File system protection method, device and system, storage medium and product

Abstract

The invention discloses a file system protection method and device, equipment, a storage medium and a product. The method comprises the steps that in a kernel mode operation mode, a file isolator responds to hook triggering indication information, and feature information of a process is acquired; based on the feature information and an isolation strategy library, an isolation strategy of the process is determined, the isolation strategy library comprises a corresponding relation between each piece of feature information and each isolation strategy, and the isolation strategy comprises a redirection rule; based on a redirection rule, redirecting the file operation request of the process to the virtual file system; wherein the isolation strategy library is generated and issued to the file isolator by the isolation controller when the file system is in a user mode operation mode, and the hook trigger indication information is generated in response to a call request of the process for the file system. Therefore, by introducing a file protection mechanism of the isolation controller in the user mode and the file isolator in the kernel mode, not only is highly accurate access control allowed to be realized, but also better performance is achieved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a file system protection method, device, system, storage medium and product. Background Art

[0002] With the rapid development of information technology and the widespread popularity of information devices, the security of data stored in these devices has attracted increasing attention from companies and individuals. Against this backdrop, root file system isolation has emerged as the times require. This technology provides an effective means to protect sensitive information stored in devices, aiming to address data security challenges. During file operations, isolation can provide an additional layer of protection to ensure that data is not accessed without authorization, providing users and organizations with greater security.

[0003] Currently, Linux-based operating systems can use namespace and cgroup technologies to implement advanced file system isolation mechanisms, which can make the file system seen by the process independent of the host file system, and the process cannot access the real file system. However, for other types of operating systems, such as macOS, there is no such mechanism. These systems only provide some endpoint security frameworks, such as KAuth, Endpoint Security, and MACF.

[0004] These frameworks can also meet the audit and authorization needs of processes for file operations, such as limiting the read, write, and execute permissions of a process to a certain file. However, it is difficult to implement a fine-grained root file system isolation mechanism, such as limiting the process root file system to a certain isolation directory so that when it accesses a certain file, it actually accesses the file under the isolation directory, and restricting other processes from accessing the isolation directory. The lack of this mechanism makes it difficult to isolate the files operated by the process from the real files, making it difficult to implement sandbox applications on this type of operating system.

[0005] At present, the solution for the above operating systems is mainly implemented by hooking the system call of the application layer and adding the underlying driver protection. This solution requires some means to inject the dynamic library into the process, and then hook the system call. When the process executes the system call, it obtains the file to be operated and redirects the file operation, and then uses the endpoint security framework to protect the redirected isolation directory.

[0006] However, adopting this solution will lead to the following problems: (1) There are too many system calls for hooks; (2) There is a problem of being detected by the process when injecting dynamic libraries, which leads to insufficient transparency and possible injection failure; (3) There is no priority for the hooks at the application layer, and the hooks can be easily bypassed by malicious processes; (4) An additional thread synchronization mechanism needs to be added to the hook, which leads to poor stability and performance. Summary of the invention

[0007] In view of this, embodiments of the present application provide a method, device, system, storage medium and product for protecting a file system, aiming to improve the security and performance of the file system.

[0008] The technical solution of the embodiment of the present application is implemented as follows:

[0009] In a first aspect, an embodiment of the present application provides a method for protecting a file system, the method comprising:

[0010] In the kernel state operation mode, the file isolator obtains characteristic information of the process in response to the hook trigger indication information;

[0011] Determining an isolation strategy for the process based on the feature information and an isolation strategy library, wherein the isolation strategy library includes a correspondence between each feature information and each isolation strategy, and the isolation strategy includes a redirection rule;

[0012] Based on the redirection rule, redirecting the file operation request of the process to the virtual file system;

[0013] The isolation policy library is generated by the isolation controller and sent to the file isolator when the file system is in user mode, and the hook trigger indication information is generated in response to the process's call request for the file system.

[0014] In some embodiments, the virtual file system includes multiple isolation domains, the isolation strategy also includes: target identification information of the target isolation domain, and redirecting the file operation request of the process to the virtual file system based on the redirection rule includes:

[0015] Based on the redirection rule and the target identification information, the file operation request is redirected to the target isolation domain, where the target isolation domain is one of the multiple isolation domains.

[0016] In some embodiments, the method further comprises:

[0017] In response to a file operation request of the process for the file system, generating a call request for the file system;

[0018] In response to the call request based on the virtual file system operation interface, the file system enters a kernel state operation mode, and determines whether a hook of the call request is triggered;

[0019] If so, a hook trigger indication message is generated to the file isolator.

[0020] In some embodiments, the isolation strategy further includes: a first isolation rule corresponding to the target isolation domain, and the method further includes:

[0021] If it is determined that the file operation request is redirected to the target isolation domain, the file operation request is isolated based on the first isolation rule.

[0022] In some embodiments, isolating the file operation request based on the first isolation rule includes:

[0023] Obtaining operation directory information corresponding to the file operation request;

[0024] Based on the operation catalog information, determining the operation catalog type corresponding to the operation catalog information;

[0025] If the operation directory type is a root directory, the file operation request is filtered to isolate the file operation request.

[0026] In some embodiments, the first isolation rule includes an identification information set, and isolating the file operation request based on the first isolation rule includes:

[0027] Determining whether the target identification information belongs to the identification information set, and if not, determining that the process type of the process is a non-isolated process;

[0028] Determining whether the target identification information is greater than or equal to the first identification information, and if not, filtering the file operation request to isolate the file operation request;

[0029] Among them, the identification information set is an identification information set corresponding to the isolation domain of the isolation process type, and the first identification information is the identification information of the isolation domain corresponding to the file operation request.

[0030] In some embodiments, the virtual file system includes a plurality of isolation domains, and the method further includes:

[0031] In the user state operation mode, the file isolation controller determines identification information corresponding to each isolation domain based on the number of the multiple isolation domains and a preset isolation domain naming rule;

[0032] For each piece of identification information, determining the process characteristic information corresponding to each piece of identification information and the isolation strategy corresponding to each piece of identification information;

[0033] Based on each of the identification information and each of the process characteristic information, a first mapping relationship is generated, wherein the first mapping relationship includes a correspondence between each of the isolation domain identification information and each of the process characteristic information;

[0034] Based on each of the identification information and each of the isolation strategies, generating a second mapping relationship;

[0035] The isolation policy library is generated based on the first mapping relationship and the second mapping relationship.

[0036] In some embodiments, the method further comprises:

[0037] In response to the file operation request, determining a vnode event corresponding to the file operation request;

[0038] If the vnode event satisfies the mapping relationship, it is determined whether the hook of the call request is triggered, and the mapping relationship is used to characterize the corresponding relationship between each vnode event and each hook function.

[0039] In some embodiments, the virtual file system includes a plurality of isolation domains, and the method further includes:

[0040] If there is no corresponding isolation policy in the isolation policy library for the characteristic information, determining the process type of the process based on the characteristic information;

[0041] Based on the process type and the isolation domain corresponding to the file operation request, determine whether to isolate the file operation request.

