File access method and electronic equipment

Abstract

The embodiment of the invention provides a file access method and electronic equipment, and the method comprises the steps: receiving process information of an application process sent by a kernel, the kernel being used for suspending the application process when monitoring the application process; according to the process information, calculating an actual metric value of a program file corresponding to the application process and an actual metric value of a target file needing to be accessed by the application process, and obtaining a judgment result according to the actual metric value of the program file and the actual metric value of the target file; the judgment result comprises allowing the application process to access the target file or not allowing the application process to access the target file; and sending the judgment result to the kernel to enable the kernel to wake up the application process, and releasing or intercepting the application process. According to the scheme, the security and reliability of file access can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a file access method and an electronic device. Background Art

[0002] In current file access scenarios, authentication is generally performed on the access end to effectively prevent the impact of illegal access on the file access system. For example, through trusted boot technology, the system can verify the integrity and authenticity of the application process to prevent malware from affecting the security of the system. Trusted boot usually involves the cooperation of hardware and software, including the use of secure boot boot program, digital signature verification, secure boot chip and other technical means.

[0003] In the above scheme, when the file requested by the access terminal is a malicious file, such as a tampered file, it is impossible to effectively prevent the access terminal from accessing the malicious file. After the access terminal accesses the malicious file, it may affect the normal operation of the access terminal, resulting in low security and reliability of file access. Summary of the invention

[0004] The embodiments of the present application provide a file access method and an electronic device, which can improve the security and reliability of file access.

[0005] In a first aspect, an embodiment of the present application provides a file access method, the method comprising:

[0006] receiving process information of a suspended application process sent by the kernel, wherein the application process is used to access a target file, and the process information includes a file path of the target file;

[0007] Calculating an actual measurement value of the target file according to the process information;

[0008] Obtaining an original measurement value of the target file from a trusted module;

[0009] The actual measurement value is compared with the original measurement value, and a decision result is sent to the kernel, so that the kernel wakes up the application process and allows or denies the application process to access the target file.

[0010] In the above scheme, based on the actual measurement value of the target file, it is possible to determine whether the target file requested by the application process is credible, thereby determining whether the file access event is credible, and intercepting the file access event when it is untrustworthy through the kernel, which can effectively improve the security of file access and the reliability of the system.

[0011] In a possible implementation, comparing the actual measurement value of the target file with the original measurement value of the target file specifically includes:

[0012] When the actual measurement value of the target file is the same as the original measurement value of the target file, sending a first ruling result to the kernel so that the kernel allows the application process to access the target file;

[0013] When the actual metric value of the target file is different from the original metric value of the target file, a second ruling result is sent to the kernel, so that the kernel denies the application process from accessing the target file.

[0014] In the above scheme, when the actual measurement value of the target file is the same as the original measurement value, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, and the target file has not been tampered with. It can be considered that the target file is credible, and a first judgment result is sent to the kernel so that the kernel allows the application process to access the target file; when the actual measurement value is different from the original measurement value, it indicates that the target file has been tampered with, and the target file can be considered untrustworthy, and a second judgment result is sent to the kernel so that the kernel denies the application process access to the target file.

[0015] In a possible implementation, before receiving the process information of the application process sent by the kernel, the method includes:

[0016] Setting a hook function so that when the kernel detects that an application process calls a file access interface, the kernel suspends the application process and returns the process information of the application process;

[0017] Then the comparing the actual measurement value of the target file with the original measurement value of the target file and sending the decision result to the kernel so that the kernel allows or denies the application process to access the target file includes:

[0018] The actual measurement value of the target file is compared with the original measurement value of the target file, a decision result is sent to the kernel, and the application process is awakened, so that the kernel allows or denies the application process to access the target file.

[0019] In the above scheme, by setting a hook function, when the kernel detects that an application process accesses a target file, the application process is suspended until the trust measurement of the target file is completed, and then the application process is awakened according to the returned judgment result, and the application process is allowed or denied to access the target file, thereby effectively preventing untrustworthy malicious files from affecting the security of the application process and the system.

[0020] In a possible implementation, the process information includes a process identifier of the application process, and the comparing the actual measurement value of the target file with the original measurement value of the target file and sending a decision result to the kernel so that the kernel allows or denies the application process to access the target file specifically includes:

[0021] The actual measurement value of the target file is compared with the original measurement value of the target file, and a decision result is sent to the kernel so that the kernel allows or denies the application process corresponding to the process identifier to access the target file, wherein the decision result includes the process identifier.

[0022] In the above scheme, the process information of different processes can be received, and then the access results can be fed back respectively according to the process identifiers, thereby allowing multiple processes to access different target files and improving the efficiency of file access.

[0023] In a second aspect, an embodiment of the present application provides a file access method, the method comprising:

[0024] receiving process information of an application process sent by the kernel, wherein the application process is used to access a target file, and the process information includes a file path of the target file;

[0025] Calculating an actual measurement value of the target file according to the process information;

[0026] Reading a configuration file, wherein the configuration file includes a trusted module storage function identifier of the target file;

[0027] Acquire the original measurement value of the target file according to the trusted module storage function identifier;

[0028] The actual measurement value of the target file is compared with the original measurement value of the target file, and a decision result is sent to the kernel, so that the kernel allows or denies the application process to access the target file.

