File processing method and device

Abstract

The invention provides a file processing method, which comprises the following steps: obtaining an encrypted first file in response to obtaining a first secret key, the first file comprising attribute information of each component corresponding to a second file, and the second file being used for supporting the component to be in a working state; based on the first secret key, at least part of the encrypted first file is decrypted, so that target attribute information, corresponding to the first secret key, in the first file is in a decrypted state. The invention further provides a file processing device for executing the method.

Description

Technical Field

[0001] The present disclosure relates to the field of electronic technology, and more specifically, to a file processing method and device. Background Art

[0002] In modern software development and management, it is crucial to understand the components, dependencies, and related information of the software. By listing all the components in the software, including the supplier or source information of open source libraries, third-party software, and proprietary code, developers and organizations can clearly understand the composition and structure of the software. This list helps track and manage software components, ensure the overall quality and reliability of the software, help identify and prevent potential risks in the supply chain, ensure the security and reliability of the supply chain, and facilitate tracking and implementation of updates through clear descriptions of components and dependencies, reduce technical debt, and improve software maintenance efficiency.

[0003] However, some codes and designs are not publicly available and are not secure enough to use and protect. Summary of the invention

[0004] In view of this, the present disclosure provides a file processing method, device, electronic device medium, and program product.

[0005] One aspect of the present disclosure provides a file processing method, including: in response to obtaining a first key, obtaining an encrypted first file, the first file including attribute information of each component corresponding to a second file, and the second file being used to support the component in a working state; based on the first key, at least partially decrypting the encrypted first file so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

[0006] According to an embodiment of the present disclosure, obtaining the encrypted first file includes: obtaining a third file, the third file including attribute information of each component corresponding to the second file, wherein the third file and the second file are stored in the same storage module; and generating the encrypted first file according to the third file.

[0007] According to an embodiment of the present disclosure, the file processing method also includes: obtaining attribute information of each component in the second file; generating an attribute information file based on the attribute information; encrypting the attribute information file based on a pre-generated second key to obtain an encrypted first file; and generating a third file in the same format as the second file based on the encrypted first file.

[0008] According to an embodiment of the present disclosure, the file processing method also includes: determining a target attribute corresponding to the target attribute information; generating a first key corresponding to the target attribute based on the target attribute and the second key, so that the target attribute information corresponding to the target attribute in the first file can be in a decrypted state based on the first key.

[0009] According to an embodiment of the present disclosure, the second file is generated based on the first code, and the attribute information of each component in the second file is obtained, including: splitting the first code to obtain multiple code blocks, and the code blocks correspond to the components one by one; matching the code blocks according to the preset first database to determine the attribute information of the components.

[0010] According to an embodiment of the present disclosure, obtaining attribute information of each component in the second file includes: generating a reverse code corresponding to the second file based on the second file, wherein the reverse code includes address information associated with at least some of the components; determining the attribute information of at least some of the components based on a preset second database and the address information; determining the attribute information of each component in the second file based on a preset third database and the attribute information of at least some of the components.

[0011] According to an embodiment of the present disclosure, the file processing method also includes: obtaining a fourth file generated by the first code during the compilation process, the fourth file including compilation information of each code block in the first code; and determining the integrity of the first file based on a comparison result between the fourth file and the first file.

[0012] According to an embodiment of the present disclosure, the first file also includes identification information, and the file processing method also includes: obtaining an update request for the first file; determining the update authority of the update request based on the update request and the identification information; and updating the first file when the update authority satisfies a first condition.

[0013] According to an embodiment of the present disclosure, the file processing method also includes: matching the first code and / or reverse code according to a preset fourth database to determine the vulnerability component, wherein the reverse code is generated based on the second file, and the first code is used to generate the second file; determining the attribute information of the vulnerability component according to the vulnerability component and the first file; and outputting prompt information based on the attribute information of the vulnerability component.

