Control method and first equipment

Abstract

The invention discloses a control method and first equipment. The control method applied to the first equipment comprises the following steps: acquiring a shared file from second equipment; determining that the shared file meets a risk file judgment condition; executing the shared file in the isolation environment of the first equipment, wherein the system environment of a first operating system of the first equipment is not influenced when the shared file runs in the isolation environment; wherein the first equipment is provided with a first operating system, the second equipment is provided with a second operating system, the first operating system is different from the second operating system, and the shared file does not cause risks to the second operating system of the second equipment.

Description

Technical Field

[0001] The present application relates to the technical field of file sharing, and in particular to a control method and a first device. Background Art

[0002] The technology of sharing files between different devices provides convenience for users to access and operate the same file based on different devices, and also effectively improves the efficiency of file processing. However, the same file or program may generate different security risks on different devices. For example, file A is not a risky file on device 1, but it is a risky file on device 2, which means that opening file A on device 2 will affect the security of device 2. Therefore, how to ensure the security of different devices for file sharing has become an urgent problem to be solved. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a control method and a first device.

[0004] In a first aspect, an embodiment of the present application provides a control method, including:

[0005] Retrieve a shared file from a second device;

[0006] Determining that the shared file meets a risk file determination condition;

[0007] Execute the shared file in the isolated environment of the first device, wherein the shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device;

[0008] The first device has a first operating system, the second device has a second operating system, the first operating system is different from the second operating system, and the shared file does not pose a risk to the second operating system of the second device.

[0009] In a possible implementation manner, determining whether the shared file meets the risk file determination condition includes at least one or more of the following methods:

[0010] Acquire a first path of the shared file on the first device, and determine whether the shared file meets a risk file determination condition based on the first path;

[0011] Determine the file type of the shared file, and determine whether the shared file meets a risk file determination condition based on the file type;

[0012] Authentication is performed on the shared file, and whether the shared file meets a risk file determination condition is determined according to the authentication result.

[0013] In a possible implementation manner, the shared file satisfies at least one of the following risk file determination conditions:

[0014] The first directory to which the first path belongs enables the first device to access the second device;

[0015] Files of the file type can be run on the first device but cannot be run on the second device;

[0016] The verification result indicates that the identity authentication of the shared file has failed.

[0017] In a possible implementation, executing the shared file in the isolated environment of the first device includes:

[0018] Determine a target process corresponding to executing the shared file;

[0019] Monitoring access objects of the target process;

[0020] Determining that the access object meets the redirection condition;

[0021] Respond to the operation on the access object based on the isolation environment.

[0022] In a possible implementation manner, determining that the access object meets the redirection condition at least includes:

[0023] The access object belongs to the first device, and the target process includes any execution operation of writing, modifying, starting or associating with other processes.

[0024] In a possible implementation manner, after determining that the shared file meets the risk file determination condition, the method includes:

[0025] Setting a risk mark for the shared file;

[0026] The process of executing the shared file in the isolated environment of the first device also includes:

[0027] Monitoring all processes running in the first device;

[0028] Determine a process including the risk tag in the process file, and respond to the operation of the process based on the isolation environment.

[0029] In a possible implementation, the acquiring the shared file from the second device includes:

[0030] Determine a first directory to which a first path corresponding to the shared file belongs;

[0031] Determine a second directory based on the first directory, where the second directory is a directory for storing file data of the shared file on the second device, and the second directory is not visible on the first device;

[0032] The file data of the shared file is obtained according to the second directory.

[0033] In a second aspect, an embodiment of the present application further provides a control method, which is applied to a second device, and the control method includes:

[0034] Establishing a virtual directory, wherein the virtual directory can realize file sharing between a first device and the second device, wherein the first device has a first operating system, and the second device has a second operating system, and the first operating system is different from the second operating system;

[0035] Obtaining an access request from the first device for a target shared file under the virtual directory;

[0036] In response to the access request, the target shared file is obtained based on a mapping relationship between the virtual directory and a real storage directory of the target shared file;

[0037] The target shared file is sent to the first device so that when the first device determines that the risk file determination condition is met, the target shared file is executed in the isolated environment of the first device, and the target shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device.

