Security protection method, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the field of computer security, and discloses a security protection method, electronic equipment and a storage medium. The security protection method comprises the steps that whether an address first byte of a target API is a protection instruction or not is periodically detected, the target API comprises an API protected through a probe and / or HOOK in a sandbox, and the protection instruction comprises a jump instruction or a probe instruction; and re-performing corresponding protection operation on the target API of which the detected address first byte is not the protection instruction, wherein the protection operation comprises probe insertion and / or HOOK. The security of the sandbox is at least improved, so that the security of a system in which the sandbox is located is improved, and a zero-trust framework and a secure access service edge are conveniently realized.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer security, and in particular to a security protection method, electronic device and storage medium. Background Art

[0002] Secure Access Service Edge (SASE) is a service based on entity identity, real-time context, enterprise security / compliance policies, and continuous risk / trust assessment throughout the session. Among them, zero trust, as the core technical capability of the secure access service edge, will affect the implementation of the secure access service edge, and data security is an important part of the zero trust architecture, which will also affect the implementation of the secure access service edge.

[0003] At present, as a security mechanism for isolating applications or processes, sandbox technology has been widely used in various computer systems to ensure data security. Specifically, it creates an isolated and restricted environment (i.e., a "sandbox") in a computer system and runs applications or processes in this restricted environment to achieve secure isolation of sensitive data, thereby preventing the application or process from posing a potential threat to the system or other applications.

[0004] However, although the sandbox can provide security protection for computer systems, the security of the sandbox itself also faces severe challenges, which will also affect the security of the computer system, thereby affecting the implementation of the zero-trust framework and the implementation of the secure access service edge. Summary of the invention

[0005] The embodiments of the present application provide a security protection method, an electronic device, and a storage medium, which are at least beneficial to improving the security of the sandbox itself, thereby improving the security of the system where the sandbox is located, and facilitating the implementation of a zero-trust framework and a secure access service edge.

[0006] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a security protection method, comprising: periodically detecting whether the first byte of the address of the target API is a protection instruction, wherein the target API includes an API protected by a probe and / or HOOK in a sandbox, and the protection instruction includes a jump instruction or a probe instruction; re-performing corresponding protection operations on the target API whose detected first byte of the address is not the protection instruction, and the protection operation includes: inserting a probe and / or performing HOOK.

[0007] In some embodiments, the method also includes: monitoring process creation operations inside and outside the sandbox; when the process creation operation is monitored, obtaining the process name corresponding to the process creation operation; detecting whether it is a process created by a tool based on the process name; and when the process created by the tool is detected, ending the process created by the tool.

[0008] In some embodiments, the monitoring of process creation operations inside and outside the sandbox includes: after the sandbox is started, calling the sandbox driver to register a process creation callback message, wherein when the process creation operation occurs inside or outside the sandbox, the process creation callback message will be triggered, and the process creation callback message carries the identification information and / or process name of the process creation; obtaining the process name corresponding to the process creation operation includes: parsing the process creation callback message to obtain the process name corresponding to the process creation operation.

[0009] In some embodiments, the monitoring of process creation operations inside and outside the sandbox includes: after the sandbox is started, monitoring the process creation operations inside and outside the sandbox at the application layer; obtaining the process name corresponding to the process creation operation includes: at the application layer, injecting the target component into all processes inside and outside the sandbox, so as to obtain the process name from the process space of each process through the target component.

[0010] In some embodiments, the method further includes: periodically detecting all components under the sandbox directory based on the original components under the sandbox directory; if at least one of the original components is not detected under the sandbox directory, copying the undetected original component to the current sandbox directory.