[0014] Another aspect of the present disclosure provides a file processing device, including: an obtaining module, which obtains an encrypted first file, wherein the first file includes attribute information of each component corresponding to a second file, and the second file is used to support the component to be in a working state; and

[0015] A decryption module is used to decrypt at least part of the encrypted first file based on the first key, so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

[0016] Another aspect of the present disclosure provides an electronic device, comprising:

[0017] one or more processors;

[0018] a memory for storing one or more programs,

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0020] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0021] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and when the instructions are executed, are used to implement the method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0023] Figure 1 A flowchart of a file processing method according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 2 Schematically shows a flow chart of obtaining an encrypted first file in a file processing method according to an embodiment of the present disclosure;

[0025] Figure 3 A flowchart of generating a third file in a file processing method according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 4 A flowchart of generating a first secret key in a file processing method according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 5 Schematically shows a flowchart of obtaining attribute information of each component in a second file in a file processing method according to an embodiment of the present disclosure;

[0028] Figure 6 Another flowchart schematically illustrates the method for obtaining the attribute information of each component in the second file in the file processing method according to the embodiment of the present disclosure;

[0029] Figure 7 A flowchart for determining the integrity of a first file in a file processing method according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 8 A flowchart of updating a first file in a file processing method according to an embodiment of the present disclosure is schematically shown;

[0031] Fig. 9 A flowchart of prompting vulnerability information in a file processing method according to an embodiment of the present disclosure is schematically shown;

[0032] Fig.10 A block diagram schematically shows a file processing device according to an embodiment of the present disclosure; and

[0033] Fig.11 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0036] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0037] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0038] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0039] In the embodiments of the present disclosure, before obtaining or collecting user personal information or obtaining or collecting organization or group information, corresponding authorization or consent is obtained.

[0040] An embodiment of the present disclosure provides a file processing method, comprising: in response to obtaining a first key, obtaining an encrypted first file, the first file including attribute information of each component corresponding to a second file, and the second file being used to support the components in a working state; based on the first key, at least partially decrypting the encrypted first file so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

[0041] Figure 1 The flowchart of the file processing method according to the embodiment of the present disclosure is schematically shown.

[0042] like Figure 1 As shown, the method includes operations S110 to S120.

[0043] In operation S110, in response to obtaining the first key, an encrypted first file is obtained, the first file including attribute information of each component corresponding to the second file, and the second file is used to support the component in a working state.

[0044] Specifically, each component corresponding to the second file may be, for example, each hardware device used to support the operation of the electronic device. The second file is used to put each component in a working state to form an execution environment, and the execution environment is used to respond to the operation of the operating system.

[0045] For example, the second file may be an executable file corresponding to UEFI (Unified Extensible Firmware Interface), such as a bin file.

[0046] Components can be various hardware devices in or connected to electronic devices, such as network cards, graphics cards, CPUs, memories, etc. The executable files corresponding to UEFI are triggered to execute after the electronic device is started but before the operating system is loaded, providing support for various hardware devices, such as initializing the aforementioned network cards, loading drivers corresponding to various hardware, etc., so that the execution environment composed of various hardware can respond to the operation of the operating system after the operating system is loaded.

[0047] According to an embodiment of the present disclosure, the attribute information of each component corresponding to the second file may include but is not limited to the component name, version number, source (supplier), license information, dependencies, tools used to build software programs, compiler version, build script, author, release date, modification history, etc.

[0048] According to an embodiment of the present disclosure, the first file may include the attribute information of each component corresponding to the second file, for example, the attribute information of each component corresponding to the second file is stored in the first file in the form of a table. According to the actual needs, the first file may be an XML file, a JSON file, etc., and the present disclosure does not limit the format of the first file.

[0049] The following Table 1 gives an example of attribute information stored in the first file. It should be noted that the content in Table 1 is only an example, and those skilled in the art can store appropriate content accordingly according to actual conditions.

[0050] Table 1 Attribute information stored in the first file

[0051]

[0052] According to an embodiment of the present disclosure, in response to the timing of obtaining the first key, it may be before the operating system is loaded, for example, when the electronic device is in a UEFI system takeover state.

[0053] According to an embodiment of the present disclosure, the encrypted first file is obtained based on data stored in the electronic device.

[0054] In operation S120, based on the first key, the encrypted first file is at least partially decrypted, so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

[0055] According to an embodiment of the present disclosure, before the electronic device obtains the first key and before obtaining the first key, the first file is in at least a partially encrypted state. The encrypted portion is only disclosed to a specific user, organization, or group. The specific user, organization, or group can use the first key to decrypt the target attribute information corresponding to the first key in the first file, so that the target attribute information is in a decrypted state.

[0056] Table 2 schematically shows the contents of the encrypted first file, wherein “***” indicates that the contents have been encrypted and the specific contents cannot be read.