[0042] In a second aspect, an embodiment of the present application further provides a file system protection device, the device comprising:

[0043] An acquisition module, used for, in a kernel state operation mode, the file isolator responding to a file operation request of a process for a file system to acquire characteristic information of the process;

[0044] A determination module, configured to determine a target isolation strategy based on the feature information and an isolation strategy library, wherein the isolation strategy library includes a correspondence between each feature information and each isolation strategy, and the target isolation strategy includes a redirection rule;

[0045] A redirection module, used for redirecting the file operation request of the process to the virtual file system based on the redirection rule;

[0046] The isolation policy library is generated by the isolation controller and sent to the file isolator when the file system is in the user mode.

[0047] In a third aspect, an embodiment of the present application provides a file protection system, an isolation controller and a file isolator, wherein the isolation controller and the file isolator are configured to execute the steps of the method described in the first aspect above.

[0048] In some embodiments, the isolation controller includes: a first communication module and an isolator management module, and the file isolator includes: a second communication module, a policy decision module and a file redirection module; wherein,

[0049] The isolator management module is used to load the file isolator;

[0050] The first communication module is used to generate and send an isolation policy library to the second communication module when the file system is in a user mode operation mode;

[0051] The second communication module is used to receive the isolation policy library and the hook trigger indication information in the kernel state operation mode;

[0052] The policy decision module is used to obtain feature information of the process; determine the isolation policy of the process based on the feature information and the isolation policy library, the isolation policy library includes the correspondence between each feature information and each isolation policy, and the isolation policy includes a redirection rule;

[0053] The redirection module is used to redirect the file operation request of the process to the virtual file system based on the redirection rule;

[0054] The hook trigger indication information is generated in response to a call request from a process to a file system.

[0055] In some embodiments, the file isolator also includes a file filtering module, which is used to obtain operation directory information corresponding to the file operation request; based on the operation directory information, determine the operation directory type corresponding to the operation directory information; if the operation directory type is a root directory, determine that the operation directory information does not meet the directory isolation rules, and filter the file operation request to isolate the file operation request.

[0056] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0057] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0058] The technical solution provided by the embodiment of the present application is that, in the kernel state operation mode, the file isolator responds to the hook trigger indication information to obtain the characteristic information of the process; based on the characteristic information and the isolation policy library, the isolation policy of the process is determined, the isolation policy library includes the correspondence between each characteristic information and each isolation policy, and the isolation policy includes redirection rules; based on the redirection rules, the file operation request of the process is redirected to the virtual file system; wherein, the isolation policy library is generated and sent to the file isolator by the isolation controller when the file system is in the user state operation mode, and the hook trigger indication information is generated in response to the process's call request for the file system.

[0059] In this way, the embodiment of the present application introduces a file protection mechanism of a user-state isolation controller and a kernel-state file isolator. The isolation controller sends an isolation policy library, and the file isolator redirects file operations to the virtual file system to implement file system isolation operations. Since the isolation operation occurs at the kernel level, the kernel-level implementation not only allows for highly precise access control, but also avoids the conventional practice of directly inserting dynamic libraries into the process space, greatly reducing the risk of being detected or avoided by malicious software, reducing the cost of application layer interface abstraction, and having better performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of a method for protecting a file system provided in an embodiment of the present application;

[0061] Figure 2 A schematic diagram of the overall structure of the file protection system provided in the embodiment of the present application;

[0062] Figure 3 A schematic diagram of the structure of the isolation controller provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the structure of a file isolator provided in an embodiment of the present application;

[0064] Figure 5 This is a structural diagram of an isolation strategy in an application example of this application;

[0065] Figure 6 This is a schematic diagram of the operation flow of the isolation controller in an application example of this application;

[0066] Figure 7 This is a flowchart of an isolator hook file system operation function in an application example of this application;

[0067] Figure 8 This is a schematic diagram of the isolation process in an application example of this application;

[0068] Fig. 9 This is a schematic diagram of the file protection process of the isolation domain in an application example of this application;

[0069] Fig.10 A schematic diagram of the structure of a file system protection device provided in an embodiment of the present application;

[0070] Fig.11 A schematic diagram of the structure of a file system protection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0073] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations:

[0074] Root file system isolation: refers to the use of technical means in the operating system to isolate the file system root directory (usually / ) of a process from the file system of the host system, so that the process has its own independent file system view. This isolation helps to achieve mutual independence between processes and improve the security, stability and portability of the system.

[0075] Isolation domain: An isolation domain refers to a range, which includes the domain number and the domain root directory. The root directory of the isolated process is limited to the root directory of the isolation domain.

[0076] macOS: macOS / OS X is an operating system using a graphical user interface launched by Apple and is the main operating system for the Macintosh series of computers.

[0077] Kernel: The macOS kernel is called Darwin, which contains a Unix kernel based on BSD (Berkeley Software Distribution) and a Mach microkernel.

[0078] VFS (Virtual file system): An abstraction layer between the upper-layer software and the file system in the kernel, providing a unified interface for the upper-layer software so that it can interact with the underlying file system without having to worry about the specific file system implementation.

[0079] vnode: vnode represents a file or directory in VFS. vnode uses object-oriented thinking to abstract files. Each vnode contains file information, including file permissions, type, size, owner, and an array of methods for operating the vnode (i.e. v_op). v_op is provided by the underlying file system, and vnode does not need to pay attention to the specific implementation.

[0080] Kernel Extension (Kext): A software module used to extend kernel functionality in the macOS operating system. Kernel extensions allow developers to dynamically inject code into the kernel of the operating system in order to add new features, device drivers, or modify existing kernel behavior.

[0081] Hook: translated into Chinese as "hook" or "hook", refers to the function address or entry instruction set called by the binary executable program, which modifies the binary instruction set to modify the original instruction.

[0082] Sandbox: A security mechanism used to limit the permissions and access of applications in a computer system. It creates a restricted, isolated environment to ensure that programs can only perform authorized operations, preventing them from causing potential harm to the system and other applications.

[0083] IOKIT (Input / Output Kit): is a framework in macOS that enables developers to interact with various kernel modules.

[0084] At present, the mainstream solution for file system isolation is to hook the system call of the application layer and implement the underlying driver protection. This solution requires some means to inject the dynamic library into the process, then hook the system call, and when the process executes the system call, obtain the file to be operated and redirect the file operation, and then use the endpoint security framework to protect the redirected isolation directory. This method has some disadvantages:

[0085] 1. System calls are located at the upper layer, providing rich and differentiated calling interfaces, and there are too many system calls that need to be hooked;

[0086] 2. There are problems with the dynamic library being detected by the process, insufficient transparency, and possible injection failures;

[0087] 3. The hook at the application layer has no priority and can be easily bypassed by malicious processes;

[0088] 4. It is necessary to add an additional thread synchronization mechanism in the hook, which leads to poor stability and performance.

[0089] The embodiment of the present application adopts a more low-level method, avoiding the hook of the upper file system call, reducing the number of hooks, improving the transparency of the system call, and making it easier to maintain. Since the operation occurs at the kernel level, the embodiment of the present application also does not need to inject the dynamic library into the process, reducing the risk of being detected. The kernel-level implementation also allows for more fine-grained permission control, ensuring that only authorized operations can be performed, reducing the risk of being bypassed by malicious processes. In addition, compared with the application layer hook, the kernel hook occurs at a lower level, reducing the overhead of the application layer interface abstraction and having better performance.