[0029] In the above scheme, based on the trusted module storage function identifier in the configuration file, the storage location of the original measurement value of the target file can be flexibly configured, and based on the actual measurement value and the original measurement value of the target file, it is judged whether the target file requested to be accessed by the application process is trustworthy, thereby comprehensively judging whether the file access event is trustworthy, accurately measuring the trustworthiness of the file access event, and intercepting the file access event through the kernel when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0030] In a possible implementation, the method includes:

[0031] When starting, a configuration file is loaded, wherein the configuration file includes configuration information of at least one file, wherein the configuration information includes a file path and a trusted module storage function identifier, wherein the trusted module storage function identifier is used to indicate a storage location of an original measurement value of the file, and the target file is one of the at least one file;

[0032] When the trusted module storage function identifier indicates that the storage location is a trusted module, storing the original measurement value of the file in the trusted module;

[0033] When the trusted module storage function identifier does not indicate that the storage location is a trusted module, the original measurement value of the file is stored in the configuration file.

[0034] In the above scheme, by setting the configuration file, you can choose to save the original measurement value of the target file in a trusted module or configuration file, which improves the flexibility of the configuration and avoids the situation where the trusted module is limited in space and cannot store the original measurement values ​​of all target files. Therefore, based on the actual measurement value of the target file, it is possible to judge whether the target file requested by the application process to access is trustworthy, accurately perform trust measurement on file access events, and effectively improve the security of file access and the reliability of the system.

[0035] In a possible implementation, comparing the actual measurement value of the target file with the original measurement value of the target file specifically includes:

[0036] When the actual measurement value of the target file is the same as the original measurement value of the target file, sending a first ruling result to the kernel so that the kernel allows the application process to access the target file;

[0037] When the actual metric value of the target file is different from the original metric value of the target file, a second ruling result is sent to the kernel, so that the kernel denies the application process from accessing the target file.

[0038] In the above scheme, when the actual measurement value of the target file is the same as the original measurement value, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, and the target file has not been tampered with. It can be considered that the target file is credible, and a first judgment result is sent to the kernel so that the kernel allows the application process to access the target file; when the actual measurement value is different from the original measurement value, it indicates that the target file has been tampered with, and the target file can be considered untrustworthy, and a second judgment result is sent to the kernel so that the kernel denies the application process access to the target file.

[0039] In a possible implementation, before receiving the process information of the application process sent by the kernel, the method includes:

[0040] Setting a hook function so that when the kernel detects that an application process calls a file access interface, the kernel suspends the application process and returns the process information of the application process;

[0041] Then the comparing the actual measurement value of the target file with the original measurement value of the target file and sending the decision result to the kernel so that the kernel allows or denies the application process to access the target file includes:

[0042] The actual measurement value of the target file is compared with the original measurement value of the target file, a decision result is sent to the kernel, and the application process is awakened, so that the kernel allows or denies the application process to access the target file.

[0043] In the above scheme, by setting a hook function, when the kernel detects that an application process accesses a target file, the application process is suspended until the trust measurement of the target file is completed, and then the application process is awakened according to the returned judgment result, and the application process is allowed or denied to access the target file, thereby effectively preventing untrustworthy malicious files from affecting the security of the application process and the system.

[0044] In a possible implementation, the method further includes:

[0045] The configuration information also includes a file backup path;

[0046] When the actual measurement value is different from the original measurement value, the backup file in the file backup path is used to overwrite the file in the file path.

[0047] In the above solution, the backup file is used to automatically restore the program file and / or the target file when it is tampered with, which can effectively improve the security of the system and the efficiency of file access.

[0048] In a possible implementation, the method further includes:

[0049] The configuration information also includes a file recovery function identifier;

[0050] When the file recovery function flag indicates that it is turned on, when the actual measurement value is different from the original measurement value, the backup file in the file backup path is used to overwrite the file in the file path.

[0051] In the above solution, based on the file recovery function identifier, it is possible to flexibly choose to use the backup file to automatically recover or not automatically recover when the program file and / or the target file is tampered with.

[0052] In a possible implementation, the configuration file further includes a trusted module storage function identifier of a program file corresponding to the application process, and the method further includes:

[0053] Calculating an actual measurement value of the program file according to the process information;

[0054] Acquiring an original measurement value of the program file according to a trusted module storage function identifier of the program file;

[0055] Then, comparing the actual measurement value of the target file with the original measurement value of the target file and sending a decision result to the kernel so that the kernel allows or denies the application process to access the target file specifically includes:

[0056] When the actual measurement value of the target file is the same as the original measurement value of the target file, and the actual measurement value of the program file is the same as the original measurement value of the program file, sending a first ruling result to the kernel so that the kernel allows the application process to access the target file;

[0057] When the actual metric value of the target file is different from the original metric value of the target file, or the actual metric value of the program file is different from the original metric value of the program file, a second ruling result is sent to the kernel so that the kernel denies the application process access to the target file.

[0058] In the above scheme, based on the actual measurement value of the program file and the actual measurement value of the target file, it is possible to determine whether the application corresponding to the application process is trustworthy and whether the target file is trustworthy, thereby comprehensively determining whether the file access event is trustworthy. The file access event can be accurately measured for trustworthiness, and the kernel can intercept the file access event when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0059] In a possible implementation, the process information includes a process identifier of the application process, and the comparing the actual measurement value of the target file with the original measurement value of the target file and sending a decision result to the kernel so that the kernel allows or denies the application process to access the target file specifically includes:

[0060] The actual measurement value of the target file is compared with the original measurement value of the target file, and a decision result is sent to the kernel so that the kernel allows or denies the application process corresponding to the process identifier to access the target file, wherein the decision result includes the process identifier.

[0061] In the above scheme, the process information of different processes can be received, and then the access results can be fed back respectively according to the process identifiers, thereby allowing multiple processes to access different target files and improving the efficiency of file access.

[0062] In a third aspect, an embodiment of the present application provides a file access method, which is applied to a kernel, and the method includes:

[0063] When it is detected that an application process calls a file access interface, the application process is suspended and process information of the application process is sent, wherein the application process is used to access a target file, and the process information includes a file path of the target file; an actual measurement value of the target file is calculated according to the process information to obtain a decision result;

[0064] According to the decision result, the application process is awakened, and the application process is released or blocked.