[0057] Table 2 Attribute information in the first encrypted file

[0058]

[0059] It should be noted that there may be unencrypted parts in the first file, for example, the relevant information of component A in Table 2, which means that any user must have the reading permission of component A. For example, component A and its relevant information have been fully disclosed and free of charge by supplier A and the author. In other embodiments, all contents in the first file are encrypted. In this case, the fully disclosed content such as component A in Table 1 can also be encrypted, and accordingly, any first key can decrypt the content of component A.

[0060] According to an embodiment of the present disclosure, before responding to obtaining the first key, a specific user, organization or group needs to obtain the first key corresponding to its reading permission in advance. The acquisition method can be, for example, that the specific user, organization or group sends a key application to the server, and after the server authenticates the identity of the specific user, organization or group, the corresponding first key is sent to the specific user, organization or group according to the target electronic device and the reading permission of the specific user, organization or group, so that the specific user, organization or group can enter the correct first key into the electronic device.

[0061] Table 3 schematically shows the content of the first file after at least partial decryption. For example, the target attribute information corresponding to the first key is "personnel is C, supplier is C". Then the encrypted first file is decrypted using the first key, and the decrypted content may be as shown in Table 3.

[0062] Table 3 Attribute information in the first file after decryption

[0063]

[0064] According to the disclosed embodiment, through the first key, the user can only read the content of the first file that meets his or her authority, while other content is in an undecrypted state, thereby ensuring the security of the data. In addition, the encrypted first file is obtained by processing the data already saved in the electronic device, so that the content recorded in the first file is associated with the actual product. The user can directly obtain the attribute information of each component corresponding to the second file of the electronic product through the electronic device of the actual product, without having to obtain a component list and then look for the corresponding electronic product as in the traditional method, thereby improving the user experience.

[0065] Figure 2 The flowchart of obtaining the encrypted first file in the file processing method according to the embodiment of the present disclosure is schematically shown.

[0066] like Figure 2 As shown, operation S110 may include operations S210 to S220.

[0067] In operation S210, a third file is obtained, where the third file includes attribute information of each component corresponding to the second file, wherein the third file and the second file are stored in the same storage module.

[0068] According to an embodiment of the present disclosure, the format of the third file is the same as that of the second file, for example, both may be bin files, and the third file includes attribute information of each component corresponding to the second file. It should be noted that the third file may include relevant information such as in Table 1 above, but the relevant data in the third file is not directly displayed as in Table 1 above, that is, the data in the third file has the meaning of the content shown in Table 1 above, but the data in the third file needs to be further processed before it can be changed into intuitive data such as in Table 1.

[0069] In operation S220, an encrypted first file is generated according to the third file. According to an embodiment of the present disclosure, the format of the first file may be different from that of the second file. For example, the second file and the third file are both bin files, and an encrypted first file is generated according to the third file in bin format, and the encrypted first file may be an XML file. The generation method may be to unpack or decode the bin file through a suitable parsing tool, and the specific parsing tool depends on how the bin file is packaged or encoded, and the present disclosure does not limit the specific generation and parsing process.

[0070] According to the disclosed embodiment, since the second file is used to support the component in a working state to form an execution environment to respond to the operation of the operating system, for example, the second file is an executable file corresponding to UEFI, then the second file needs to be non-volatile, so that the electronic device will not be affected or changed during power failure, restart, and operation of the operating system, so as to ensure the repeated use of the electronic device. On this basis, the third file and the second file are stored in the same storage module, such as a UEFI memory, so that the third file also has corresponding non-volatility. During the repeated use of the electronic device, whether it is power failure, restart, or system operation, the content of the third file will not be changed, thereby ensuring the security and authority of the data recorded in the first file corresponding to the third file.

[0071] Figure 3The flowchart of generating the third file in the file processing method according to the embodiment of the present disclosure is schematically shown.

[0072] like Figure 3 As shown, the file processing method of the embodiment of the present disclosure may further include operations S310 to S340.

[0073] In operation S310, the attribute information of each component in the second file is obtained. For example, the name, version number, source (supplier), license information, dependencies, tools for building software programs, compiler versions, build scripts, authors, release dates, modification history, etc. of each component can be obtained through the firmware interface of the electronic device, such as UEFI or BIOS (Basic Input / Output System). It should be noted that if the attribute information obtained in this way is not comprehensive, the attribute information that cannot be obtained can be supplemented through the preset database based on the attribute information obtained through the firmware interface. For example, if only the serial number and version number of each component are obtained through the firmware interface, then other attribute information such as source, author, etc. of the components corresponding to each serial number and version number can be queried in the preset database.