[0090] An embodiment of the present application provides a method for protecting a file system. It should be noted that the operating modes of the file operating system include: kernel mode and user mode. Kernel mode is the state in which the core part of the file operating system runs, and has full control over the hardware and the right to use all instructions. When a program needs to perform low-level operations such as file I / O, network communication, and memory management, it must be executed in kernel mode. Ordinary programs run in user mode, such as browsers, text editors, and other applications. In this state, the resources and instruction sets that the program can access are limited, and it cannot directly access the hardware. In actual applications, user-mode programs actively request operating system services, and the operating mode switches from user mode to kernel mode. Figure 1 As shown, the method comprises the following steps:

[0091] Step 110: In the kernel state operation mode, the file isolator obtains feature information of the process in response to the hook trigger indication information.

[0092] It is understandable that the file isolator can exist as a kernel extension, loaded by the isolation controller, and redirect the file operation request of the process to the virtual file system in the kernel mode. In the user mode, the isolation controller is responsible for policy management and distribution according to business needs, and distributes the isolation policy library to the file isolator.

[0093] It is understandable that when a process accesses a file through a file system call, a call request for the file system is generated, and the call will penetrate the user state into the kernel state and be captured by a preset hook in the virtual file system layer, generating a hook trigger indication information. VFS is a layer of abstract file system operations in the operating system kernel, supporting a variety of different file systems.

[0094] It is understandable that after the hook is triggered, a hook trigger indication is generated, and control is transferred to the file isolator, which obtains the characteristic information of the process. The characteristic information of the process includes but is not limited to: process pid, parent process pid, process path, process name and environment variables.

[0095] Step 120: Based on the feature information and the isolation policy library, determine the isolation policy of the process. The isolation policy library includes the correspondence between each feature information and each isolation policy. The isolation policy includes a redirection rule.

[0096] It is understandable that the isolation policy library contains the correspondence between each feature information and each isolation policy, and the isolation policy corresponding to the feature information is searched in the isolation library. The isolation policy includes a redirection rule, based on which the file operation request may be redirected to a different physical location or logical path.

[0097] Step 130: Based on the redirection rule, redirect the file operation request of the process to the virtual file system.

[0098] Among them, the isolation policy library is generated by the isolation controller and sent to the file isolator when the file system is in user mode, and the hook trigger indication information is generated in response to the process's call request for the file system.

[0099] It is understandable that the process of redirecting the file operation request of the process to the virtual file system (VFS) based on the redirection rule actually means changing the actual file system path that the process originally attempted to access at the operating system level and guiding it to an abstract, logical file system level. This process achieves control and isolation of file access without changing the behavior of the process itself.

[0100] In addition, after determining that redirection is required, the system builds a virtual view for the process at the VFS layer. As an abstract layer in the operating system kernel, VFS provides a unified interface to access different file systems, which makes redirection possible. In this virtual view, the file path seen by the process can be completely different from the actual storage path.

[0101] In this way, the embodiment of the present application introduces a file protection mechanism of a user-state isolation controller and a kernel-state file isolator. The isolation controller sends an isolation policy library, and the file isolator redirects file operations to the virtual file system to implement file system isolation operations. Since the isolation operation occurs at the kernel level, the kernel-level implementation not only allows for highly precise access control, but also avoids the conventional practice of directly inserting dynamic libraries into the process space, greatly reducing the risk of being detected or avoided by malicious software, reducing the cost of application layer interface abstraction, and having better performance.

[0102] In some embodiments, the virtual file system includes multiple isolation domains. In an embodiment of the present application, the virtual file system is designed to include multiple isolation domains, each of which represents an independent, logically isolated file system environment to adapt to different security levels, access rights or specific usage requirements.

[0103] In some embodiments, the isolation strategy further includes: target identification information of the target isolation domain, and redirecting the file operation request of the process to the virtual file system based on the redirection rule, including:

[0104] Based on the redirection rules and target identification information, the file operation request is redirected to the target isolation domain, which is one of the multiple isolation domains.

[0105] It is understandable that each isolation domain includes a domain number and a root directory corresponding to the domain number. After startup, the isolation controller first prepares the root directory required by the isolation process in the isolation domain, so that the isolated process can run normally under a virtual root directory. The isolation controller first traverses the isolation domains in turn. If the root directory does not exist, it creates a root directory. The subdirectories under the root directory include: / Library, / tmp, / var, / opt, / Users, / bin, / private.

[0106] It is understandable that each isolation domain has its corresponding identification information, which can be the name, ID, security level label or other metadata that defines its characteristics of the isolation domain. These identification information are used as part of the isolation policy to distinguish and specify the isolation environment to which the process should belong. The isolation policy also includes: target identification information of the target isolation domain. Once the target isolation domain is identified, based on the pre-set redirection rules, the system will transparently direct the process's file operation request to the virtual file system view corresponding to the isolation domain.

[0107] In some embodiments, the method further comprises:

[0108] In response to a file operation request of a process for a file system, generating a call request for the file system;

[0109] In response to the call request based on the virtual file system operation interface, the file system enters the kernel state operation mode and determines whether the hook of the call request is triggered;

[0110] If so, a hook trigger indication message is generated to the file isolator.

[0111] It can be understood that when a process is monitored to try to perform an operation on the file system, the file system is in user mode, such as reading, writing, creating, deleting files, etc., in response to the process's file operation request for the file system, a call request to the file system is generated, which encapsulates key information such as the operation type and the target file path.

[0112] It is understandable that after the virtual file system operation interface responds to the call request from the user space, the system is guided to switch to a more secure and more powerful kernel mode of operation, and in the kernel mode, it is determined whether the pre-set hook is triggered by the call request.

[0113] It is understandable that if it is determined that the call request meets the triggering conditions of one or more preset hooks, corresponding indication information will be generated. The indication information is passed to the file isolator, and the file isolator takes further actions in response to the indication information, such as redirecting the file operation to the virtual file system.

[0114] In some embodiments, the isolation strategy further includes: a first isolation rule corresponding to the target isolation domain, and the method further includes:

[0115] If it is determined that the file operation request is redirected to the target isolation domain, the file operation request is isolated based on the first isolation rule.

[0116] It is understandable that since there are multiple isolation domains, after it is determined that the file operation request is redirected to the target isolation domain, although the file operation request has been redirected to the target isolation domain, ensuring that the file operation will not affect the real file system, even in the isolation environment constructed by the virtual file system, according to the least privilege rule, it is necessary to further establish the first isolation rule within the virtual file system, and isolate the file operation request based on the first isolation rule to establish a multi-level, three-dimensional file protection system to ensure that the system can effectively defend against complex and changing threats. It is understandable that redirection is the starting point of isolation, and the first isolation rule is the key to achieving the purpose of isolation.

[0117] In some embodiments, isolating the file operation request based on the first isolation rule includes:

[0118] Get the operation directory information corresponding to the file operation request;

[0119] Based on the operation directory information, determine the operation directory type corresponding to the operation directory information;

[0120] If the operation directory type is a root directory, the file operation request is filtered to isolate the file operation request.

[0121] It should be noted that when a process attempts to perform a file operation such as opening, reading, writing, creating or deleting a file, a file operation request is generated, which includes file path information, and the file path information includes operation directory information. The operation directory information is directly related to the location information of the file resource in the file system.