[0011] In some embodiments, before the periodic detection of all components under the sandbox directory according to the original components under the sandbox directory, the method includes: when the installation package releases the sandbox component directory, reading the binary data and component information of all components under the directory, and encrypting the obtained binary data, wherein the component information includes at least one or a combination of the following information: the number of components, the offset position of each component, the component size, and the encryption method; writing the encrypted data and the component information into a file under the sandbox directory; the periodic detection of all components under the sandbox directory according to the original components under the sandbox directory includes: periodically obtaining the component information and binary data under the sandbox directory, encrypting the obtained binary data, and performing a consistency check with the encrypted data written in the sandbox directory and the component information corresponding to the encrypted data.

[0012] In some embodiments, the corresponding protection operation is re-performed on the target API whose first byte of the detected address is not the protection instruction, including: when it is detected that the target API whose first byte of the detected address is not the protection instruction has occurred for a preset number of times, the current process is terminated and the sandbox is exited; when it is detected that the target API whose first byte of the detected address is not the protection instruction has not exceeded a preset number of times, the corresponding protection operation is re-performed on the target API whose first byte of the detected address is not the protection instruction.

[0013] In some embodiments, the target API includes at least one or a combination of the following APIs: a file operation API, a registry operation API, and a process operation API; the method also includes at least one of the following operations: HOOKing the file operation API to hide the sandbox directory when an untrusted process calls it, block write operations on the sandbox file, and / or block reading and writing of the sandbox file; based on registry filter driver technology, monitor and block untrusted processes from calling the registry operation API; based on object filter driver technology, monitor and block untrusted processes from calling the process operation API.

[0014] According to some embodiments of the present application, the second aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security protection method as described in any one of the first aspect of the embodiments of the present application.

[0015] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the security protection method as described in any one of the first aspects of the embodiments of the present application.

[0016] The technical solution provided in the embodiments of the present application has at least the following advantages:

[0017] In the sandbox, the target API that has been protected by the probe and / or HOOK is periodically checked to determine whether the first byte of its address is a protective instruction such as a jump instruction or a probe instruction, so that it is possible to timely detect whether the probe and / or HOOK is eliminated, that is, to timely detect whether the protection of the target API fails. In the case that the protection of the target API fails, the protection of the sandbox can be restored in time by re-performing the corresponding protection operations, such as inserting a probe and / or performing a HOOK, thereby avoiding the hidden dangers caused by the failure of the sandbox protection and improving the security of the sandbox. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0019] Figure 1 This is the process of the security protection method provided in the embodiment of this application Figure 1 ;

[0020] Figure 2 This is the process of the security protection method provided in the embodiment of this application Figure 2 ;

[0021] Figure 3 This is the process of the security protection method provided in the embodiment of this application Figure 3 ;

[0022] Figure 4 This is the process of the security protection method provided in the embodiment of this application Figure 4 ;

[0023] Figure 5 This is the process of the security protection method provided in the embodiment of this application Figure 5 ;

[0024] Figure 6 This is the process of the security protection method provided in the embodiment of this application Figure 6 ;

[0025] Figure 7 It is a schematic diagram of a combination of multiple security protection methods provided in the embodiments of the present application;

[0026] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0028] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0029] On the one hand, the embodiments of the present application provide a security protection method, which is applicable to various electronic devices that use sandbox technology, such as devices based on Windows operating systems, devices based on Android operating systems, etc. It enhances the environmental security of the sandbox by providing a self-protection mechanism for the sandbox and enhancing the original self-protection mechanism of the sandbox, thereby achieving data security governance (X-Data Loss Prevention, XDLP) for the sandbox, thereby improving the data security isolation of the sandbox, and is more conducive to the realization of a zero-trust framework and secure access to the service edge. To facilitate the understanding of the above content, the following will be combined with Figures 1 to 7 Herein, Figures 1 to 6 They are respectively different flow charts of the security protection method provided in the embodiments of the present application, Figure 7 A schematic diagram of the parallel operation of the security protection method is provided for the embodiment of the present application.