[0038] In a third aspect, an embodiment of the present application further provides a first device, including:

[0039] An acquisition module configured to acquire a shared file from a second device;

[0040] A determination module configured to determine that the shared file meets a risk file determination condition;

[0041] an execution module configured to execute the shared file in the isolated environment of the first device, wherein the shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device;

[0042] The first device has a first operating system, the second device has a second operating system, the first operating system is different from the second operating system, and the shared file does not pose a risk to the second operating system of the second device.

[0043] In the control method of the embodiment of the present application, after the first device obtains the shared file of the second device and determines that the shared file meets the risk file judgment condition, the shared file is executed in the isolated environment of the first device, wherein the running of the shared file in the isolated environment does not affect the system environment of the first operating system of the first device, that is, it effectively avoids the impact of the shared file on the system environment of the first operating system, thereby ensuring the security of the first device. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 A flow chart of a control method provided by the present application is shown;

[0046] Figure 2 A flow chart showing execution of a shared file in an isolated environment of a first device in a control method provided by the present application is shown;

[0047] Figure 3 A flow chart of obtaining a shared file from a second device in a control method provided by the present application is shown;

[0048] Figure 4 A flow chart showing another control method provided by the present application is shown;

[0049] Figure 5 A schematic diagram of a virtual directory and its corresponding mapping relationship provided by the present application is shown;

[0050] Figure 6 A schematic diagram of the structure of a first device provided by the present application is shown;

[0051] Figure 7 A schematic structural diagram of a second device provided in the present application is shown. DETAILED DESCRIPTION

[0052] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0053] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0054] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0055] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0056] It should also be understood that, although the present application has been described with reference to some specific examples, those skilled in the art will be able to realize many other equivalent forms of the present application that have the features described in the claims and are therefore within the scope of protection defined thereby.

[0057] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0058] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0059] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0060] To facilitate understanding of the present application, a control method provided by the present application is first introduced in detail.

[0061] Figure 1 The flowchart of the control method provided in the embodiment of the present application is shown, and the control method is applied to the first device. The specific steps of the control method include S101-S103.

[0062] S101: Acquire a shared file from a second device.

[0063] In one embodiment, the second device and the first device are interconnected devices in the same local area network, and the second device may be one or more. The local area network may be based on a short-range communication network protocol such as WIFI and / or Bluetooth.

[0064] The shared files include but are not limited to exe files and rich text documents. The shared files are stored on the second device, and the first device can access the shared files on the second device in accordance with the sharing protocol. In one embodiment, the second device is connected to the first device via the World Wide Web, and the first device can access the shared files on the second device. In one embodiment, the second device is connected to the first device via a hybrid network of the World Wide Web and a wireless network.

[0065] In response to an acquisition operation performed by the user, a shared file located on the second device is acquired based on a sharing protocol.

[0066] S102: Determine whether the shared file meets the risk file determination condition.

[0067] The first device has a first operating system, the second device has a second operating system, and the first operating system is different from the second operating system. For example, the first operating system of the first device is a Windows system, and the second operating system of the second device is an Android system or an IOS system or other non-Windows systems. In addition, since the shared file is stored in the second device, the shared file does not pose a risk to the second operating system of the second device.

[0068] Considering that the first operating system is different from the second operating system, based on this, after the first device obtains the shared file, it is further determined whether the shared file meets the risk file determination condition, that is, whether the shared file poses a risk to the first operating system of the first device.

[0069] S103, executing the shared file in the isolated environment of the first device, where the shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device.

[0070] After determining that the shared file meets the risk file determination condition, that is, the shared file will pose a risk to the first operating system of the first device, the shared file is executed in the isolation environment of the first device. The isolation environment is pre-built on the first device, such as based on a sandbox, and the shared file runs in the isolation environment without affecting the system environment of the first operating system of the first device.

[0071] The embodiment of the present application is arranged in a pre-built isolation environment to execute shared files that meet the risk file determination conditions, thereby effectively avoiding the impact of the shared files on the system environment of the first operating system and ensuring the security of the first device.

[0072] Furthermore, the above is to determine whether the shared file meets the risk file determination conditions, but it does not determine whether the shared file poses a risk to the first operating system. Based on this, during the execution of the shared file in the isolated environment of the first device, the isolated environment can monitor the process corresponding to the execution of the shared file in real time, and analyze the process information to determine whether the shared file poses a risk to the first operating system. If it is determined that the shared file poses a risk to the first operating system, a deletion instruction for the shared file is generated, and the deletion instruction is fed back to the second device through the first device, so that the second device responds to the deletion instruction, that is, the shared file is deleted, thereby avoiding the security risks caused by the first device accessing the shared file.