[0074] In operation S320, an attribute information file is generated according to the attribute information. The attribute information file may be an XML file, and the attribute information may be stored in a table format in the XML file.

[0075] In operation S330, the attribute information file is encrypted based on the pre-generated second key to obtain an encrypted first file.

[0076] Specifically, the pre-generated second key is not associated with the content in the attribute information file. The pre-generated second key can be generated based on cryptographic principles and algorithms. For example, the second key is generated using a secure random number generator and specific cryptographic techniques (such as elliptic curve cryptography or pairing base cryptography). The second key itself is a collection of cryptographic parameters.

[0077] Before encrypting the attribute information file, you also need to define the access policy of the attribute information file. The access policy records various pre-set user permissions. For example, user 1 only has the reading permission for the relevant components in the attribute information file whose author is "user 1".

[0078] The public parameters are derived through the second key and a specific algorithm. The public parameters do not contain the master key itself, but related data generated by the second key through a series of calculations.

[0079] The attribute information file is encrypted using public parameters and access policies to obtain an encrypted first file.

[0080] In operation S340, a third file having the same format as the second file is generated according to the encrypted first file. For example, if the second file is a bin file and the encrypted first file is an encrypted XML file, the encrypted XML file can be compiled by a corresponding compilation tool to obtain a bin file having the same format as the second file.

[0081] According to an embodiment of the present disclosure, after generating the third file, the method further includes storing the third file and the second file in the same memory.

[0082] Specifically, a large file can be generated based on the third file and the second file, that is, the third file and the second file are spliced ​​together. It should be noted that in this way, the spliced ​​file should not affect the normal execution of the content in the second file by the electronic device, that is, the electronic device can execute the same function as the second file is executed alone through the spliced ​​file. Moreover, when executing the same function as the second file is executed alone, the content corresponding to the first file in the spliced ​​file will not be changed.

[0083] Specifically, a designated area can be divided in the memory where the second file needs to be stored to store the third file. It should be noted that after the third file is stored, the third file should not be modified when the electronic device executes the second file and after the electronic device executes the second file. Accordingly, when the third file is operated (e.g., written, read, etc.) and after the third file is operated, the content of the second file should not be modified.

[0084] Figure 4 The flowchart of generating the first key in the file processing method according to the embodiment of the present disclosure is schematically shown.

[0085] like Figure 4 As shown, the file processing method of the embodiment of the present disclosure may further include operations S410 to S420.

[0086] In operation S410, the target attribute corresponding to the target attribute information is determined. The target attribute information should correspond to the user's authority. For example, if user 1 can read all the contents whose author is C and supplier is C, then the target attributes should be "author: C" and "supplier: D".

[0087] In operation S420, a first key corresponding to the target attribute is generated according to the target attribute and the second key, so that target attribute information corresponding to the target attribute in the first file can be decrypted based on the first key.

[0088] Specifically, according to the target attribute and the second key, generating the first key corresponding to the target attribute includes: generating the second key by combining the public parameter derived from the second key with the target attribute, for example, combining the public parameter with the target attribute through methods such as elliptic curves and pairing base cryptography to generate the second key. It should be noted that the public parameter used to generate the second key should be the same as Figure 3 In the embodiment, the public parameters used to encrypt the attribute information file are the same, so that the target attribute information corresponding to the target attribute in the first file can be decrypted based on the first key. For example, the target attributes should be "author: C" and "supplier: D", then the target attribute information should be the attribute information of all components whose author is C and whose supplier is supplier D.

[0089] Figure 5 A flowchart for obtaining attribute information of each component in a second file in a file processing method according to an embodiment of the present disclosure is schematically shown.

[0090] like Figure 5 As shown, in Figures 1 to 4 Based on the illustrated embodiment, operation S310 may include operations S510 to S520.

[0091] According to the embodiment of the present disclosure, the second file is generated based on the first code. For example, the second file is an executable file corresponding to UEFI, and the first code can be a specific code of UEFI written by a programmer in a high-level language. The first code is compiled or converted to generate an executable file (second file) executed by the electronic device during actual operation.