[0030] It is understandable that file security, service security, and driver security are the foundation of sandbox security. If any one of them has problems, the sandbox security may be threatened. For example, if the important policy data files of the sandbox are arbitrarily read and tampered with, and the data flow channel is changed from closed to open, sensitive data may be leaked from the security domain to the personal domain; for example, if the registry information related to the service in the sandbox is deleted or tampered with, the sandbox service or driver is maliciously stopped or removed, etc. All of the above problems may cause data leakage in the sandbox, threatening the security of the sandbox.

[0031] Therefore, in some embodiments, in order to solve the above problems, a security protection method is provided, and its process is as follows: Figure 1 As shown, the following steps are included:

[0032] Step 101, hooking the file operation application programming interface (Application Programming Interface, API) to hide the sandbox directory when an untrusted process calls it, block the write operation to the sandbox file, and / or block the reading and writing of the sandbox file.

[0033] Step 102: Based on the registry filter driver technology, monitor and block the call of the untrusted process to the registry operation API.

[0034] Step 103: Based on the object filter driver technology, monitor and block the call of the process operation API by the untrusted process.

[0035] In this way, through HOOK technology, filter driver technology and other technologies, it is possible to timely monitor the untrusted process's operations on files, registries, processes and other objects in the sandbox and block them, thereby preventing the untrusted process from performing unsafe operations on the sandbox's files, registries, processes, etc., and ensuring the security of the files, registries and processes in the sandbox, thereby improving the security of the sandbox.

[0036] To facilitate better understanding of those skilled in the art Figure 1 The embodiments shown will be explained below.

[0037] In step 101, the file operation API is not limited. It is understandable that there are various file operation methods, such as file access, reading files, writing files, etc. Therefore, there may be multiple file operation APIs, such as one or more of the file access API, the file read operation API, the file write operation API, or any other API related to file operations, which will not be listed one by one here.

[0038] In addition, the core of hooking the file operation API is to jump to the corresponding policy when the corresponding API is called, so as to control the call of the API and prevent untrusted processes from destroying the security of the sandbox by calling the API. The embodiment of this application does not limit the policy of jump execution. Figure 1 The illustrated embodiments are merely examples. For example, in some embodiments, the executed policies may include: a hiding policy, a read-only policy, a reject policy, etc. Among them, for example, the hiding policy may be: when an untrusted process wants to access the sandbox directory, the sandbox directory is hidden from it so that it cannot see the sandbox directory. This can achieve unawareness and further improve the security of the sandbox directory. For another example, the read-only policy may be: untrusted processes are allowed to read files in the sandbox, but untrusted processes are not allowed to write data to the files, thereby ensuring the integrity of the sandbox files. For another example, the reject policy may be: untrusted processes are not allowed to read or write files in the sandbox. In this way, self-protection of sandbox files is achieved by setting corresponding policies.

[0039] It should be noted that the embodiments of the present application do not limit the strategies for specific applications, which can be set according to different security requirements, different equipment capabilities, etc., and will not be described in detail here.

[0040] It should also be noted that step 101 only uses the protection based on HOOK technology as an example. In some cases, protection can also be performed by means of probes. For example, the probe is inserted into the API that needs to be monitored. When the API is called, the probe will be triggered, and the corresponding control strategy will also be triggered. I will not go into details here.

[0041] In step 102, the registry operation API is not limited. It is understandable that there are many kinds of registry operations, such as registry deletion, registry addition, registry modification, and registry directory write operations. Therefore, the registry API may also have many different situations, such as including one or more of the registry deletion API, registry addition API, registry modification API, and registry directory write operation API, or any other API related to registry operations, which will not be listed here. Among them, since the sandbox service needs to be recorded in the registry, the operation of the registry may cause the uninstallation and tampering of the sandbox service. Therefore, in order to ensure the security of the sandbox service, it can be achieved by monitoring and controlling the registry operation, that is, blocking the call of the untrusted process to the registry operation API, wherein some calls can be blocked, for example, blocking the modification and deletion operations to ensure the original service, without blocking all calls, and all calls can be blocked, that is, all calls of the untrusted process are blocked to fully ensure the security of the sandbox and the security of the computer system. For example, by using registry filter driver technology, all registry operation APIs are monitored, but only operations such as modification and deletion of services by untrusted processes are blocked. In this way, some registry operation permissions can still be reserved for users, which is beneficial to ensuring user experience. Alternatively, by using registry filter driver technology, untrusted processes are prohibited from writing to sandbox-related registry directories to prevent important data from being tampered with. I will not go into details here.