[0122] It is understandable that the operation directory type corresponding to the operation directory information can be determined. The root directory is one of the operation directory types, which is the top-level directory in the file system and the starting point of all other directories. The root directory is very important for the file system because it contains many key files and directories required to start and run the system. In order to ensure security, the root directory is generally isolated by default. If the operation directory type is the root directory, the file operation request is filtered to isolate the file operation request. Filtering includes blocking or refusing to perform the operation, and its purpose is to protect the core directory of the system from being accessed or modified at will.

[0123] In some embodiments, the first isolation rule includes an identification information set, and based on the first isolation rule, isolating the file operation request includes:

[0124] Determine whether the target identification information belongs to the identification information set, and if not, determine that the process type of the process is a non-isolated process;

[0125] Determining whether the target identification information is greater than or equal to the first identification information, and if not, filtering the file operation request to isolate the file operation request;

[0126] Among them, the identification information set is the identification information set corresponding to the isolation domain of the isolation process type, and the first identification information is the identification information of the isolation domain corresponding to the file operation request.

[0127] It should be noted that the target identification information refers to the identification information associated with the process that initiates the file operation request, which represents the attributes of the process. The first identification information refers to the identification of the isolation domain where the resource or directory that the file operation request intends to access is located. The first identification information is related to the location information of the isolation domain in the virtual file system, and reflects the security level of the isolation domain of the operation request. When processing a file operation request, the embodiment of the present application will compare the target identification information and the first identification information to determine whether to allow the process to perform operations on the isolation domain.

[0128] It is understandable that before comparing the target identification information field and the first identification information, the priority of the process needs to be determined. In practical applications, the types of processes are divided into isolated processes and non-isolated processes. Isolated processes usually involve sensitive operations on the file system, while non-isolated processes do not involve these operations and are restricted to environments with lower permissions or can only access non-sensitive resources. In some embodiments, it can be determined whether the type of a process belongs to an isolated process or a non-isolated process based on the characteristic information of the process.

[0129] It is understandable that the identification information set of the isolation domain of the non-isolated process can be pre-built, and the target identification information of the process is determined based on the above isolation strategy. If the target identification information does not belong to the above identification information set, the process type of the process is determined to be a non-isolated process. For a non-isolated process, it cannot access an isolation domain with a higher security level than itself.

[0130] Here, in the embodiment of the present application, the identification information domain of the isolation domain corresponds to the security level. If the identification information is represented by a number, a lower number usually represents a lower security level. For example, the identification information of the isolation domain corresponding to the non-isolated process is -1, and the identification information of the isolation domain corresponding to the isolated process is 1. If it is determined that the target identification information is less than the first identification information, it indicates that the security level of the current process is low, and the security level corresponding to the file operation request of the process is high. The security level of the process is not enough and it cannot be allowed to perform the file operation. Then, the file operation request is filtered to isolate the file operation request.

[0131] In some embodiments, the virtual file system includes a plurality of isolation domains, the method further comprising:

[0132] In the user mode, the file isolation controller determines the identification information corresponding to each isolation domain based on the number of multiple isolation domains and the preset isolation domain naming rules;

[0133] For each piece of identification information, determining the process characteristic information corresponding to each piece of identification information and the isolation strategy corresponding to each piece of identification information;

[0134] Based on each identification information and each process characteristic information, a first mapping relationship is generated, where the first mapping relationship includes a correspondence between each isolation domain identification information and each process characteristic information;

[0135] Generate a second mapping relationship based on each identification information and each isolation strategy;

[0136] Based on the first mapping relationship and the second mapping relationship, an isolation policy library is generated.

[0137] It is understandable that the file isolation controller will set up the isolation policy library required by the file isolator in the user mode and send it to the file isolator. In the user mode, the file isolation controller works. It first generates a unique identification information for each isolation domain based on the number of multiple isolation domains configured in the virtual file system and a preset naming rule (which may involve elements such as domain names, user groups, security levels, etc.). These identification information are used to uniquely distinguish different isolation domains and serve as the basis for subsequent operations. For example, a domain number can be set for each isolation domain. The domain number serves as the identification information of the isolation domain. The domain number ranges from -1024 to 1024. The size of the domain number also indicates its corresponding security level. The security permissions of the isolation domain with a domain number less than 0 are set lower, and the security permissions of the isolation domain with a domain number greater than 0 are set higher.

[0138] It is understandable that for each identification information, the process characteristic information corresponding to each identification information is determined. Exemplarily, the process characteristic information corresponding to the process type of different processes is different. For isolated processes, which have a higher security level, it can be determined that the process characteristic information corresponding to a certain isolated process corresponds to an isolation domain identifier with a domain number greater than 0, and correspondingly, the process characteristic information of a certain non-isolated process corresponds to an isolation domain identifier with a domain number less than 0. In addition, the corresponding isolation policy is set for each identification information.

[0139] Here, each identification information has its corresponding process feature information and isolation strategy, and based on each identification information and each process feature information, a first mapping relationship is generated, the first mapping relationship includes the correspondence between each isolation domain identification information and each process feature information; based on each identification information and each isolation strategy, a second mapping relationship is generated; based on the first mapping relationship and the second mapping relationship, an isolation strategy library is generated. In this way, the isolation feature library not only stores the basic configuration of the isolation domain, but also integrates the distribution of processes and the corresponding isolation strategy, so that the subsequent file isolator can quickly and accurately apply the correct strategy when processing file operation requests, thereby improving the security of file protection.

[0140] In some embodiments, the method further comprises:

[0141] In response to the file operation request, determining a vnode event corresponding to the file operation request;

[0142] If the vnode event satisfies the mapping relationship, it is determined whether the hook of the call request is triggered. The mapping relationship is used to characterize the correspondence between each vnode event and each hook function.

[0143] It is understandable that the embodiments of the present application not only focus on the file operation itself, but also go deep into the virtual node level corresponding to the operation, achieving more fine-grained monitoring. Vnode (Virtual Node) is an abstract structure representing file system objects (such as files and directories) in UNIX-like systems. In this embodiment, when a file operation request is received, the system will further identify and determine the vnode event corresponding to the request.

[0144] It should be noted that the embodiment of the present application pre-sets a mapping relationship, which characterizes the association between different vnode events and specific hook functions. Only when the vnode event that occurs matches the preset mapping relationship will it be checked whether the corresponding hook function is triggered. This mechanism can take accurate security responses for specific vnode events, improving the system's ability to defend against targeted attacks.

[0145] In some embodiments, the virtual file system includes a plurality of isolation domains, the method further comprising:

[0146] If the feature information has no corresponding isolation policy in the isolation policy library, the process type of the process is determined based on the feature information;

[0147] Determine whether to isolate the file operation request based on the process type and the isolation domain corresponding to the file operation request.

[0148] It should be noted that the embodiments of the present application take into account that if there is no isolation policy pre-defined for a specific process, it is also possible to determine whether to isolate the file operation request based on the process type to which the device belongs and the isolation domain corresponding to the file operation request. Through the dual consideration of process type and isolation domain, the solution achieves multi-level security protection. Not only the properties of a single process are considered, but also the security context of the overall environment in which it is located is incorporated to ensure that the isolation decision is more reasonable and comprehensive. For example, even if a process is a non-isolated process, if the intention of its file operation request is to attempt to access files in a sensitive isolation domain, the system can still decide whether to implement isolation based on the security level of the isolation domain.