[0092] In operation S510, the first code is split to obtain a plurality of code blocks, and the code blocks correspond to the components one by one. The first code can be split into various code blocks, and the code blocks correspond to the components one by one. For example, the components corresponding to the UEFI executable file are a graphics card, a network card, and an external hard disk. Then, in the corresponding first code, the program code corresponding to each component can also be split out, for example, split out graphics card related code, network card related code, and external hard disk related code, etc.

[0093] In operation S520, the code blocks are matched according to the preset first database to determine the attribute information of the component. The first database may be a database that pre-stores the relevant codes corresponding to the attribute information. For example, the graphics card related codes of the manufacturer A whose author is A, the network card related codes of the manufacturer B whose author is B, etc. are pre-stored in the first database. It should be noted that the above storage content only illustrates the case where there are only two attribute information (manufacturer and author), and those skilled in the art can store relevant codes for different attribute information and any combination of different attribute information according to actual conditions.

[0094] The code block is matched through the preset first database to determine the attribute information of the component corresponding to the code block. It should be noted that in actual situations, technicians often make adaptive adjustments to the code, which will cause certain differences between the code in the code block and the code pre-stored in the first database. In view of this situation, the code can be matched for similarity. When the similarity is greater than a preset threshold, the code in the code block is considered to be successfully matched. Based on the successfully matched code in the first database, the attribute information of the component corresponding to the code block can be determined.

[0095] Figure 6 Another flowchart schematically illustrates the method for obtaining the attribute information of each component in the second file in the file processing method according to an embodiment of the present disclosure.

[0096] like Figure 6 As shown, in Figures 1 to 4 Based on the illustrated embodiment, operation S310 may include operations S610 to S630.

[0097] In operation S610, a reverse code corresponding to the second file is generated according to the second file, where the reverse code includes address information associated with at least part of the components.

[0098] In the embodiment of the present disclosure, the second file may be, for example, a compiled or packaged executable file provided by a supplier. Usually, these executable files are saved as binary data. In this case, determining the attribute information of each component in the second file requires reverse analysis of the second file, and reverse analysis of the second file is performed using a reverse analysis tool for executable files.

[0099] It should be noted that after the code is compiled to generate an executable file such as a bin file, it is generally difficult to restore the bin file to the original code due to the irreversibility of the compilation. However, through the reverse analysis tool, the binary data in the bin file can be reversed to obtain the reverse code, which will contain at least some of the address information associated with the component. For example, the reverse code obtained by the reverse analysis tool will contain the address information of the interface, library or function called by the component.

[0100] In operation S620, attribute information of at least some components is determined according to the preset second database and address information. In the preset second database, the correspondence between the interface, library or function and the address can be maintained in advance, and the attribute information of at least some components can be determined through the second database and the address information obtained in the reverse code. For example, after the bin file is reverse analyzed by the reverse analysis tool, it is found in the reverse code obtained that the bin file will access and call the relevant content of address A during execution. Through the second database, it can be queried that the corresponding content at address A is a function for graphics card initialization with version number 1.001, then there is a component for graphics card initialization in the second file, and some attribute information of this component (version number 1.001, component function for graphics card initialization, etc.) can be confirmed.

[0101] In operation S630, the attribute information of each component in the second file is determined according to the preset third database and the attribute information of at least some components. The third database pre-stores the corresponding information between each mutually related attribute parameter, so other attribute information of each component can be determined through the third database and the attribute information of at least some components obtained in operation S620. For example, the third database stores: a component with version number 1.001 for graphics card initialization, whose supplier is supplier D and author is person E. Then, other attribute information of this component can be obtained through version number 1.001 and function of graphics card initialization: supplier is supplier D and author is person E.

[0102] In other embodiments, it can be combined with Figure 5 and Figure 6 In the illustrated embodiment, two methods are used to simultaneously obtain the corresponding attribute parameters, and the results of the two are compared to verify integrity.

[0103] Figure 7 The flowchart of determining the integrity of a first file in the file processing method according to an embodiment of the present disclosure is schematically shown.

[0104] like Figure 7 As shown, in Figure 5 Based on the illustrated embodiment, verifying the integrity of the first file may include operations S710 to S720.

[0105] In operation S710, a fourth file generated during the compilation of the first code is obtained, where the fourth file includes compilation information of each code block in the first code.