[0042] Furthermore, this embodiment does not limit the process operation API. It is understandable that there are many different process operations, such as ending a process, debugging a process, and dumping a memory. Therefore, the process operation API may also exist in many different situations, such as including one or more of the ending process API, the process debugging API, and the memory dump API, or any other API related to API operation, etc., which will not be listed here. In this way, the object filter driver technology is used to prohibit untrusted processes from tampering with important processes in the sandbox, thereby ensuring the security of the sandbox process.

[0043] It should be noted that Figure 1 This is just an example of implementing protection through HOOK or probe. It is understandable that different computer systems may have different protection requirements. You can selectively decide whether to use protection for different objects according to specific needs, and decide which strategy to use for protection. For example, you can only protect the process, or you can also protect the sandbox data, or monitor and control the code (and / or process) from different sources, etc., which will not be described here one by one. In addition, Figure 1The execution order of the steps shown in the figure is also only an example. In some embodiments, steps 101 to 103 can be executed in a set order after the sandbox is started (or created, restarted, etc.), and it is not necessary to execute them in the same order. Figure 1 Execute in the order shown.

[0044] It can also be understood that the aforementioned embodiments provide security protection for sandbox files, processes, services, drivers, etc., but after analysis, it was found that with the upgrade of related tools or attack methods, the above protection has certain risks: by attacking the process of the sandbox security domain, it may be possible to bypass the protection provided by the above embodiments, such as using a cracking tool to attach to the process of the security domain, dumping the memory data of the process and debugging the process, thereby obtaining sensitive data and causing data leakage; or using security tools to restore the API of the sandbox hook component HOOK, etc.

[0045] Therefore, in some embodiments, in order to solve the above problems, a security protection method is provided, and its process is as follows: Figure 2 As shown, the following steps are included:

[0046] Step 201, periodically detect whether the first byte of the address of the target API is a protection instruction, wherein the target API includes an API protected by a probe and / or HOOK in a sandbox, and the protection instruction includes a jump instruction or a probe instruction.

[0047] Step 202: re-perform corresponding protection operation on the target API whose first byte of the detected address is not a protection instruction. The protection operation includes: inserting a probe and / or performing HOOK.

[0048] That is to say, in the sandbox, the target API that has been protected by the probe and / or HOOK is periodically checked to determine whether the first byte of its address is a protective instruction such as a jump instruction or a probe instruction, so that it is possible to timely detect whether the probe and / or HOOK is eliminated, that is, to timely detect whether the protection of the target API fails. Therefore, when the protection of the target API fails, the protection of the sandbox can be restored in time by re-performing the corresponding protection operations, such as inserting a probe and / or performing a HOOK, thereby avoiding the hidden dangers caused by the failure of the sandbox protection and improving the security of the sandbox.

[0049] To facilitate better understanding of those skilled in the art Figure 2 The embodiments shown will be explained below.

[0050] In step 201, the detection period is not limited, and can be set according to user habits, equipment safety requirements, power consumption requirements, safety requirements, etc.

[0051] Furthermore, it is understandable that when protecting the API, it can be implemented based on HOOK technology, probes, or other methods. However, no matter which protection method is used, the key point is that when the API is called, the corresponding protection instruction will be executed first. Otherwise, the corresponding operation may be executed without having time to adopt blocking and other operations. Therefore, it is possible to detect whether the protection is implemented by detecting the first byte of the address of the protected API. At the same time, since there may be a variety of different protection methods, there may be a variety of protection instructions. For example, when the HOOK technology is used for protection, the protection instruction is a jump instruction, that is, 0xe9. When the probe technology is used for protection, the protection instruction is a probe instruction. Of course, when other methods are used for protection, the protection instructions are also different. The embodiments of the present application do not limit this, and they will not be listed here one by one.