[0149] In this way, even without customized policies for specific processes, security controls based on isolation domains can still provide a basic protection network to ensure that key resources or sensitive data areas are not potentially threatened by undefined processes and to avoid the escape of unknown processes.

[0150] The present application also provides a file protection system. The overall structure of the file protection system is as follows: Figure 2 As shown, the file protection system includes: an isolation controller and a file isolator, and the isolation controller and the file isolator are configured to execute the above-mentioned file system protection method.

[0151] exist Figure 2 In the kernel state, the file isolator exists in the form of kernel extension and is loaded by the isolation controller. In the user state, the isolation controller will send the isolation policy to the file isolator according to business needs. When the isolated process (process 1, process 2 and process 3) falls into the kernel state through the file system call, the corresponding file system operation function hook running in the VFS layer will be triggered, and then enter the file isolator. The isolator divides the process into its isolation domain according to the policy, such as isolation domain 1. The files operated by the process are redirected to the isolation storage corresponding to its priority, and the isolation storage can cross the file system. Correspondingly, for non-isolated processes (process 1, process 2 and process 3), the domain of the non-isolated process is 0. In this application example, the non-isolated process is only allowed to access files in the isolation domain with a domain number less than 0 (such as isolation domain-1 in the figure), and is not allowed to access files in the isolation domain with a domain number greater than 0 (such as isolation domain 1 in the figure).

[0152] In some embodiments, Figure 3 As shown, the isolation controller includes: a first communication module and an isolator management module. The first communication module is responsible for communicating with the isolator using the IOKIT framework, and the isolator management module is responsible for loading the isolator, collecting isolation logs through the communication module, and issuing isolation policies. In addition, the isolation controller also includes N business modules.

[0153] In some embodiments, the file isolator includes: a second communication module, a policy decision module, a file redirection module, and a file filtering module. The second communication module is used to receive the isolation policy library and the hook trigger indication information in the kernel state operation mode; the policy decision module is used to obtain the characteristic information of the process; based on the characteristic information and the isolation policy library, the isolation policy of the process is determined, the isolation policy library includes the correspondence between each characteristic information and each isolation policy, and the isolation policy includes a redirection rule; the redirection module is used to redirect the file operation request of the process to the virtual file system based on the redirection rule; wherein the hook trigger indication information is generated in response to the call request of the process for the file system. The file isolator also includes a file filtering module, the file filtering module is used to obtain the operation directory information corresponding to the file operation request; based on the operation directory information, determine the operation directory type corresponding to the operation directory information; if the operation directory type is the root directory, determine that the operation directory information does not meet the directory isolation rule, and filter the file operation request to isolate the file operation request.

[0154] For example, Figure 4As shown, the file isolator includes: a second communication module, a hook module, the second communication module is responsible for communicating with the isolation controller, the hook module contains hooks for the file system operation functions in the vnode structure, and the operation functions are: vnop_reclaim, vnop_read, vnop_open, vnop_write, vnop_pagein, vnop_pageout, vnop_lookup, vnop_create, vnop_close, vnop_inactive, vnop_rename, vnop_exchange, vnop_getattr. The policy decision module is responsible for judging whether the process needs to be isolated and whether the process is allowed to access files in the isolation domain based on the process credentials and process context. The global cache module contains the domain cache where the process is located, the vnode mapping table, and the hook mapping table for other modules to query. The file redirection module is responsible for redirecting the files accessed by the process to the isolation domain according to the results returned by the policy decision module. The file filtering module is responsible for filtering non-isolated processes from accessing isolation domain files according to the results returned by the policy decision module, and preventing isolation domain processes from escaping root file system isolation.

[0155] Below, the embodiment of the present application is described in detail with reference to an application example.

[0156] This application example proposes a solution for isolating the root file system of macOS processes. Based on the kernel extension, the file system operation function is hooked, the root file system of the user-mode process can be isolated, and the access of the non-isolated process to the root directory of the isolated process can be filtered. The isolation process is completely transparent and will not be perceived by the isolated process. In addition, the solution of this application embodiment can also be used to build sandbox applications.

[0157] The key to this application example is that it consists of two parts: an isolation controller running in user mode and an isolator running in kernel mode. The isolation controller is responsible for loading the isolator, issuing isolation policies, and creating isolation domains. The kernel isolator is implemented based on kernel extensions. When the isolated process performs file operations, the hook of the corresponding file system operation function is triggered, and the path of the operated file will dynamically determine whether to add the prefix of the corresponding isolation domain according to the policy. If a prefix is ​​added, for the isolated process, it is equivalent to its root file system being isolated in a virtual domain, so it cannot access real file resources outside the isolation domain. Isolation domains can be on different file systems or on the same file system. Different processes belong to different domains, ranging from -1024 to 1024, and the domain of non-isolated processes is 0. Files in isolation domains with domain numbers greater than 0 cannot be accessed by non-isolated processes.

[0158] In this way, this application example combines the kernel isolator with the user-mode controller so that the isolator and the controller can work together to achieve a more flexible and complex root file system isolation mechanism. The kernel-mode file system isolator runs between the VFS layer and the file system layer, so that the file data can be fully controlled and can cross file systems. Since the isolator runs in the kernel mode, the isolated process cannot perceive the existence of the isolator, and it is more difficult to escape isolation.

[0159] First, the structure of the isolation strategy set by the isolation controller is explained. Figure 5 As shown, Figure 5 This is a schematic diagram of the isolation strategy for this application example.

[0160] Isolation strategies such as Figure 5 As shown, the isolation policy includes a policy header and a set of isolation policies (N). The policy header describes a set of isolation domains (isolation domain N), including domain numbers and domain root directories. The domain number ranges from -1024 to 1024. Non-isolated processes are only allowed to access files in domains with domain numbers less than 0, which is used to implement process behavior analysis applications. Isolation domains with domain numbers less than 0 are used to isolate malicious processes. The files they operate are non-important and non-high-level files, so non-isolated processes can access them. Non-isolated processes are not allowed to access isolation domains with domain numbers greater than 0, which is used to implement workspace applications with high-level file protection. The isolation policy includes: isolated process characteristics, isolation domains, and isolation rule groups. Isolation process characteristics describe which processes need to be isolated, including process pid, parent process pid, process path, process name, and environment variables. The field can be set to empty to achieve a looser isolation process match. The isolation domain number N associates the process with the isolation domain to which it is isolated. The isolation rule group contains a series of isolation rules. For example, the isolation rule 1 corresponding to the path / system in the figure is not isolated, and the rule 2 corresponding to the path / Users is isolated. The root directory is isolated by default. Since macOS has read-only mounted directories, some read-only mounted directories can be placed in non-isolated rules. When the isolated process accesses files in non-isolated directories, the real files are used directly.

[0161] Based on the above isolation strategy, this application example describes the operation process of the isolation controller in detail. The operation flow chart of the isolation controller is as follows: Figure 6 As shown, the specific steps are as follows:

[0162] Step 601: Start.

[0163] Step 602: Check whether the isolation domain has a root. If not, execute step 603. If not, execute step 604.

[0164] In actual application, after startup, the isolation controller first prepares the root directory required by the isolation process in the isolation domain, so that the isolated process can run normally under a virtual root directory. The controller first traverses the isolation domain in turn, and if the root directory does not exist, step 603 is executed, and if not, step 604 is executed.

[0165] Step 603: Create N root directories.