[0106] According to an embodiment of the present disclosure, the first file is generated according to the first code, for example, it is obtained by compiling the first code. Then, during the compilation process of the first code, a fourth file is generated at the same time, and the fourth file includes compilation information of each code block in the first code. The fourth file may be, for example, a compilation log generated during the compilation process of the first code, and the compilation information may include, for example, the version number of each code block in the first code.

[0107] In operation S720, the integrity of the first file is determined based on the comparison result of the fourth file with the first file. Since the code blocks and components are in a one-to-one correspondence, the compilation information of each code block and the component are also in a one-to-one correspondence. Through this one-to-one correspondence, it can be determined whether each component recorded in the first file corresponds one-to-one with the compilation information in the fourth file, so as to determine the integrity of the first file. For example, through the version number in the compilation information, it is determined which components the first code corresponds to, and then these determined components are compared with the components in the first file to determine whether the components recorded in the first file are complete.

[0108] Figure 8 The flowchart of updating the first file in the file processing method according to the embodiment of the present disclosure is schematically shown.

[0109] According to the embodiment of the present disclosure, the first file also includes identification information. Specifically, after the encrypted first file is generated, an identification information can be added therein, and the identification information can be stored in, for example, a file header or a file attribute-related location for determining update permissions.

[0110] like Figure 8 As shown, in Figures 1 to 7 Based on the illustrated embodiment, the method further includes: updating the first file, which may specifically include operations S810 to S830.

[0111] In operation S810, an update request for a first file is obtained. When a first file in an electronic device needs to be updated, a user needs to send an update request to determine an update authority.

[0112] In operation S820, the update authority of the update request is determined based on the update request and the identification information. The update authority includes allowing updates and not allowing updates. The update request contains an identification value corresponding to the content of the identification information. If the identification value is within the range allowed by the identification information, then the update authority is determined to be allowing updates. If not, then the update authority is determined to be not allowing updates. For example, the identification information is a specific value, assuming it is 0x01. When the identification value in the update request is also 0x01, the update authority is allowing updates, otherwise updates are not allowed. For example, the identification information may also be a numerical range, assuming it is 0x01 to 0x10. As long as the identification value in the update request is within this range, updates are allowed, otherwise updates are not allowed.

[0113] In operation S830, if the update permission satisfies a first condition, the first file is updated. Specifically, the first condition is: if the update permission is to allow update, the first file is updated.

[0114] Combination Figure 2 In the illustrated embodiment, since the content of the first file is saved in the electronic device in the form of a third file, for example, saved in the format of a bin file, it is difficult to know the specific corresponding binary data of the updated content in the bin file when updating, so it is difficult to directly update the content in the bin file. Therefore, when the first file is updated, the entire content in the first file is updated, that is, the updated third file is generated with the complete updated first file, replacing or overwriting the original third file. It should be noted that when the third file is spliced ​​with the second file, that is, the second file and the third file are saved together as a large file, it is necessary to update the entire spliced ​​file, that is, it is necessary to generate an updated third file from the updated first file, and then splice the updated third file with the original second file to generate an updated spliced ​​file, and then replace or overwrite the originally stored spliced ​​file.

[0115] Fig. 9 The flowchart of prompting vulnerability information in the file processing method according to an embodiment of the present disclosure is schematically shown.

[0116] like Fig. 9 As shown, in Figures 1 to 8 Based on the illustrated embodiment, the file processing method may further include outputting prompt information, which may specifically include operations S910 to S930.

[0117] In operation S910, the first code and / or the reverse code are matched according to the preset fourth database to determine the vulnerable component, wherein the reverse code is generated from the second file, and the first code is used to generate the second file. The fourth database can pre-store the code of the component with existing vulnerabilities and the corresponding attribute information. Based on this, the first code can be matched with the vulnerability code, and when it is determined that there is a code in the first code with a similarity greater than a preset similarity threshold with the vulnerability code, it is considered that there is a vulnerable component in the component corresponding to the first code. And / or, according to the address information obtained in the reverse code, the attribute information of at least part of the components is determined, and the attribute information obtained is matched with the attribute information stored in the fourth database, so as to determine whether there is a vulnerable component in the component corresponding to the second file corresponding to the reverse code. For example, it is determined through the reverse code that the graphics card initialization component with version number 1.002 is used in the second file, and in the fourth database, "the graphics card initialization component with version number 1.002 has a vulnerability" is saved, then it can be determined that there is a vulnerable component in the second file.