[0052] It should be noted that this embodiment does not limit the target API, which can be any protected API in the sandbox. For example, the target API can be one or more of the file operation API, registry operation API, process operation API involved in the aforementioned embodiments, or other APIs protected by policies or other methods, etc., which will not be listed one by one here.

[0053] In step 202, the first byte of the address is not the target API of the protection instruction, which means that the corresponding protection operation can no longer be executed, and protection can no longer be performed normally. Therefore, the corresponding protection operation is performed again at this time to achieve protection recovery, avoid security risks caused by protection failure, and improve the security of the sandbox.

[0054] Based on the above embodiments, it is understandable that the sandbox may continue to be attacked. At this time, the sandbox may continuously detect that the protection fails. The risk of continuing to run is very high, and it is easy to have protection loopholes and security issues. Moreover, although the protection can be restored by re-protecting at this time, it will switch between failure and recovery, and it will not be able to run normally, which affects the efficiency of the sandbox operation and the user experience is also poor. Therefore, you can consider exiting the sandbox to ensure the safety of the sandbox.

[0055] Therefore, in some embodiments, a security protection method is provided, the process of which is as follows: Figure 3 As shown, the following steps are included:

[0056] Step 301, periodically checking whether the first byte of the address of the target API is a protection instruction, wherein the target API includes an API protected by a probe and / or HOOK in the sandbox, and the protection instruction includes a jump instruction or a probe instruction.

[0057] Step 302, when it is detected that the first byte of the address is not the target API of the protection instruction for a preset number of times, the current process is terminated and the sandbox is exited.

[0058] Step 303 , when the number of times the target API whose first byte of the address is not a protection instruction is detected does not exceed a preset number, the corresponding protection operation is re-performed on the target API whose first byte of the address is not a protection instruction.

[0059] In other words, by setting a preset number of times, the number of recovery protections can be limited to avoid excessive recovery times that affect user experience, and to avoid hidden dangers caused by continued operation under high-risk conditions.

[0060] It should be noted that Figure 2 and Figure 3 The embodiments shown are only examples of core steps provided for ease of understanding, and may also be implemented in combination with other technical means. For example, in some embodiments, when the probe is successfully inserted or the HOOK is successfully performed, the name of the API of the probe insertion or the HOOK, the address of the inserted probe or the HOOK, the dynamic link library (DLL) of the HOOK, etc. may be recorded, so that when the protection needs to be restored, the HOOK or probe that needs to be restored and its insertion position and insertion method may be determined more efficiently and accurately based on the above recorded information, and will not be described one by one here.

[0061] It should also be noted that Figure 2 and Figure 3 In the illustrated embodiment, when the target API is protected by inserting a probe, the corresponding protection is re-performed, i.e., the probe is re-inserted; when the target API is protected by HOOK, the corresponding protection is re-performed, i.e., the HOOK is re-performed.

[0062] It can also be understood that the recovery of protection is a security protection solution after the attack is completed. In order to better maintain the sandbox environment, it is also possible to prevent attacks in advance, while alleviating the pressure of protection recovery processing, and solving problems such as environmental collapse caused by multiple protection failures. To this end, in some embodiments, a security protection method is provided, and its process is as follows: Figure 4 As shown, the following steps are included:

[0063] Step 401, monitor the process creation operations inside and outside the sandbox.

[0064] Step 402: When a process creation operation is monitored, obtain a process name corresponding to the process creation operation.

[0065] Step 403: Detect whether the process is created by the tool according to the process name.