[0166] In actual applications, if it is determined that there is no root in the isolation domain, a root directory is created. The subdirectories under the root directory include: / Library, / tmp, / var, / opt, / Users, / bin, and / private.

[0167] Step 604: Create an isolation policy.

[0168] In actual applications, after creating the root directory, the controller will create an isolation policy.

[0169] Step 605: Load the file isolator kernel extension.

[0170] In actual application, after creating the root directory, the controller will create an isolation policy. Then the controller loads the kernel extension of the file isolator through the kextload command and executes step 606.

[0171] Step 606: Obtain the IOKIT service provided by the file isolator.

[0172] Step 607: Open the IOKOT service provided by the file isolator.

[0173] Get the IOKIT service provided by the isolator, and then open the IOKIT service provided by the file isolator.

[0174] Step 608: Send the policy.

[0175] In actual applications, the isolation policy can be issued through the interface provided by the isolator.

[0176] Step 609: Determine whether the file isolator uploads the audit log. If so, execute step 610; if not, continue to execute step 609.

[0177] Then, the isolation controller also provides an interface for receiving the audit log to the isolator in reverse, and uses the interface to collect the process file audit log, which is uploaded by the file isolator. In actual application, it is determined whether the file isolator uploads the audit log, and if so, step 610 is executed.

[0178] Step 610: Collect audit logs.

[0179] Next, we take the underlying vode event as an example to explain the operation flow of the isolator hook file system operation function. The process of the isolator hook file system operation function is as follows: Figure 7 As shown, the specific steps are as follows:

[0180] Step 701: Kernel extension is loaded.

[0181] After the isolator kernel extension is loaded, the kernel will automatically run the start function in the IOService registered by the extension to the kernel.

[0182] Step 702: IOService::start runs.

[0183] Here, in the start function, the isolator will be initialized.

[0184] Step 703: Register kauth callback.

[0185] First, register the vnode event callback with the kauth framework officially provided by Apple, and set it to focus only on events within the vnode range.

[0186] Step 704: Initialize the vnode mapping table.

[0187] Then initialize the vnode mapping relationship table, which is used to store the mapping relationship between the original vnode and the isolated vnode.

[0188] Step 705: Initialize the hook mapping table.

[0189] Then, a mapping relationship table of the file system operation function hook is initialized to store the relationship between the original file system operation function and the file system operation function hook.

[0190] Step 706: Wait to see if the policy is enabled. If so, execute step 707. If not, continue to execute step 706.

[0191] Then the isolator gives up the CPU time slice and waits for the application layer controller to send the isolation policy. When the policy does not exist, the policy is not enabled, and no operation is performed in the register vnode event callback, and it returns directly to continue to execute step 706. After the controller connects to the isolator through the IOKIT service and sends the policy, if it is determined that the policy is enabled, it executes step 707.

[0192] Step 707: Wait to see if there is a vnode event. If yes, execute step 708. If no, continue to execute step 707.

[0193] Step 708: Determine whether the isolation strategy is satisfied. If so, execute step 709; if not, continue to execute step 708.

[0194] In actual applications, when the controller is connected to the isolator through the IOKIT service and issues a policy, it will obtain the process credentials corresponding to the vnode in the registered vnode event callback to determine whether the process meets the isolation policy. If the conditions are met, step 709 is executed; if not, the file system operation function in the vnode operated by the process that does not meet the isolation conditions will not be hooked. After the file operating system function is hooked, all operations on the vnode will be processed by the isolator, and step 708 is executed.

[0195] Step 709: hook the FS operation function of the vnode.

[0196] After determining whether the process meets the conditions, the vnode operated by the process will be obtained, and the file system operation function in the vnode structure will be replaced for hooking, and the mapping relationship will be saved in the hook mapping relationship table. For processes that do not meet the isolation conditions, the file system operation function in the vnode they operate will not be hooked.

[0197] Step 710: hook the FS operation function of the parent vnode.

[0198] When the conditions are met, the parent vnode of the process operation will be obtained, and the file system operation function in the vnode structure will be replaced for hooking.

[0199] Step 711: Save the hook mapping.

[0200] When the conditions are met, the vnode and parent vnode of the process operation are obtained, and the file system operation function in the vnode structure is replaced for hooking, and the mapping relationship is saved in the hook mapping relationship table.

[0201] Step 712: Clear the name cache.

[0202] Finally, the name cache is cleared to ensure that when searching for the corresponding vnode by file name, the corresponding child vnode is searched from the parent vnode each time, bypassing the search through the name cache.

[0203] In this way, in the isolator, the process context of the vnode operation will be obtained, the isolation policy will be matched, and the isolation process will be run.

[0204] like Figure 8 The specific isolation process is as follows Figure 8 As shown, the specific steps are as follows:

[0205] Step 801: Process operation file.

[0206] Step 802: System call.

[0207] Here, process root file isolation is provided by the file redirection module in the isolator. When a process operates a file, it enters the kernel state through a system call.

[0208] Step 803: VFS file operation interface.

[0209] Then call the file operation interface provided by VFS.

[0210] Step 804: Determine whether the vnode FS operation function is hooked, if so, execute steps 805 to 812, if not, execute step 813.

[0211] Here, the file system operation function in the vnode corresponding to the file is triggered. If the file operation function of the vnode is not hooked, step 813 is executed. If it is called, steps 805 to 812 are executed.

[0212] Step 805: Get the process cache.

[0213] Here, since the vnode operation function corresponding to the file is hooked, it will enter the file isolator. Then, in the isolator, according to the process context, the isolation domain to which the process belongs is obtained according to the pid, and then the policy decision module is entered to make a decision based on the isolation domain or process information.

[0214] Step 806: Determine whether the isolation rule is hit, if so, execute steps 807 to 810, if not, execute step 811.

[0215] Here, if the policy decision module determines that the isolation rule is not hit, step 811 is executed to directly operate the original vnode without isolation. If the isolation rule is hit, step 807 is executed.

[0216] Step 807: Determine whether the vnode has been isolated, if so, execute step 808, if not, execute step 809.

[0217] Here, if it is determined that the isolation policy is satisfied and the vnode is isolated, that is, an isolation mapping relationship exists, step 808 is executed; if it is determined that the isolation policy is satisfied, but the vnode does not have an isolation mapping relationship, step 809 is executed.

[0218] Step 808: Get vnode mapping.

[0219] If the isolation policy is met and the vnode already has an isolation mapping relationship, it means that the vnode has been isolated, then the isolated vnode is obtained directly.

[0220] Step 809: Create an isolation vnode mapping.

[0221] Here, if the isolation strategy vnode does not have an isolation mapping relationship, an isolation vnode is created, and the relationship between the isolation vnode and the vnode is saved in the mapping table.

[0222] Step 810: Update the isolation vnode map.

[0223] Step 811: Update the process cache.

[0224] Step 812: Query the hook mapping table.

[0225] Finally, query the hook mapping table and call the original file system operation function to operate the isolated vnode.

[0226] Step 813: Call the original file system operation function to operate the vnode.

[0227] Here, if the file operation function of the vnode is not hooked, the original file system operation function is called.

[0228] If the hook mapping table is queried and the original file system operation function is called to operate the isolated vnode, since the operation is on the isolated vnode, the file operated by the process is redirected, and the file actually operated is the isolated file.