[0073] Furthermore, since other devices may be arranged in the local area network where the first device and the second device are located, other devices may also access the shared files on the second device. Therefore, when the second device deletes the shared files, the potential safety hazard caused by other devices accessing the shared files can be avoided, thereby ensuring the security of the local area network where the first device and the second device are located, and greatly reducing the security risk of file sharing between the devices (the first device, the second device and other devices) in the local area network. Accordingly, the security risk of new devices joining the local area network is also reduced.

[0074] Optionally, the method of determining whether a shared file meets the risk file determination condition provided in the embodiment of the present application includes at least one or more of the following methods:

[0075] The first

[0076] Obtain a first path of the shared file on the first device, and determine whether the shared file meets the risk file determination condition based on the first path. In a specific implementation, when the first device accesses a remote file such as a shared file on the second device, it maps the directory of the shared file to a local disk. For example, if the directory of the shared file on the second device is / sdcard / , the first device maps the / sdcard / directory to the local F drive.

[0077] Optionally, based on the remote file access method, the first device accesses the corresponding data on the second device, that is, the shared file, through the Network File System (NFS) and the connection interface (socket), and the NFS and the connection interface are used to realize data interaction between the first device and the second device. Afterwards, the first device presents the shared file in the task manager of the first operating system in a manner corresponding to the first operating system for the user to view. Of course, when mapping the / sdcard / directory to the local F drive, it is also necessary to perform operations such as drive letter registration, as well as configure content that can provide file and data support for the F drive.

[0078] The mapped F disk is a virtual disk, but the F disk can also be realized through a driver, and can also be connected to a system interface, presented to a user, and realize functions such as reading and writing.

[0079] The first operating system can obtain the information it wants to start when the process starts through a process callback or other mechanism. For example, after the user performs a startup operation on a shared file, the first operating system starts to create a process corresponding to the shared file and determines the first path corresponding to the shared file, such as F: / share / spyxx.exe. At the same time, the driver in the first device captures the startup operation to know that the program it wants to start is spyxx.exe.

[0080] When determining the first path and determining whether the shared file meets the risk file determination condition based on the first path, it is specifically to determine whether the first directory to which the first path belongs can enable the first device to access the second device. For example, in the above example, it is to determine whether the first directory to which the first path belongs is / sdcard / . If the first directory to which the first path belongs can enable the first device to access the second device, that is, the first directory to which the first path belongs is / sdcard / , then it is determined that the shared file meets the risk file determination condition.

[0081] Accordingly, in this manner, the shared file meets the risk file determination condition that the first directory to which the first path belongs can enable the first device to access the second device.

[0082] The second

[0083] Determine the file type of the shared file, and determine whether the shared file meets the risk file determination criteria based on the file type. In a specific implementation, different operating systems have different compatibilities. For example, file A can run on the first device but cannot run on the second device, and file B can run on the second device but cannot run on the first device. In addition, if the file cannot run on the device, it indicates that the file does not pose a risk to the operating system of the device.

[0084] Based on this, after obtaining the shared file, the file type of the shared file is further determined to determine whether the shared file meets the risk file determination condition based on the file type, for example, the file type of the shared file is determined according to its extension.

[0085] In this manner, the shared file meets the risk file determination condition that the file type can be run on the first device but not on the second device, that is, it is determined whether the shared file can be run on the first device but not on the second device.

[0086] Furthermore, if the file type of the shared file indicates that the shared file can run on the first device but cannot run on the second device, it indicates that the shared file poses a risk to the first operating system of the first device but does not pose a risk to the second operating system of the second device, that is, the shared file meets the risk file determination condition.

[0087] For example, the file type of the shared file is .exe, the first operating system is Windows, and the second operating system is Android. It can be seen that the shared file cannot be run on the second device but can be run on the first device, that is, the shared file does not pose a risk to the second operating system of the second device but poses a risk to the first operating system of the first device, and then determines that the shared file meets the risk file judgment condition.