[0066] Step 404: when a process created by the tool is detected, terminate the process created by the tool.

[0067] The processes inside and outside the sandbox refer to the processes in the sandbox and the processes of the system (or device) where the sandbox is located.

[0068] In this way, by monitoring the creation of all processes inside and outside the sandbox, it is possible to promptly discover and block processes created by debugging, attacking and other tools that may pose security risks, thereby avoiding security issues caused by the tools by blocking the tools, ensuring the security of the sandbox process, and improving the security of the sandbox. In addition, by monitoring the creation operation rather than the operation while the process is running, it is possible to block the process before it causes harm, preventing it from bypassing related API calls to undermine the security of the sandbox, thereby further improving the security of the sandbox.

[0069] It should be noted that since the creation of a process involves multiple aspects, such as drivers, application layers, etc., the monitoring of the creation of a process can be implemented from different aspects, and this embodiment does not limit this. For example, in some embodiments, monitoring the process creation operation inside and outside the sandbox can be implemented in the following manner: after the sandbox is started, the sandbox driver is called to register a process creation callback message, wherein when a process creation operation occurs inside and outside the sandbox, a process creation callback message will be triggered, and the process creation callback message carries the identification information and / or process name of the process creation. Correspondingly, obtaining the process name corresponding to the process creation operation can be implemented in the following manner: parsing the process creation callback message to obtain the process name corresponding to the process creation operation. Alternatively, in some embodiments, monitoring the process creation operation inside and outside the sandbox can be implemented in the following manner: after the sandbox is started, the process creation operation inside and outside the sandbox is monitored at the application layer. Correspondingly, obtaining the process name corresponding to the process creation operation can be implemented in the following manner: at the application layer, the target component is injected into all processes inside and outside the sandbox to obtain the process name from the process space of each process through the target component. Of course, the above two methods can also be combined to monitor more comprehensively and accurately and achieve more timely processing. That is, when the sandbox environment is started, the sandbox driver will first register the process creation callback message. When the process is created, the callback message of the process creation will be obtained. This message can obtain the id and process name of the process creation. When the callback message comes, it is determined whether the created process name is the name of the detection tool. If so, the return value of the process creation will be tampered to prohibit the process creation. When it is detected that the debugging and attack tools are opened outside the sandbox, the sandbox will pop up an alarm window to remind and end the debugging and attack tool process. After the application layer uses the component to inject into the target process, it obtains the process name of the target process in the target process space, determines whether the target process is the name of the debugging tool, and if so, it will immediately end itself and notify the sandbox to exit. Of course, the above is only an exemplary description of the implementation method of process creation monitoring. In other embodiments, other methods can also be used to implement it, which will not be repeated here.

[0070] It is also understandable that in addition to the above-mentioned situations that may cause sandbox security risks, there are other possible situations that may also cause sandbox security risks. For example, when sandbox components are deleted, renamed, or replaced with malicious components, the functions provided by the sandbox will fail, which may also lead to data leakage.

[0071] Therefore, in some embodiments, in order to solve the above problems, a security protection method is provided, and its process is as follows: Figure 5 As shown, the following steps are included:

[0072] Step 501, periodically detect all components under the sandbox directory based on the original components under the sandbox directory.

[0073] Step 502: When at least one original component is not detected in the sandbox directory, copy the undetected original component to the current sandbox directory.

[0074] That is to say, by detecting and copying the original components of the sandbox, the original components of the sandbox can always remain intact, that is, integrity detection and recovery are performed. This avoids the security risks of the sandbox caused by the lack of some components and improves the security of the sandbox.

[0075] It should be noted that this embodiment does not limit the implementation method of the original component. In order to complete the detection more efficiently, it can perform concise and efficient detection on the original component. For example, it can compare the name, operating parameters and other information of the original component with the current component. In order to perform the detection more accurately, it can also compare all the information of the original component one by one, such as the binary data of the component. Various implementation methods of the detection will not be listed here one by one.