[0229] Step 814: Trigger vnode callback.

[0230] After the call returns, trigger Figure 7 The vnode callback in the hook process shown in the figure, then all the operation functions of the vnode may be hooked (depending on whether the isolation policy is met). When the same file is operated next time and enters the VFS file operation interface, since the vnode operation function corresponding to the file is hooked, it will enter the file isolator. Then in the isolator, according to the process context, the isolation domain to which the process belongs is obtained according to the pid, and then the policy decision module is entered to make a decision based on the isolation domain or process information.

[0231] In addition, in order to avoid the situation where there is no corresponding isolation policy for process characteristics, this application example provides a schematic diagram of the isolation domain protection process. Fig. 9 As shown in the figure, the file protection process of the isolation domain is as follows Fig. 9 As shown, the specific steps are as follows:

[0232] Step 901: Wait for vnode events.

[0233] Here, the isolation domain protection can filter non-isolated domain processes from accessing files with an isolation domain number greater than 0, and filter isolated processes from escaping isolation. The isolation domain protection is provided by the file filtering module in the isolator. All vnode events in the system will be acquired by the file filtering module.

[0234] Step 902: Get the process context.

[0235] Here, the process context is first obtained within the module.

[0236] Step 903: Get the domain where the vnode is located.

[0237] Then determine the isolation domain where the process is located based on the process context, and then determine the isolation domain where the operation vnode is located.

[0238] Step 904: Determine whether it is an isolated process, if so, execute step 905, if not, execute step 906.

[0239] Next, if it is a non-isolated process, execute step 906, if it is an isolated process, execute step 905. If it is an isolated process, determine the parent path of the path where the vnode is located by recursive search operation, and determine whether it is a non-isolated directory and execute step 905.

[0240] Step 905: Check whether the directory where the vnode is located is not isolated. If so, execute step 909; if not, execute step 907.

[0241] Here, if it is an isolated process, the parent path of the path where the vnode is located is determined by recursive search to determine whether it is a non-isolated directory. If so, step 909 is executed, if not, step 907 is executed.

[0242] Step 906: Is the isolation domain where the vnode is located less than 0? If so, execute step 909; if not, execute step 908.

[0243] If it is a non-isolated process, continue to determine whether the isolation domain where the vnode is located is less than 0. If so, access is allowed and step 909 is executed. If not, access is not allowed and step 908 is executed.

[0244] Step 907: Determine whether the isolation domain where the vnode is located is equal to the process isolation domain. If so, execute step 909; if not, execute step 908.

[0245] Here, if it is determined to be an isolation directory, determine whether the isolation domain where the vnode is located is equal to the isolation domain of the isolation process. If so, execute step 909. In this way, access is allowed only when the domains are the same, which can prevent escape behavior; if not, execute step 908.

[0246] Step 908: Access denied.

[0247] Step 909: Access is allowed.

[0248] This application example implements process root file system isolation through kernel hook. Combined with flexible isolation strategies, this method can isolate a part of the directory separately, thus supporting complex application scenarios. This method can be used to build macOS sandbox application products including: workspace file leakage prevention, application behavior analysis, etc. This method cannot be perceived by the process, the isolation effect is obvious, and it is difficult to escape file isolation.

[0249] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a file system protection device, which corresponds to the above-mentioned file system protection method, and each step in the above-mentioned file system protection method embodiment is also completely applicable to the file system protection method device embodiment. Fig.10 As shown, the protection device of the file system includes: an acquisition module 1010, a determination module 1020 and a redirection module 1030, wherein the acquisition module 1010 is used for the file isolator to obtain feature information of the process in response to the file operation request of the process for the file system in the kernel state operation mode; the determination module 1020 is used to determine the target isolation policy based on the feature information and the isolation policy library, the isolation policy library includes the correspondence between each feature information and each isolation policy, and the target isolation policy includes redirection rules; the redirection module 1030 is used to redirect the file operation request of the process to the virtual file system based on the redirection rules; wherein the isolation policy library is generated by the isolation controller when the file system is in the user state operation mode and sent to the file isolator.

[0250] In some embodiments, the virtual file system includes multiple isolation domains, and the redirection module 1030 is further used to redirect the file operation request to the target isolation domain based on the redirection rule and the target identification information, and the target isolation domain is one of the multiple isolation domains.

[0251] In some embodiments, the file system protection device also includes a generation module 1040, which is used to generate a call request to the file system in response to a file operation request of the process for the file system; the determination module 1020 is also used to respond to the call request based on the virtual file system operation interface, the file system enters the kernel state operation mode, and determines whether the hook of the call request is triggered; if so, a hook trigger indication information is generated to the file isolator.

[0252] In some embodiments, the isolation strategy also includes: a first isolation rule corresponding to the target isolation domain, and the file system protection device also includes an isolation device 1050, which is used to determine whether to redirect the file operation request to the target isolation domain, and then isolate the file operation request based on the first isolation rule.

[0253] In some embodiments, the acquisition module 1010 is also used to obtain the operation directory information corresponding to the file operation request; the determination module 1020 is also used to determine the operation directory type corresponding to the operation directory information based on the operation directory information; the isolation module 1050 is also used to filter the file operation request if the operation directory type is a root directory, so as to isolate the file operation request.

[0254] In some embodiments, the first isolation rule includes an identification information set, and the determination module 1020 is also used to determine whether the target identification information belongs to the identification information set. If not, the process type of the process is determined to be a non-isolated process; the isolation module 1050 is also used to determine whether the target identification information is greater than or equal to the first identification information. If not, the file operation request is filtered to isolate the file operation request; wherein the identification information set is an identification information set corresponding to the isolation domain of the isolation process type, and the first identification information is the identification information of the isolation domain corresponding to the file operation request.

[0255] In some embodiments, the virtual file system includes multiple isolation domains, and the determination module 1020 is also used to determine, in the user mode operation mode, the file isolation controller, based on the number of multiple isolation domains and the preset isolation domain naming rules, the identification information corresponding to each isolation domain; for each identification information, determine the process characteristic information corresponding to each identification information and the isolation policy corresponding to each identification information; the generation module 1040 is also used to generate a first mapping relationship based on each identification information and each process characteristic information, the first mapping relationship including the correspondence between each isolation domain identification information and each process characteristic information; based on each identification information and each isolation policy, generate a second mapping relationship; based on the first mapping relationship and the second mapping relationship, generate an isolation policy library.

[0256] In some embodiments, the determination module 1020 is also used to respond to the file operation request and determine the vnode event corresponding to the file operation request; if the vnode event satisfies the mapping relationship, it determines whether the hook of the call request is triggered, and the mapping relationship is used to characterize the correspondence between each vnode event and each hook function.

[0257] In some embodiments, the virtual file system includes multiple isolation domains, and the determination module 1020 is also used to determine the process type of the process based on the feature information if there is no corresponding isolation policy in the isolation policy library for the feature information; and determine whether to isolate the file operation request based on the process type and the isolation domain corresponding to the file operation request.

[0258] In actual application, the acquisition module 1010, the determination module 1020, the redirection module 1030, the generation module 1040 and the isolation module 1050 can be implemented by a processor in the protection device of the file system. Of course, the processor needs to run the computer program in the memory to implement its function.