[0118] In operation S920, attribute information of the vulnerable component is determined based on the vulnerable component and the first file. The attribute information of the component determined in operation S910 is incomplete, while the first file records the complete attribute information of each component. Therefore, the attribute information of each vulnerable component can be quickly determined through the vulnerable component and the first file. For example, if it is determined through operation S910 that there is a graphics card initialization component with version number 1.002 in the component corresponding to the second file, then the first file can be queried to determine that the graphics card initialization driver with version number 1.002 is provided by supplier E and the author is person F.

[0119] In operation S930, based on the attribute information of the vulnerable component, a prompt message is output. For example, in the above operation, it is determined that the supplier of the vulnerable component is E, the author is F, the version number is 1.002, and the function is to initialize the graphics card, then a prompt message can be output: "In this code or executable file, there is a vulnerable component, the component information can be: supplier E, author F, version number 1.002, used for graphics card initialization, please pay attention to the technician." This prompts the technician to perform further processing.

[0120] Fig.10 The block diagram schematically shows a file processing device according to an embodiment of the present disclosure.

[0121] like Fig.10 As shown, the file processing device 1000 includes an acquisition module 1010 and a decryption module 1020 .

[0122] The acquisition module 1010 is used to obtain the encrypted first file in response to obtaining the first key, the first file including the attribute information of each component corresponding to the second file, and the second file is used to support the component to be in a working state. In some embodiments, the acquisition module 1010 can be used to perform the aforementioned operation S110.

[0123] The decryption module 1020 is used to decrypt at least part of the encrypted first file based on the first key, so that the target attribute information corresponding to the first key in the first file is in a decrypted state. In some embodiments, the decryption module 1020 can be used to perform the aforementioned operation S120.

[0124] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0125] For example, any multiple of the acquisition module 1010 and the decryption module 1020 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the acquisition module 1010 and the decryption module 1020 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 1010 and the decryption module 1020 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0126] It should be noted that the file processing device part in the embodiment of the present disclosure corresponds to the file processing method part in the embodiment of the present disclosure. The description of the file processing device part specifically refers to the file processing method part, which will not be repeated here.

[0127] According to the embodiment of the present disclosure, the file processing apparatus 1000 may further include a second obtaining module 1030 , a first generating module 1040 , an encryption module 1050 and a second generating module 1060 .

[0128] The second obtaining module 1030 is used to obtain the attribute information of each component in the second file. In some embodiments, the above operation S310 may be performed, which will not be described in detail here.

[0129] The first generating module 1040 is used to generate an attribute information file according to the attribute information. In some embodiments, the above operation S320 may be performed, which will not be described in detail here.

[0130] The encryption module 1050 is used to encrypt the attribute information file based on the pre-generated second key to obtain the encrypted first file. In some embodiments, the above operation S330 may be performed, which will not be described in detail here.

[0131] The second generating module 1060 is used to generate a third file in the same format as the second file according to the encrypted first file. In some embodiments, the above operation S340 may be performed, which will not be described in detail here.

[0132] According to an embodiment of the present disclosure, the file processing device 1000 may further include a third generation module 1070, which is used to determine a target attribute corresponding to the target attribute information; and generate a first key corresponding to the target attribute according to the target attribute and the second key, so that the target attribute information corresponding to the target attribute in the first file can be in a decrypted state based on the first key. In some embodiments, the above operations S410 to S420 may be performed, which will not be described in detail herein.

[0133] According to an embodiment of the present disclosure, the file processing device 1000 may further include an integrity verification module 1080, which is used to obtain a fourth file generated during the compilation of the first code, wherein the fourth file includes compilation information of each code block in the first code; and determine the integrity of the first file according to a comparison result between the fourth file and the first file. In some embodiments, the above operations S710 to S720 may be performed, which will not be described in detail herein.

[0134] According to an embodiment of the present disclosure, the file processing device 1000 may further include an update module 1090, which is used to obtain an update request for the first file; determine the update authority of the update request according to the update request and the identification information; and update the first file if the update authority satisfies the first condition. In some embodiments, the above operations S810 to S830 may be performed, which will not be described in detail here.