[0076] To facilitate better understanding of those skilled in the art Figure 5 The embodiment shown is further described below.

[0077] In some embodiments, Figure 6 As shown, before periodically detecting all components in the sandbox directory according to the original components in the sandbox directory, the security protection method further includes the following steps:

[0078] Step 603, when the installation package releases the sandbox component directory, read the binary data and component information of all components under the directory, and encrypt the obtained binary data, wherein the component information includes at least one or a combination of the following information: the number of components, the offset position of each component, the component size, and the encryption method.

[0079] Step 604: write the encrypted data and the component information into a file under the sandbox directory.

[0080] Correspondingly, periodically checking all components under the sandbox directory based on the original components under the sandbox directory can be achieved through the following steps: periodically obtaining the component information and binary data under the sandbox directory, encrypting the obtained binary data to perform consistency check with the encrypted data written in the sandbox directory and the component information corresponding to the encrypted data.

[0081] Specifically, in some examples, Figure 6The illustrated embodiment can be implemented in the following manner: when the installation package releases the sandbox component directory, the binary data of all components are read in sequence and the content of the data is encrypted, and then the encrypted content is written to a file in the sandbox directory. This file records how many components there are in the current sandbox directory, where the offset position of each component is, the component size, the encryption method of the data, etc. After the file record is completed, the sandbox driver will start a thread, regularly detect all components in the sandbox directory, and obtain the name and file size of the corresponding component and the last modification time of the file. After recording this information, the sandbox driver will detect the consistency of all components in the original file with the components in the sandbox directory, such as detecting whether the component name in the original file exists in the sandbox directory. If it exists, then detect whether the file MD5 result of the original component is consistent with the MD5 result of the component in the sandbox directory. If it is consistent, it is considered that the file has not been replaced, and if it is inconsistent, it is considered that the file has been replaced. At this time, the sandbox driver will copy a copy of the component of the original file to the sandbox directory. If it does not exist, it will be considered that the file has been renamed or deleted, and a copy will be directly copied to the sandbox directory. This mechanism can effectively ensure the consistency of components. MD5 is only an exemplary description of encryption, and other encryption methods can also be used, such as SHA1, etc., which will not be listed here one by one.

[0082] Of course, the above is only an exemplary description of the implementation method of component integrity detection and recovery. As mentioned above, other methods can also be used in other embodiments, which will not be described in detail here.

[0083] It can also be understood that the various protection schemes provided in the above embodiments can be applied simultaneously during the operation of the sandbox. In this way, the sandbox can be protected from multiple aspects, thereby preventing the occurrence of problems such as data leakage in the sandbox to the greatest extent, achieving data security management of the sandbox, and ensuring the security of the sandbox. For example, in some embodiments, the functions of monitoring and protecting files, processes, services, registries, failure detection and recovery, tool detection, and component integrity detection and recovery provided in the above different embodiments can be encapsulated into different modules. In this way, after starting the sandbox service and driver, Figure 7 As shown, different modules are also started and run in parallel to monitor and protect files, processes, services, registries, failure detection and recovery, tool detection, and component integrity detection and recovery, thereby achieving all-round protection for the sandbox and avoiding security risks caused by various situations. This greatly improves the security of the sandbox itself, thereby improving the security of the computer system by improving the security of the sandbox.

[0084] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0085] A second aspect of the present application also provides an electronic device, such as Figure 8 As shown, it includes: at least one processor 801; and a memory 802 that is communicatively connected to the at least one processor 801; wherein the memory 802 stores instructions that can be executed by the at least one processor 801, and the instructions are executed by the at least one processor 801 so that the at least one processor 801 can execute the security protection method described in any of the above method embodiments.

[0086] The memory 802 and the processor 801 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 801 and the memory 802 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 801 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 801.

[0087] The processor 801 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 802 can be used to store data used by the processor 801 when performing operations.