[0065] In the above scheme, the kernel will suspend the monitored application process, send the process information of the application process, determine whether the application process is trustworthy, wake up the application process according to the determination result, and execute release or interception, which can effectively prevent malicious files from affecting the security of the application process and the system.

[0066] In a fourth aspect, an embodiment of the present application provides an electronic device, the electronic device comprising: a monitoring process, an application process and a kernel;

[0067] The kernel is used to suspend the application process when detecting that an application process calls a file access interface, and send process information of the application process to the monitoring process; the application process is used to access a target file, and the process information includes a file path of the target file;

[0068] The monitoring process is used to calculate the actual measurement value of the target file according to the process information; read a configuration file, the configuration file including a trusted module storage function identifier of the target file; obtain the original measurement value of the target file according to the trusted module storage function identifier; compare the actual measurement value of the target file with the original measurement value of the target file, and send a decision result to the kernel;

[0069] The kernel is also used to allow or deny the application process to access the target file according to the decision result. In the above scheme, the kernel suspends the monitored application process and sends the process information of the application process to the monitoring process. The monitoring process can determine whether the target file accessed by the application process is credible based on the actual measurement value of the target file, thereby determining whether the file access event is credible and accurately measuring the credibility of the file access event. The kernel wakes up the application process according to the decision result and executes release or interception, which can effectively prevent malicious files from affecting the security of the application process and the system.

[0070] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory and a trusted module communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method described above.

[0071] In the above scheme, the storage location of the original measurement value of the target file can be determined according to the trusted module storage function identifier in the configuration file, so as to obtain the original measurement value of the target file, and based on the actual measurement value and the original measurement value of the target file, it is judged whether the target file requested to be accessed by the application process is trustworthy, thereby comprehensively judging whether the file access event is trustworthy, accurately measuring the trustworthiness of the file access event, and intercepting the file access event through the kernel when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0072] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method as described above.

[0073] In the above scheme, the storage location of the original measurement value of the target file can be determined according to the trusted module storage function identifier in the configuration file, so as to obtain the original measurement value of the target file, and based on the actual measurement value and the original measurement value of the target file, it is judged whether the target file requested to be accessed by the application process is trustworthy, thereby comprehensively judging whether the file access event is trustworthy, accurately measuring the trustworthiness of the file access event, and intercepting the file access event through the kernel when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0074] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described above when the computer program is executed by a processor.

[0075] In the above scheme, the storage location of the original measurement value of the target file can be determined according to the trusted module storage function identifier in the configuration file, so as to obtain the original measurement value of the target file, and based on the actual measurement value and the original measurement value of the target file, it is judged whether the target file requested to be accessed by the application process is trustworthy, thereby comprehensively judging whether the file access event is trustworthy, accurately measuring the trustworthiness of the file access event, and intercepting the file access event through the kernel when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0077] Figure 1 A schematic diagram of the architecture of an electronic device provided in an embodiment of the present application;

[0078] Figure 2A flowchart of a file access method provided in an embodiment of the present application;

[0079] Figure 3 A flowchart of another file access method provided in an embodiment of the present application;

[0080] Figure 4 A flowchart of another file access method provided in an embodiment of the present application;

[0081] Figure 5 A flowchart of another file access method provided in an embodiment of the present application;

[0082] Figure 6 A flowchart of another file access method provided in an embodiment of the present application;

[0083] Figure 7 A schematic diagram of the structure of another electronic device provided in an embodiment of the present application.

[0084] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0085] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations that match the present application. Instead, they are merely examples of devices and methods that match some aspects of the present application as detailed in the appended claims.

[0086] First, the nouns designed in this application are explained:

[0087] Trusted Computing: A technical solution for ensuring the trustworthiness and security of computer systems. Through the combination of hardware and software, a trusted computing environment is established to protect computers and data from malware, attacks, and unauthorized access.

[0088] Trusted Measurement: is a process of evaluating the trustworthiness of a computer system by measuring and verifying system configuration, software, and firmware to determine whether the system is in the expected security state. Trusted Measurement can help detect changes in system configuration and potential malware intrusions.

[0089] Trusted Recovery: refers to restoring the integrity and availability of a system or data through trusted mechanisms and processes when the system or data is accidentally damaged or lost. Trusted recovery is one of the important means to ensure the trustworthiness of systems and data.

[0090] Process: refers to a program in a computer running on a certain data set. It is the basic unit for resource allocation in the system and the foundation of the operating system structure. In the early computer structure designed for processes, the process is the basic execution entity of the program; in the contemporary computer structure designed for threads, the process is the container of threads. A program is a description of instructions, data and their organizational form, and a process is the entity of the program.

[0091] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0092] The technical solutions of the present application and the technical solutions of the present application are described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. In the description of the present application, unless otherwise clearly specified and limited, each term should be understood in a broad sense in the art. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0093] Figure 1 This is a diagram of the architecture of an electronic device provided in an embodiment of the present application. Figure 1 As shown, the architecture of the electronic device 100 may include a user space, a kernel space, and hardware, the user space of the electronic device 100 runs an application process 10 and a monitoring process 11, the kernel space of the electronic device 100 includes a kernel (Central Processing Unit Core) 12, and the hardware of the electronic device 100 includes a memory. The application process 10 may be a process for an application to access a target file 13 in the memory of the electronic device 100.

[0094] Optionally, the memory may also store a binary program file 14 of the application 10. In a possible implementation, the program file 14 may include a static file linked to the application.