[0259] It should be noted that: the file system protection device provided in the above embodiment only uses the division of the above program modules as an example to illustrate when protecting the file system. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the above-described processing. In addition, the file system protection device provided in the above embodiment and the file system protection method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0260] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a file system protection device. Fig.11 Only an exemplary structure of the file system protection device is shown, not the entire structure, and can be implemented as needed. Fig.11 Partial or complete structure shown.

[0261] like Fig.11 As shown, the file system protection device 1100 provided in the embodiment of the present application includes: at least one processor 1101, a memory 1102, a user interface 1103 and at least one network interface 1104. The various components in the file system protection device 1100 are coupled together through a bus system 1105. It can be understood that the bus system 1105 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1105 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig.11 Various buses are labeled as bus system 1105.

[0262] The user interface 1103 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0263] The memory 1102 in the embodiment of the present application is used to store various types of data to support the operation of the file system protection device 1100. Examples of such data include: any computer program used to operate on the file system protection device.

[0264] The file system protection method disclosed in the embodiment of the present application can be applied to the processor 1101, or implemented by the processor 1101. The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the file system protection method can be completed by the hardware integrated logic circuit or software instructions in the processor 1101. The above-mentioned processor 1101 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1101 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 1102. The processor 1101 reads the information in the memory 1102 and completes the steps of the file system protection method provided in the embodiment of the present application in combination with its hardware.

[0265] In an exemplary embodiment, the file system protection device can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0266] It can be understood that the memory 1102 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0267] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, which can be a computer-readable storage medium, for example, a memory 1102 storing a computer program, and the computer program can be executed by a processor 1101 of the file system protection device to complete the steps of the method of the present application embodiment. The computer-readable storage medium can be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0268] Illustratively, an embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the processor 1101 of the file system protection device 1100 to complete any of the aforementioned method steps.

[0269] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0270] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0271] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for protecting a file system, characterized in that: The method comprises: In the kernel state operation mode, the file isolator obtains characteristic information of the process in response to the hook trigger indication information; Determining an isolation strategy for the process based on the feature information and an isolation strategy library, wherein the isolation strategy library includes a correspondence between each feature information and each isolation strategy, and the isolation strategy includes a redirection rule; Based on the redirection rule, redirecting the file operation request of the process to the virtual file system; The isolation policy library is generated by the isolation controller and sent to the file isolator when the file system is in user mode, and the hook trigger indication information is generated in response to the process's call request for the file system.

2. The method according to claim 1, characterized in that The virtual file system includes multiple isolation domains, and the isolation strategy also includes: target identification information of the target isolation domain, and redirecting the file operation request of the process to the virtual file system based on the redirection rule includes: Based on the redirection rule and the target identification information, the file operation request is redirected to the target isolation domain, where the target isolation domain is one of the multiple isolation domains.

3. The method according to claim 1, characterized in that The method further comprises: In response to a file operation request of the process for the file system, generating a call request for the file system; In response to the call request based on the virtual file system operation interface, the file system enters a kernel state operation mode, and determines whether a hook of the call request is triggered; If so, a hook trigger indication message is generated to the file isolator.

4. The method according to claim 2, characterized in that: The isolation strategy further includes: a first isolation rule corresponding to the target isolation domain, and the method further includes: If it is determined that the file operation request is redirected to the target isolation domain, the file operation request is isolated based on the first isolation rule.

5. The method according to claim 4, characterized in that The isolating the file operation request based on the first isolation rule includes: Obtaining operation directory information corresponding to the file operation request; Based on the operation catalog information, determining the operation catalog type corresponding to the operation catalog information; If the operation directory type is a root directory, the file operation request is filtered to isolate the file operation request.

6. The method according to claim 4, characterized in that The first isolation rule includes an identification information set, and isolating the file operation request based on the first isolation rule includes: Determining whether the target identification information belongs to the identification information set, and if not, determining that the process type of the process is a non-isolated process; Determining whether the target identification information is greater than or equal to the first identification information, and if not, filtering the file operation request to isolate the file operation request; Among them, the identification information set is an identification information set corresponding to the isolation domain of the isolation process type, and the first identification information is the identification information of the isolation domain corresponding to the file operation request.

7. The method according to claim 1, characterized in that The virtual file system includes a plurality of isolation domains, and the method further includes: In the user state operation mode, the file isolation controller determines identification information corresponding to each isolation domain based on the number of the multiple isolation domains and a preset isolation domain naming rule; For each piece of identification information, determine the process characteristic information corresponding to each piece of identification information and the isolation strategy corresponding to each piece of identification information; Based on each of the identification information and each of the process characteristic information, a first mapping relationship is generated, wherein the first mapping relationship includes a correspondence between each of the isolation domain identification information and each of the process characteristic information; Based on each of the identification information and each of the isolation strategies, generate a second mapping relationship; The isolation policy library is generated based on the first mapping relationship and the second mapping relationship.

8. The method according to claim 3, characterized in that The method further comprises: In response to the file operation request, determining a vnode event corresponding to the file operation request; If the vnode event satisfies the mapping relationship, it is determined whether the hook of the call request is triggered, and the mapping relationship is used to characterize the corresponding relationship between each vnode event and each hook function.

9. The method according to claim 1, characterized in that: The virtual file system includes a plurality of isolation domains, and the method further includes: If there is no corresponding isolation policy in the isolation policy library for the characteristic information, determining the process type of the process based on the characteristic information; Based on the process type and the isolation domain corresponding to the file operation request, determine whether to isolate the file operation request.

10. A file system protection device, characterized in that: The device comprises: An acquisition module, used for, in a kernel state operation mode, the file isolator responding to a file operation request of a process for a file system to acquire characteristic information of the process; A determination module, configured to determine a target isolation strategy based on the feature information and an isolation strategy library, wherein the isolation strategy library includes a correspondence between each feature information and each isolation strategy, and the target isolation strategy includes a redirection rule; A redirection module, used for redirecting the file operation request of the process to the virtual file system based on the redirection rule; The isolation policy library is generated by the isolation controller and sent to the file isolator when the file system is in the user mode.

11. A file protection system, characterized in that: include: An isolation controller and a file isolator, wherein the isolation controller and the file isolator are configured to execute the steps of the method according to any one of claims 1 to 9.

12. The file protection system according to claim 11, wherein the isolation controller comprises: The first communication module and the isolator management module, the file isolator includes: a second communication module, a policy decision module and a file redirection module; wherein, The isolator management module is used to load the file isolator; The first communication module is used to generate and send an isolation policy library to the second communication module when the file system is in a user mode operation mode; The second communication module is used to receive the isolation policy library and the hook trigger indication information in the kernel state operation mode; The policy decision module is used to obtain feature information of the process; determine the isolation policy of the process based on the feature information and the isolation policy library, the isolation policy library includes the correspondence between each feature information and each isolation policy, and the isolation policy includes a redirection rule; The redirection module is used to redirect the file operation request of the process to the virtual file system based on the redirection rule; The hook trigger indication information is generated in response to a call request from a process to a file system.

13. The file protection system according to claim 12, characterized in that: The file isolator further includes a file filtering module, the file filtering module is used to obtain the operation directory information corresponding to the file operation request; based on the operation directory information, determine the operation directory type corresponding to the operation directory information; If the operation directory type is a root directory, it is determined that the operation directory information does not satisfy the directory isolation rule, and the file operation request is filtered to isolate the file operation request.

14. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images