[0088] The third

[0089] Authentication is performed on the shared file, and whether the shared file meets the risk file determination condition is determined based on the authentication result. In this method, an authentication unit is pre-set in the first device, and the authentication unit can be provided with a verification form, which records the file information that needs to be authenticated, and the verification methods of different files, and the verification methods at least include certificate verification and hash value verification.

[0090] After the user performs a startup operation on the shared file, the identity authentication unit determines whether identity authentication is required for the shared file. If so, the shared file is authenticated according to the corresponding authentication method on the authentication form. In another example, after the user performs a startup operation on the shared file, a prompt message may be generated and displayed through the display device of the first device to allow the user to determine whether to authenticate the shared file. If so, the shared file is authenticated according to the corresponding authentication method on the authentication form.

[0091] In this way, the shared file meets the risk file determination condition, and the verification result indicates that the shared file identity authentication fails. That is, if the verification result obtained after identity authentication of the shared file is failure, such as when the certificate is invalid, it is determined that the shared file meets the risk file determination condition.

[0092] It is worth noting that the method for determining whether a shared file meets the risk file determination condition can be set to one or more of the above three. Correspondingly, the shared file meets the risk file determination condition is also one or more of the above three.

[0093] Optionally, when executing the shared file in the isolated environment of the first device, reference may be made to Figure 2 The method flow chart shown, wherein the specific steps include S201-S204.

[0094] S201, determining a target process corresponding to executing a shared file.

[0095] S202, monitoring the access objects of the target process.

[0096] S203: Determine whether the access object meets the redirection condition.

[0097] S204, responding to the operation on the access object based on the isolation environment.

[0098] In the process of executing the shared file in the isolated environment of the first device, the target process corresponding to the execution of the shared file is determined. Optionally, if the shared file is an executable file, a corresponding process is started when the shared file is executed. Therefore, when determining to execute the shared file, the started current process is monitored through the process callback mechanism, and the process parameters, path and other information of the current process are obtained to determine the target process corresponding to the execution of the shared file from the current process.

[0099] After determining the target process corresponding to the execution of the shared file, the driver on the first device monitors the target process through a partial framework to obtain the access object of the target process, such as capturing and identifying the issuer of the target ongoing request and the access object through the Minifilter framework, or capturing various operations of the target process to obtain the access object by hooking from the application layer.

[0100] After obtaining the access object of the target process, further determining whether the access object meets the redirection condition. Optionally, determining whether the access object meets the redirection condition at least includes: the access object belongs to the first device, and the target process includes any execution operation of writing, modifying, starting or associating with other processes.

[0101] In a specific implementation, the shared file can be a rich text file. When opening the shared file, it is necessary to start the corresponding program on the first device, such as a third-party application such as Office or WPS. At this time, since the shared file meets the risk file determination conditions, the shared file is opened through a third-party application in an isolated environment. At the same time, all access objects of the third-party application are monitored, and it is determined whether the access object belongs to the first device. For example, if a rich text file on the first device is opened through the third-party application, the shared file is converted into other formats through the third-party application and displayed with other programs on the first device, etc., it is determined that the access object belongs to the first device. At this time, it is further determined whether the operation performed by the third-party application on the access object is any execution operation of writing, modifying, starting or associating other processes. If so, it is determined that the access object meets the redirection conditions.

[0102] After determining that the access object meets the redirection condition, the operation on the access object is responded to based on the isolation environment. For example, the target process is WPS, and its access object is file 1 in the C drive on the first device, and the operation performed by WPS is to modify part of the content in file 1. At this time, a copy of file 1 is made, and the copied file 1 is stored in the isolation environment, and the operation of modifying part of the content in file 1 is responded to in the isolation environment. Of course, file 1 in the C drive on the first device does not respond to the modification operation.

[0103] In another example, the target process is application 1, and its access object is application 2 on the first device, and application 1 wants to start and associate with application 2, such as opening a browser through WeChat. At this time, the operation of starting and associating application 2 is responded to in the isolated environment, that is, application 2 is started and run in the isolated environment, and application 2 is not started in the system environment of the first operating system of the first device.

[0104] In another example, the operation of the target process is to perform window enumeration. At this time, the enumeration result is adjusted by modifying the enumeration return value so that the target process can only enumerate the windows of other processes that exist in the isolated environment at the same time, while the windows of processes that are not in the isolated environment cannot be enumerated.