[0095] The kernel 12 may provide a service interface, and the application process 10 may call a system call function for file access through the service interface to access the target file 13 .

[0096] The monitoring process 11 can be used to perform a trustworthiness measurement on the application process 10 and the target file 13 .

[0097] The kernel 12 can monitor whether the system call function for file access is called, monitor whether the application process 10 accesses the target file 13, and when the existence of the application process 10 is detected, suspend the application process 10 and send the process information of the application process 10 to the monitoring process 11, wherein accessing the target file 13 may include reading, writing and / or changing the application file 13; the monitoring process 11 calculates the actual measurement value of the target file 13 according to the process information, and thereby determines whether the file access event is credible based on the actual measurement value of the target file 13, obtains the determination result, and sends the determination result to the kernel 12; the kernel 12 wakes up the application process 10 according to the determination result, and releases or intercepts the application process 10.

[0098] Optionally, the monitoring process 11 can also calculate the actual measurement value of the target file 13 and the actual measurement value of the program file 14 according to the process information, and thus determine whether the file access event is credible based on the actual measurement value of the target file 13 and the actual measurement value of the program file 14 to obtain a determination result.

[0099] In one possible implementation, the monitoring process 11 determines whether the file access event is trustworthy based on the actual measurement value of the target file 13 and the actual measurement value of the program file 14, which may include obtaining the reference measurement value of the target file 13 and the reference measurement value of the program file 14 from the trusted module 15, and determining whether the actual measurement value of the target file 13 matches the reference measurement value of the target file 13 and whether the actual measurement value of the program file 14 matches the reference measurement value of the program file 14. If both match, the determination result is that the application process 10 is allowed to access the target file 13; otherwise, the determination result is that the application process 10 is not allowed to access the target file 13.

[0100] The reference measurement value of the file is calculated based on the original file content corresponding to the file, and the actual measurement value of the file is calculated based on the current content of the file. It can be understood that by judging whether the reference measurement value of the file matches the actual measurement value of the current file, it can be judged whether the current file has been tampered with compared to the original file. When the current file has been tampered with, it can be considered that the file is unreliable. The trusted module 15 can be used to store the reference measurement values ​​of some files.

[0101] Exemplarily, the hardware of the electronic device 100 may also include a trusted module 15, which may be installed in the form of a chip on the motherboard of the electronic device 100. The trusted module 15 includes but is not limited to a trusted platform module (TPM), a trusted cryptography module (TCM), and a trusted platform control module (TPCM), etc. The monitoring process 11 may obtain the reference measurement value of the target file 13 and the reference measurement value of the program file 14 through the interface provided by the trusted module 15.

[0102] Combine the following Figure 2 , the file access method provided in the embodiment of the present application is described.

[0103] Figure 2 The following is a flowchart of a file access method provided in an embodiment of the present application. The execution subject of the method is Figure 1 The monitoring process is shown in Figure 1. Figure 2 As shown, the method may include:

[0104] S201. Receive process information of a suspended application process sent by a kernel, wherein the application process is used to access a target file.

[0105] When an application process accesses a target file, the kernel's file access interface is called. In a possible implementation, the monitoring process can set a hook function so that when the kernel detects that an application process calls the file access interface, the application process can be suspended and the process information of the application process can be sent to the monitoring process.

[0106] Correspondingly, the monitoring process receives the process information of the application process.

[0107] It should be noted that suspending an application process means temporarily stopping the execution of the application process, but retaining the current state and process information of the application process so as to resume execution later.

[0108] The application program may start the application process in response to the user's access request.

[0109] The process information may include a file path of a target file that the application process is to access.

[0110] Optionally, the process information may also include an identifier of the application process. In a possible implementation, when multiple processes access different target files, the monitoring process may receive process information of different processes, and then feed back access results respectively according to the process identifiers.

[0111] S202: Calculate an actual measurement value of the target file according to the process information.

[0112] Exemplarily, the metric value of a file is calculated based on the content of the file, and different file contents correspond to different metric values. The actual metric value of a file may be the metric value corresponding to the current content of the file. The monitoring process may obtain the file content of the target file according to the process information, thereby calculating the actual metric value of the target file.

[0113] In a possible implementation, the process information includes a file path of the target file; and calculating an actual measurement value of the target file to be accessed by the application process may include:

[0114] The target file is read according to the file path of the target file, and a hash value corresponding to the current content of the target file is calculated as the actual measurement value of the target file.

[0115] It can be understood that the access path of the target file is the storage path of the target file in the memory. Therefore, obtaining the target file according to the file path of the target file includes: acquiring the file under the file path of the target file in the memory to obtain the target file.

[0116] In the above scheme, the monitoring process can obtain the file content of the current target file according to the file path of the target file, calculate the hash value corresponding to the file content of the current target file, and thus obtain the actual measurement value of the target file.

[0117] S203: Obtain the original measurement value of the target file from the trusted module.

[0118] It can be understood that after the system is started, the original measurement value of the target file can be stored in the trusted module.

[0119] In a possible implementation, after the system is started, the monitoring process can obtain the original file content of the file that may be used, calculate the hash value corresponding to the original content, and store the hash value as the original measurement value of the target file in the trusted module. The files obtained by the monitoring process should include the target file.

[0120] S204: Compare the actual measurement value with the original measurement value, and send a decision result to the kernel, so that the kernel allows or denies the application process to access the target file.

[0121] When the actual measurement value is the same as the original measurement value, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file has not been tampered with, and the target file can be considered to be credible. The monitoring process can send the first judgment result to the kernel to enable the kernel to wake up the application process and allow the application process to access the target file.