[0135] According to an embodiment of the present disclosure, the file processing device 1000 may further include a prompt module, which is used to match the first code and / or reverse code according to a preset fourth database to determine the vulnerability component, wherein the reverse code is generated based on the second file, and the first code is used to generate the second file; determine the attribute information of the vulnerability component according to the vulnerability component and the first file; and output prompt information based on the attribute information of the vulnerability component. In some embodiments, the above operations S910 to S930 may be performed, which will not be described in detail here.

[0136] Fig.11 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Fig.11 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0137] like Fig.11As shown, the electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 to a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include an onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0138] In RAM1103, various programs and data required for the operation of electronic device 1100 are stored. Processor 1101, ROM 1102 and RAM 1103 are connected to each other through bus 1104. Processor 1101 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1102 and / or RAM1103. It should be noted that the program can also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0139] According to an embodiment of the present disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to the bus 1104. The electronic device 1100 may further include one or more of the following components connected to the input / output (I / O) interface 1105: an input portion 1106 including a keyboard, a mouse, etc.; an output portion 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1108 including a hard disk, etc.; and a communication portion 1109 including a network interface card such as a LAN card, a modem, etc. The communication portion 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the input / output (I / O) interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage portion 1108 as needed.

[0140] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0141] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0142] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0143] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 1102 and / or the RAM 1103 described above and / or one or more memories other than the ROM 1102 and the RAM 1103 .

[0144] The embodiments of the present disclosure also include a computer program product, which includes a computer program, which contains program code for executing the method provided by the embodiments of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the file processing method provided by the embodiments of the present disclosure.

[0145] When the computer program is executed by the processor 1101, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0146] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1109, and / or installed from a removable medium 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0147] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0148] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0149] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A file processing method, comprising: In response to obtaining the first key, obtaining an encrypted first file, the first file including attribute information of each component corresponding to the second file, the second file being used to support the component to be in a working state; Based on the first key, the encrypted first file is at least partially decrypted, so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

2. According to the method of claim 1, obtaining the encrypted first file comprises: Obtaining a third file, the third file including attribute information of each component corresponding to the second file, wherein the third file and the second file are stored in the same storage module; The encrypted first file is generated according to the third file.

3. The method according to claim 1, further comprising: Obtaining attribute information of each component in the second file; Generate an attribute information file according to the attribute information; Encrypting the attribute information file based on a pre-generated second key to obtain an encrypted first file; A third file in the same format as the second file is generated according to the encrypted first file.

4. The method according to claim 3, further comprising: Determine a target attribute corresponding to the target attribute information; A first key corresponding to the target attribute is generated according to the target attribute and the second key, so that target attribute information corresponding to the target attribute in the first file can be decrypted based on the first key.

5. The method according to claim 3, wherein the second file is generated based on the first code, and the step of obtaining the attribute information of each component in the second file comprises: Splitting the first code to obtain multiple code blocks, where the code blocks correspond to the components one by one; According to a preset first database, the code blocks are matched to determine the attribute information of the component.

6. According to the method of claim 3, the step of obtaining the attribute information of each component in the second file comprises: Generate, according to the second file, a reverse code corresponding to the second file, wherein the reverse code includes address information associated with at least some components; Determining attribute information of at least part of the components according to a preset second database and the address information; According to a preset third database and the attribute information of at least part of the components, the attribute information of each component in the second file is determined.

7. The method according to claim 5, further comprising: Acquire a fourth file generated during the compilation of the first code, wherein the fourth file includes compilation information of each code block in the first code; The integrity of the first file is determined according to a comparison result between the fourth file and the first file.

8. The method according to claim 1, wherein the first file further comprises identification information, and the method further comprises: Obtaining an update request for the first file; Determining the update authority of the update request according to the update request and the identification information; When the update authority satisfies a first condition, the first file is updated.

9. The method according to claim 1, further comprising: According to a preset fourth database, matching the first code and / or the reverse code to determine the vulnerable component, wherein the reverse code is generated based on the second file, and the first code is used to generate the second file; Determining attribute information of the vulnerable component according to the vulnerable component and the first file; Based on the attribute information of the vulnerability component, prompt information is output.

10. A file processing device, comprising: an acquisition module, configured to obtain an encrypted first file in response to a target user inputting a first key, wherein the first file includes attribute information of each component corresponding to a second file, and the second file is used to support the component to be in a working state; as well as A decryption module is used to decrypt at least part of the encrypted first file based on the first key, so that the target attribute information corresponding to the first key in the first file is in a decrypted state.

Images