[0088] It is not difficult to find that this embodiment is a device embodiment corresponding to the method embodiment, and this embodiment can be implemented in conjunction with the method embodiment. The relevant technical details mentioned in the method embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the method embodiment.

[0089] The third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0090] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0091] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A safety protection method, characterized in that: include: Periodically detecting whether the first byte of the address of the target API is a protection instruction, wherein the target API includes an API protected by a probe and / or a HOOK in the sandbox, and the protection instruction includes a jump instruction or a probe instruction; Re-perform corresponding protection operation on the target API whose first byte of the detected address is not the protection instruction, and the protection operation includes: inserting a probe and / or performing HOOK.

2. The safety protection method according to claim 1, characterized in that: The method further comprises: Monitor process creation operations inside and outside the sandbox; When the process creation operation is monitored, obtaining a process name corresponding to the process creation operation; Detecting whether the process is created by the tool according to the process name; When a process created by the tool is detected, the process created by the tool is terminated.

3. The safety protection method according to claim 2, characterized in that: The monitoring of process creation operations inside and outside the sandbox includes: After the sandbox is started, the sandbox driver is called to register a process creation callback message, wherein when the process creation operation occurs inside or outside the sandbox, the process creation callback message will be triggered, and the process creation callback message carries the identification information of the process creation and / or the process name; The obtaining the process name corresponding to the process creation operation includes: Parse the process creation callback message to obtain a process name corresponding to the process creation operation.

4. The safety protection method according to claim 2, characterized in that: The monitoring of process creation operations inside and outside the sandbox includes: After the sandbox is started, monitoring the process creation operations inside and outside the sandbox at the application layer; The obtaining the process name corresponding to the process creation operation includes: At the application layer, the target component is injected into all processes inside and outside the sandbox, so as to obtain the process name from the process space of each process through the target component.

5. The safety protection method according to any one of claims 1 to 4, characterized in that: The method further comprises: Periodically test all components in the sandbox directory based on the original components in the sandbox directory; In the case that at least one of the original components is not detected in the sandbox directory, the undetected original component is copied to the current sandbox directory.

6. The safety protection method according to claim 5, characterized in that: Before periodically detecting all components under the sandbox directory according to the original components under the sandbox directory, the method includes: When the installation package releases the sandbox component directory, the binary data and component information of all components in the directory are read, and the obtained binary data is encrypted, wherein the component information includes at least one or a combination of the following information: the number of components, the offset position of each component, the component size, and the encryption method; Writing the encrypted data and the component information into a file in the sandbox directory; The periodic detection of all components in the sandbox directory according to the original components in the sandbox directory includes: The component information and binary data in the sandbox directory are periodically obtained, and the obtained binary data is encrypted to perform consistency check with the encrypted data written in the sandbox directory and the component information corresponding to the encrypted data.

7. The safety protection method according to any one of claims 1 to 4, characterized in that: The re-performing a corresponding protection operation on the target API whose first byte of the detected address is not the protection instruction comprises: When it is detected that the target API whose first byte of the address is not the protection instruction has occurred for a preset number of times, the current process is terminated and the sandbox is exited; When the number of times of detecting that the target API whose first byte of the address is not the protection instruction does not exceed the preset number, the corresponding protection operation is re-performed on the target API whose first byte of the address is not the protection instruction.

8. The safety protection method according to any one of claims 1 to 4, characterized in that: The target API includes at least one or a combination of the following APIs: a file operation API, a registry operation API, and a process operation API; The method further comprises at least one of the following operations: Hooking the file operation API to hide the sandbox directory, block write operations on sandbox files, and / or block read and write operations on sandbox files when the untrusted process calls the API; Based on the registry filter driver technology, monitor and block the call of the registry operation API by the untrusted process; Based on the object filter driver technology, the call of the process operation API by the untrusted process is monitored and blocked.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the security protection method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the security protection method according to any one of claims 1 to 8 is implemented.

Images