[0122] When the actual measurement value is different from the original measurement value, it indicates that the file content of the target file is inconsistent with the file content of the original file corresponding to the target file, the target file has been tampered with, and the target file can be considered untrustworthy. The monitoring process can send a second judgment result to the kernel to enable the kernel to wake up the application process and deny the application process access to the target file.

[0123] In this embodiment, based on the actual measurement value of the target file, it can be determined whether the target file requested to be accessed by the application process is credible, thereby comprehensively determining whether the file access event is credible. The file access event can be accurately measured for credibility, and the kernel can intercept the file access event when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0124] Figure 3 The following is a flowchart of another file access method provided in the embodiment of the present application. The execution subject of the method is Figure 1 The monitoring process is shown in Figure 1. Figure 3 As shown, the method may include:

[0125] S301, load a configuration file, the configuration file includes configuration information of at least one file, the configuration information includes a file path and a trusted module storage function identifier. The target file may be one of the at least one file.

[0126] When the monitoring process is started, the monitoring process can load the configuration file and obtain the file path and the trusted module storage function identifier in the configuration file. At this time, the file includes the original file content, and the trusted module storage function identifier is used to indicate the storage location of the original measurement value of the file.

[0127] In one possible implementation, when the trusted module storage function identifier indicates that the storage location is a trusted module, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then store the original measurement value in the trusted module; when the trusted module storage function identifier does not indicate that the storage location is a trusted module, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then the original measurement value will be saved in the configuration file.

[0128] Exemplarily, when the trusted module storage function is identified as 1, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then store the original measurement value in the trusted module; when the trusted module storage function is identified as 0, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then the original measurement value will be saved in the configuration file.

[0129] S302: Receive process information of a suspended application process sent by a kernel, wherein the application process is used to access a target file.

[0130] S303: Calculate the actual measurement value of the target file according to the process information.

[0131] It should be noted that the specific implementation of steps S302 and S303 can refer to steps S201 and S202, which will not be repeated here.

[0132] S304: Read the configuration file and obtain the trusted module storage function identifier in the configuration file.

[0133] S305: Obtain the original measurement value of the target file according to the trusted module storage function identifier.

[0134] The monitoring process can determine the storage location of the original measurement value of the target file according to the trusted module storage function identifier, and then obtain the original measurement value.

[0135] In one possible implementation, when the trusted module storage function identifier indicates that the storage location is a trusted module, the monitoring process can obtain the original measurement value of the target file from the trusted module; when the trusted module storage function identifier does not indicate that the storage location is a trusted module, the monitoring process can read the original measurement value of the target file from the configuration file.

[0136] Exemplarily, when the trusted module storage function identifier is 1, the monitoring process can obtain the original measurement value of the target file from the trusted module; when the trusted module storage function identifier is 0, the monitoring process can read the original measurement value of the target file from the configuration file.

[0137] S306: Compare the actual measurement value with the original measurement value, and send a decision result to the kernel, so that the kernel allows or denies the application process to access the target file.

[0138] It should be noted that the specific implementation of step S306 can refer to step S204 and will not be repeated here.

[0139] Optionally, the configuration information may also include a file backup path, and when the monitoring process is started, the file may be copied and stored in the file backup path. When the actual measurement value is different from the original measurement value in S305, the monitoring process may overwrite the file in the file path with the backup file in the file backup path to restore the tampered file.

[0140] Optionally, the configuration information may further include a file recovery function identifier, which is used to determine whether to enable the file recovery function. In a possible implementation, when the file recovery function identifier indicates that it is enabled, the monitoring process may perform the above recovery process when the actual measurement value is different from the original measurement value; when the file recovery function identifier indicates that it is not enabled, the monitoring process may not perform the above recovery process. Exemplarily, when the file recovery function identifier is 1, the monitoring process may perform the above recovery process when the actual measurement value is different from the original measurement value; when the file recovery function identifier is 0, the monitoring process may not perform the above recovery process.

[0141] Exemplarily, the backup file may also be stored in the memory.

[0142] It is understandable that step S301 can be executed only once, for example, when the monitoring process is started; when the monitoring process performs trust measurement on the application process, steps S302-S306 can be repeated to efficiently implement multiple trust measurements on the application process and / or trust measurements on multiple application processes, thereby improving file access efficiency.

[0143] In this embodiment, due to the limited space of the trusted module, it may not be possible to store the original measurement values ​​of all target files. By setting the configuration file, the original measurement values ​​of the target files can be selected to be saved in the trusted module or configuration file, thereby improving the flexibility of the configuration. Therefore, based on the actual measurement value of the target file, it is possible to determine whether the target file requested to be accessed by the application process is trustworthy, and accurately perform trust measurement on file access events, which can effectively improve the security of file access and the reliability of the system.

[0144] Figure 4 A flowchart of another file access method provided in an embodiment of the present application is shown below. The execution subject of the method is Figure 1 The monitoring process is shown in Figure 1. Figure 4 As shown, the method may include:

[0145] S401. Receive process information of a suspended application process sent by a kernel, wherein the application process is used to access a target file.

[0146] S402: Calculate the actual measurement value of the target file according to the process information.

[0147] S403: Obtain the original measurement value of the target file from the trusted module.

[0148] It should be noted that the specific implementation of steps S402-S403 can refer to steps S202-S203, which will not be repeated here.

[0149] S404: Compare the actual metric value of the target file with the original metric value to obtain a first matching result; the first matching result includes a match or a mismatch.

[0150] When the first matching result is a match, the actual measurement value of the target file is the same as the original measurement value, indicating that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file has not been tampered with, and the target file can be considered to be credible.

[0151] When the first matching result is mismatch, the actual measurement value of the target file is different from the original measurement value, indicating that the file content of the target file is inconsistent with the file content of the original file corresponding to the target file, the target file has been tampered with, and it can be considered that the target file is unreliable.

