivalent to using a whitelist mechanism, where the processes included in the text processing software process set are a whitelist, and it is determined whether the text processing software process set includes the process. If so, it is determined that the process meets the preset conditions (i.e., the above-mentioned determination that the process is a process to be processed).

[0079] Similarly, the files included in the file extension name set are whitelisted, and it is determined whether the file extension name set includes the current file. If so, it is determined that the current file meets the preset conditions (that is, the above-mentioned judgment file is a file to be processed).

[0080] When it is determined that both the process and the file need to be processed, it is further determined whether the current file is an encrypted file.

[0081] As an optional embodiment of the present application, determining whether the current file is an encrypted file includes the following steps: obtaining the number of bytes of the current file, and determining whether the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file; if the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file, parsing the file header of the current file; if the bytes obtained by parsing the file header of the current file include the target bytes, determining that the current file is an encrypted file; if the bytes obtained by parsing the file header of the current file do not include the target bytes, determining that the current file is not an encrypted file.

[0082] To determine whether a file is an encrypted file, first obtain the number of bytes of the content contained in the current file, and determine whether the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file. Generally, the number of bytes of an encrypted file is fixed, such as 512. If the number of bytes of the current file does not meet the characteristics of the number of bytes of an encrypted file, it can be directly determined that the current file is not an encrypted file. If the number of bytes of the current file meets the characteristics of the number of bytes of an encrypted file, further parse the information in the file header to preliminarily determine whether the current file is an encrypted file.

[0083] Encrypted files usually contain some specific tags or metadata in the file header, which can help identify whether the file is encrypted. It should be noted that different encryption algorithms and tools may have different file header formats, so the specific judgment method needs to be determined according to the specific situation.

[0084] When determining whether a file is an encrypted file, the first few bytes of the file are generally read, which usually contain the identification information of the file, and these bytes are compared to see if they match the known encrypted file header.

[0085] Taking GPG encrypted files as an example, the file header of this type of encrypted file usually starts with "Version: 1". If the file header contains "Version: 1", it is considered to be a GPG encrypted file.

[0086] The file header of an AES encrypted file depends on the specific encryption tool and format. For example, some AES encryption tools may include specific tags or metadata in the file header. If the file header contains a specific AES encryption tag, it is considered an AES encrypted file.

[0087] If it is detected that the current file is an encrypted file, the Endpoing Security framework interface es_respond_flags_result(client, msg, 0, true) is called to set the process running in the operating system (that is, the software used to open the current file) to not have the permission to open the current file.

[0088] The sending module 24 is used to send the path name of the process and the path name of the current file to the redirection service process.

[0089] If it is determined that the current file is an encrypted file, the acquired path name of the current process and the path name information of the current file are sent to the redirection service process.

[0090] The redirection service process is an operation related to a network or local file system, and it involves redirecting the input and output streams of a certain process to another location, such as a file, a network port or other processes. In an embodiment of the present application, the redirection service process is used to redirect files.

[0091] The second processing module 26 is used to return the user-defined function and return the processing operation of the current file to the process, triggering the process to generate the first prompt information of failure to open the current file.

[0092] The third processing module 28 is used to decrypt the current file based on the redirection service process, and call the process to continue opening the decrypted file.

[0093] It should be noted that Figure 2 The preferred implementation of the embodiment shown can be referred to Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0094] The embodiment of the present application also provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program executable by the at least one processor, and the computer program is used to enable the electronic device to perform the method of the embodiment of the present application when executed by the at least one processor.

[0095] An embodiment of the present application also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0096] The embodiment of the present application also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0097] refer to Figure 3 , the structural block diagram of the electronic device that can be used as the server or client of the embodiment of the present application will now be described, which is an example of the hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0098] like Figure 3 As shown, the electronic device includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0099] Multiple components in the electronic device are connected to the I / O interface 305, including: an input unit 306, an output unit 307, a storage unit 308, and a communication unit 309. The input unit 306 can be any type of device that can input information to the electronic device, and the input unit 306 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 307 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 308 can include but is not limited to a disk, an optical disk. The communication unit 309 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0100] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present application may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via a ROM 302 and / or a communication unit 309. In some embodiments, the computing unit 301 may be configured to perform the above method in any other appropriate manner (e.g., by means of firmware).

[0101] The computer program for implementing the method of the embodiment of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0102] In the context of the embodiments of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, devices, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0103] It should be noted that the term "including" and its variations used in the embodiments of the present application are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present application are illustrative and not restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0104] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0105] The various steps described in the method implementation methods provided in the embodiments of the present application can be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present application is not limited in this respect.

[0106] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0107] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for processing a file, characterized in that: include: Obtain the path name of the process used to open the current file and the path name of the current file using a custom function implemented on the Endpoint Security framework; The custom function is a processing function of the ES_EVENT_TYPE_AUTH_OPEN system event; When it is determined that the process and the current file meet the preset conditions and the current file is an encrypted file, calling the es_respond_flags_result function provided by the Endpoint Security framework to set the process to not have permission to open the current file; Sending the path name of the process and the path name of the current file to the redirection service process; The custom function returns, and returns the processing operation of the current file to the process, triggering the process to generate the first prompt information of failure to open the current file; The current file is decrypted based on the redirection service process, and the process is called to continue opening the decrypted file.

2. The method according to claim 1, characterized in that Before decrypting the current file based on the redirection service process, the method further includes: Determine the type of the first prompt information; According to the type of the first prompt information, the redirection service process is used to call the system's CGEventPost function and CFRelease function to simulate sending the keyboard Enter key or the keyboard Escape key to eliminate the first prompt information in real time.

3. The method according to claim 1, characterized in that Open the decrypted files, including: Using the path name of the process and the redirected file path name after decryption of the current file as execution parameters of the system function; The system function is called to execute an open file instruction to open the decrypted file.

4. The method according to claim 1, characterized in that: Determining whether the process and the current file meet a preset condition includes: If the text processing software process set includes the process, determining that the process meets a preset condition; If the file extension name set includes the current file, it is determined that the current file meets a preset condition.

5. The method according to claim 1, characterized in that Determining whether the current file is an encrypted file includes: Obtaining the number of bytes of the current file, and determining whether the number of bytes of the current file meets the characteristics of the number of bytes of the encrypted file; If the number of bytes of the current file meets the characteristics of the number of bytes of the encrypted file, parsing the file header of the current file; If the bytes obtained by parsing the file header of the current file include the target bytes, determining that the current file is an encrypted file; If the bytes obtained by parsing the file header of the current file do not include the target bytes, it is determined that the current file is not an encrypted file.

6. The method according to claim 1, characterized in that The method further comprises: In the case of not having the authority to decrypt the current file, a second prompt message is generated, wherein the second prompt message is used to prompt the user that the user does not have the authority to view the current file.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: When it is determined that the current file is not an encrypted file, the process is set to have permission to open the current file, and the process continues to perform an operation of opening the current file.

8. An electronic device comprising: A processor and a memory storing a program, wherein the program comprises instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

9. A non-transitory machine-readable medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor of a computer, the computer is used to cause the computer to execute the method according to any one of claims 1 to 7.

Images