[0152] In the above scheme, the monitoring process can determine whether the file content of the target file is consistent with the file content of the original file corresponding to the target file by judging whether the actual measurement value of the target file matches the reference measurement value of the target file, thereby determining whether the target file has been tampered with.

[0153] S405: Calculate the actual measurement value of the program file corresponding to the application process according to the process information.

[0154] Exemplarily, the process information of the application process may include a file path of a program file corresponding to the application process and a file path of a target file.

[0155] In a possible implementation, the process information includes a file path of the program file; and calculating an actual measurement value of the program file that the application process needs to access may include:

[0156] The program file is read according to the file path of the program file, and a hash value corresponding to the current content of the program file is calculated as the actual measurement value of the program file.

[0157] It can be understood that the access path of the program file is the storage path of the program file in the memory. Therefore, obtaining the program file according to the file path of the target file includes: acquiring the file under the file path of the program file in the memory to obtain the program file.

[0158] In the above scheme, the monitoring process can obtain the file content of the current program file according to the file path of the program file, calculate the hash value corresponding to the file content of the current program file, and thus obtain the actual measurement value of the program file.

[0159] S406: Obtain the original measurement value of the program file from the trusted module.

[0160] It is understandable that after the system is started, the original measurement value of the program file may be stored in the trusted module.

[0161] In a possible implementation, after the system is started, the monitoring process may obtain the original file content of the program file, calculate a hash value corresponding to the original content, and store the hash value as the original measurement value of the program file in the trusted module.

[0162] S407: Compare the actual measurement value and the original measurement value of the program file to obtain a second matching result; the second matching result includes a match or a mismatch.

[0163] When the second matching result is a match, the actual measurement value of the program file is the same as the original measurement value, indicating that the file content of the program file is consistent with the file content of the original file corresponding to the program file, the program file has not been tampered with, and the program file can be considered to be credible.

[0164] When the second matching result is mismatch, the actual measurement value of the program file is different from the original measurement value, indicating that the file content of the program file is inconsistent with the file content of the original file corresponding to the program file, the program file has been tampered with, and it can be considered that the program file is unreliable.

[0165] In the above scheme, the monitoring process can determine whether the file content of the program file is consistent with the file content of the original file corresponding to the program file by determining whether the actual measurement value of the program file matches the reference measurement value of the program file, thereby determining whether the program file has been tampered with.

[0166] In the above scheme, the monitoring process can determine whether the file content of the target file is consistent with the file content of the original file corresponding to the target file by judging whether the actual measurement value of the target file matches the reference measurement value of the target file, thereby determining whether the target file has been tampered with.

[0167] S408. Send a decision result to the kernel according to the first matching result and the second matching result, so that the kernel allows the application process to access the target file when the first matching result and the second matching result are both matched; otherwise, the application process is not allowed to access the target file.

[0168] Specifically, when the first matching result and the second matching result are both matched, that is, when the actual measurement value of the program file matches the reference measurement value of the program file and the actual measurement value of the target file matches the reference measurement value of the target file, the monitoring process determines that neither the program file nor the target file has been tampered with, and thus considers that the file access event is credible, obtains a first ruling result that allows the application process to access the target file, and sends the first ruling result to the kernel; when the first matching result is a mismatch or the second matching result is a mismatch, that is, when the actual measurement value of the program file does not match the reference measurement value of the program file or the actual measurement value of the target file does not match the reference measurement value of the target file, the monitoring process determines that the program file or the target file may have been tampered with, and thus considers that the file access event is untrustworthy, obtains a second ruling result that does not allow the application process to access the target file, and sends the second ruling result to the kernel.

[0169] It is understandable that the monitoring process may first execute steps S402-S404 to perform a credibility measurement on the target file, and then execute steps S405-S407 to perform a credibility measurement on the program file.

[0170] Optionally, when the monitoring process is started, the original measurement value of its own program file can be calculated first and saved in the trusted module. After that, the monitoring process will periodically calculate the actual measurement value of its own program file and compare it with the original measurement value in the trusted module. When the actual measurement value is the same as the file measurement value, S401-S408 will be executed.

[0171] In the above scheme, by comprehensively judging whether the actual measurement values ​​of the program file and the target file match the reference measurement values, it is possible to determine whether the program file and the target file have been tampered with based on the matching results, thereby deciding whether to allow the application process to access the target file. This allows accurate trust measurement and can intercept the target file and / or program file through the kernel when it is untrustworthy, which can effectively improve the security of file access and the reliability of the system.

[0172] Figure 5 A flowchart of another file access method provided in an embodiment of the present application is shown below. The execution subject of the method is Figure 1 The monitoring process is shown in Figure 1. Figure 5 As shown, the method may include:

[0173] S501, load a configuration file, the configuration file includes configuration information of at least two files, the configuration information includes a file path and a trusted module storage function identifier. The target file may be one of the at least two files, and the program file may be one of the at least two files.

[0174] It should be noted that the specific implementation of step S501 can refer to step S301 and will not be repeated here.

[0175] S502: Receive process information of a suspended application process sent by the kernel, wherein the application process is used to access a target file.

[0176] S503: Calculate the actual measurement value of the target file according to the process information.

[0177] It should be noted that the specific implementation of steps S502-S503 can refer to steps SS201-202, which will not be repeated here.

[0178] S504: Read the configuration file, and obtain the trusted module storage function identifier of the target file in the configuration file.

[0179] S505: Acquire the original measurement value of the target file according to the trusted module storage function identifier of the target file.

[0180] It should be noted that the specific implementation of step S505 can refer to step S305 and will not be repeated here.

[0181] S506: Compare the actual measurement value and the original measurement value of the target file to obtain a first matching result; the first matching result includes a match or a mismatch.

[0182] S507: Calculate the actual measurement value of the program file corresponding to the application process according to the process information.

[0183] It should be noted that the specific implementation of steps S506-S507 can refer to steps S404-S405, which will not be repeated here.

[0184] S508: Read the configuration file, and obtain the trusted module storage function identifier of the program file in the configuration file.

[0185] S509: Acquire the original measurement value of the program file according to the trusted module storage function identifier of the program file.

[0186] The monitoring process can determine the storage location of the original measurement value of the program file according to the trusted module storage function identifier, and then obtain the original measurement value of the program file.

[0187] In one possible implementation, when the trusted module storage function identifier indicates that the storage location is a trusted module, the monitoring process can obtain the original measurement value of the program file from the trusted module; when the trusted module storage function identifier does not indicate that the storage location is a trusted module, the monitoring process can read the original measurement value of the program file from the configuration file.

[0188] Exemplarily, when the trusted module storage function identifier is 1, the monitoring process can obtain the original measurement value of the program file from the trusted module; when the trusted module storage function identifier is 0, the monitoring process can read the original measurement value of the program file from the configuration file.

[0189] S510: Compare the actual measurement value and the original measurement value of the program file to obtain a second matching result; the second matching result includes a match or a mismatch.

[0190] S511. Send a decision result to the kernel according to the first matching result and the second matching result, so that the kernel allows the application process to access the target file when the first matching result and the second matching result are both matched; otherwise, the application process is not allowed to access the target file.

[0191] It should be noted that the specific implementation of steps S510-S511 can refer to steps S407-S408, which will not be repeated here.

[0192] It is understandable that the monitoring process may first execute steps S503-S506 to perform a credibility measurement on the target file, and then execute steps S507-S510 to perform a credibility measurement on the program file.

[0193] Optionally, when the monitoring process is started, the original measurement value of its own program file can be calculated first and saved in the trusted module. After that, the monitoring process will periodically calculate the actual measurement value of its own program file and compare it with the original measurement value in the trusted module. When the actual measurement value is the same as the file measurement value, S501-S511 will be executed.

[0194] In the above scheme, due to the limited space of the trusted module, it may not be possible to store the original measurement values ​​of all target files. By setting the configuration file, you can choose to save the original measurement values ​​of the files in the trusted module or configuration file, which improves the flexibility of the configuration. Based on the actual measurement values ​​of the program file and the target file, it is comprehensively judged whether the application process and the target file requested to be accessed by the application process are trustworthy, and the file access event is accurately measured for trustworthiness, which can effectively improve the security of file access and the reliability of the system.

[0195] Figure 6 Another file access method provided in the embodiment of the present application. The execution subject of the method is Figure 1 The kernel shown.

[0196] like Figure 6 As shown, the method may include:

[0197] S601. When it is detected that an application process calls a file access interface, the application process is suspended and process information of the application process is sent to a monitoring process. The application process is used to access a target file, and the process information includes a file path of the target file. The monitoring process calculates an actual measurement value of the target file based on the process information to obtain a decision result.

[0198] Exemplarily, the monitoring process may set a hook function so that when the kernel detects that the application process accesses the target file, the kernel suspends the application process and sends the process information of the application process to the monitoring process.

[0199] The kernel monitoring whether the application process accesses the target file may include monitoring whether a system call function for file access is called.

[0200] The monitoring process can determine whether the application process is trustworthy based on the process information and return the determination result to the kernel.

[0201] S602: wake up the application process according to the decision result, and release or intercept the application process.

[0202] Specifically, the decision result may include allowing the application process to access the target file or not allowing the application process to access the target file. After receiving the decision result, the kernel wakes up the application process, and releases the application process when the decision result is that the application process is allowed to access the target file; when the decision result is that the application process is not allowed to access the target file, the application process is intercepted.

[0203] In this embodiment, the kernel suspends the monitored application process and sends the process information of the application process to the monitoring process. The monitoring process determines whether the application process is trustworthy, wakes up the application process based on the determination result, and executes release or interception, which can effectively prevent malicious files from affecting the security of the application process and the system.

[0204] The embodiment of the present application also provides an electronic device. The electronic device includes: a monitoring process, an application process and a kernel;

[0205] The kernel is used to suspend the application process when detecting that an application process calls a file access interface, and send process information of the application process to the monitoring process; the application process is used to access a target file, and the process information includes a file path of the target file;

[0206] The monitoring process is used to calculate the actual measurement value of the target file according to the process information; obtain the original measurement value of the target file from the trusted module; compare the actual measurement value with the original measurement value, and send a decision result to the kernel;

[0207] The kernel is further configured to allow or deny the application process to access the target file according to the arbitration result.

[0208] The electronic device is used to execute the file access method provided in the above embodiment. The specific implementation and beneficial effects thereof are as described above and will not be repeated here.

[0209] The embodiment of the present application also provides an electronic device. The electronic device includes: a monitoring process, an application process and a kernel;

[0210] The kernel is used to suspend the application process when detecting that an application process calls a file access interface, and send process information of the application process to the monitoring process; the application process is used to access a target file, and the process information includes a file path of the target file;

[0211] The monitoring process is used to calculate the actual measurement value of the target file according to the process information; read a configuration file, the configuration file including a trusted module storage function identifier of the target file; obtain the original measurement value of the target file according to the trusted module storage function identifier; compare the actual measurement value of the target file with the original measurement value of the target file, and send a decision result to the kernel;

[0212] The kernel is further configured to allow or deny the application process to access the target file according to the arbitration result.

[0213] The electronic device is used to execute the file access method provided in the above embodiment. The specific implementation and beneficial effects thereof are as described above and will not be repeated here.

[0214] Figure 7 This is a schematic diagram of the structure of another electronic device provided in an embodiment of the present application. Figure 7As shown, the electronic device includes a processor (processor) 291. The kernel is a unit of the processor 291, and the application process and the monitoring process can be run on the processor 291. The electronic device also includes a memory 292; it can also include a communication interface (CommunicationInterface) 293, a bus 294 and a trusted module 15. Among them, the processor 291, the memory 292, the communication interface 293, and the trusted module 15 can communicate with each other through the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can call the logic instructions in the memory 292 to execute the file access method provided by the above-mentioned various method embodiments.

[0215] In addition, the logic instructions in the above-mentioned memory 292 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0216] The memory 292 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present disclosure. The processor 291 executes the software programs, instructions, and modules stored in the memory 292 to perform functional applications and data processing, that is, to implement the methods in the above method embodiments.

[0217] The memory 292 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 292 may include a high-speed random access memory and may also include a non-volatile memory.

[0218] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the above embodiment.

[0219] An embodiment of the present application also provides a computer program product, including a computer program, which implements the method provided in any embodiment of the above-mentioned embodiment of the present disclosure when the computer program is executed by a processor.

[0220] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0221] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A file access method, characterized in that: include: receiving process information of a suspended application process sent by the kernel, wherein the application process is used to access a target file, and the process information includes a file path of the target file; Calculating an actual measurement value of the target file according to the process information; Obtaining an original measurement value of the target file from a trusted module; The actual measurement value is compared with the original measurement value, and a decision result is sent to the kernel, so that the kernel wakes up the application process and allows or denies the application process to access the target file.

2. A file access method, characterized in that: The method comprises: receiving process information of an application process sent by the kernel, wherein the application process is used to access a target file, and the process information includes a file path of the target file; Calculating an actual measurement value of the target file according to the process information; Acquire a configuration file, wherein the configuration file includes a trusted module storage function identifier of the target file; Acquire the original measurement value of the target file according to the trusted module storage function identifier; The actual measurement value of the target file is compared with the original measurement value of the target file, and a decision result is sent to the kernel, so that the kernel allows or denies the application process to access the target file.

3. The file access method according to claim 2, characterized in that: The method comprises: Loading a configuration file, wherein the configuration file includes configuration information of at least one file, wherein the configuration information includes a file path and a trusted module storage function identifier, wherein the trusted module storage function identifier is used to indicate a storage location of an original measurement value of the file, and the target file is one of the at least one file; When the trusted module storage function identifier indicates that the storage location is a trusted module, storing the original measurement value of the file in the trusted module; When the trusted module storage function identifier does not indicate that the storage location is a trusted module, the original measurement value of the file is stored in the configuration file.

4. The file access method according to any one of claims 1 to 3, characterized in that: The comparing the actual measurement value of the target file with the original measurement value of the target file specifically includes: When the actual measurement value of the target file is the same as the original measurement value of the target file, sending a first ruling result to the kernel so that the kernel allows the application process to access the target file; When the actual metric value of the target file is different from the original metric value of the target file, a second ruling result is sent to the kernel, so that the kernel denies the application process from accessing the target file.

5. The file access method according to any one of claims 1 to 4, characterized in that: Before the process information of the application process sent by the receiving kernel is received, the method includes: Setting a hook function so that when the kernel detects that an application process calls a file access interface, the kernel suspends the application process and returns the process information of the application process; Then the comparing the actual measurement value of the target file with the original measurement value of the target file and sending the decision result to the kernel so that the kernel allows or denies the application process to access the target file includes: The actual measurement value of the target file is compared with the original measurement value of the target file, a decision result is sent to the kernel, and the application process is awakened, so that the kernel allows or denies the application process to access the target file.

6. The file access method according to claim 3, characterized in that: The method further comprises: The configuration information also includes a file backup path; When the actual measurement value is different from the original measurement value, the backup file in the file backup path is used to overwrite the file in the file path.

7. The file access method according to claim 6, characterized in that: The method further comprises: The configuration information also includes a file recovery function identifier; When the file recovery function flag indicates that it is turned on, when the actual measurement value is different from the original measurement value, the backup file in the file backup path is used to overwrite the file in the file path.

8. The file access method according to any one of claims 6 to 7, characterized in that: The configuration file also includes a trusted module storage function identifier of a program file corresponding to the application process, and the method further includes: Calculating an actual measurement value of the program file according to the process information; Acquiring an original measurement value of the program file according to a trusted module storage function identifier of the program file; Then, comparing the actual measurement value of the target file with the original measurement value of the target file and sending a decision result to the kernel so that the kernel allows or denies the application process to access the target file specifically includes: When the actual measurement value of the target file is the same as the original measurement value of the target file, and the actual measurement value of the program file is the same as the original measurement value of the program file, sending a first ruling result to the kernel so that the kernel allows the application process to access the target file; When the actual metric value of the target file is different from the original metric value of the target file, or the actual metric value of the program file is different from the original metric value of the program file, a second ruling result is sent to the kernel so that the kernel denies the application process access to the target file.

9. The file access method according to any one of claims 1 to 8, characterized in that: The process information includes the process identifier of the application process, and the comparing the actual measurement value of the target file with the original measurement value of the target file and sending the decision result to the kernel so that the kernel allows or denies the application process to access the target file specifically includes: The actual measurement value of the target file is compared with the original measurement value of the target file, and a decision result is sent to the kernel so that the kernel allows or denies the application process corresponding to the process identifier to access the target file, wherein the decision result includes the process identifier.

10. An electronic device, characterized in that: include: A processor, and a memory and a trusted module communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 9.

Images