[0105] In another example, the operation of the target process is to take a system process snapshot. At this time, the content of the snapshot is adjusted by modifying the snapshot data so that the target process can only collect itself, processes in the isolated environment, and system service processes, while the target process cannot collect processes outside the isolated environment.

[0106] As described above, for access objects that meet the redirection conditions, operations on the access objects are responded to in an isolated environment, thereby effectively preventing security risks caused by executing shared files that meet the risk file determination conditions in the system environment of the first operating system, thereby ensuring the security of the first device.

[0107] In another example, after determining that a shared file meets the risk file determination condition, a risk mark is set for the shared file, so that in the process of executing the shared file in the isolated environment of the first device, all processes running in the first device are monitored in real time, and the process file corresponding to each process is obtained, and then the process including the risk mark in the process file is determined, and the operation of the process is responded to based on the isolated environment. For example, if the shared file is a rich text file, after setting the risk mark for the rich text file, if it is detected that the process file of process C in the first device includes the rich text file, the process C is responded to based on the isolated environment.

[0108] Optionally, Figure 3A flow chart of a method for acquiring a shared file from a second device is shown, wherein specific steps include S301-S303.

[0109] S301, determining a first directory to which a first path corresponding to a shared file belongs.

[0110] S302: Determine a second directory based on the first directory, where the second directory is a directory for storing file data of shared files on the second device, and the second directory is not visible on the first device.

[0111] S303: Obtain file data of the shared file according to the second directory.

[0112] When obtaining a shared file from the second device, first determine the first directory to which the first path corresponding to the shared file belongs, wherein the first directory is a directory on the second device, and the first directory is visible on the first device, and thus the file sharing between the first device and the second device can be realized through the first directory.

[0113] Furthermore, a second directory is determined based on the first directory, wherein a certain mapping relationship exists between the first directory and the second directory. The second directory is a directory for storing file data of shared files on the second device, and the second directory is not visible on the first device, thereby ensuring the security of file data on the second device while achieving file sharing with the first device.

[0114] After the second directory is determined based on the first directory and the mapping relationship between the first directory and the second directory, file data of the shared file is obtained according to the second directory.

[0115] The present application also provides another control method, which is applied to a second device, and: Figure 4 The flowchart of another control method is shown, wherein the specific steps include S401-S404.

[0116] S401, establishing a virtual directory, where the virtual directory can realize file sharing between a first device and a second device, where the first device has a first operating system, and the second device has a second operating system, and the first operating system is different from the second operating system.

[0117] In a specific implementation, a virtual directory is pre-established in the second device, and the virtual directory can realize file sharing between the first device and the second device, that is, the virtual directory is visible on the first device.

[0118] Accordingly, when the virtual directory is created, a virtual file under the virtual directory is created. Similarly, the virtual file under the virtual directory is visible on the first device.

[0119] The first device has a first operating system, the second device has a second operating system, and the first operating system is different from the second operating system. For example, the first operating system of the first device is a Windows system, and the second operating system of the second device is an Android system or other non-Windows systems.

[0120] S402: Obtain an access request from the first device to a target shared file in a virtual directory.

[0121] Here, when the user accesses a file on the second device through the first device, the user performs an access operation on the target shared file under the virtual directory based on the first device to generate a corresponding access request, wherein the target shared file is any file in the virtual directory.

[0122] For example, when the first device maps the virtual directory / sdcard / in the second device to its F drive, the user double-clicks to open F: / share / spyxx.exe. At this time, the first device parses the file F: / share / spyxx.exe, and based on the mapping relationship between the virtual directory in the second device and the F drive in the first device, determines that it corresponds to / sdcard / share / spyxx.exe of the second device, and generates an access request for / sdcard / share / spyxx.exe and sends it to the second device.

[0123] The second device obtains in real time an access request for a target shared file in a virtual directory sent by the first device, and responds to the access request to achieve file sharing with the first device.

[0124] S403, responding to the access request, obtaining the target shared file based on the mapping relationship between the virtual directory and the real storage directory of the target shared file.

[0125] The second device establishes a mapping relationship between the virtual directory and the local real storage directory while establishing the virtual directory. For example, the virtual directory established is / sdcard / share / , and the mapping relationship between the virtual directory / sdcard / share / and the local real storage directory / sdcard / Download / is established.

[0126] After obtaining the access request sent by the first device, the second device obtains the target shared file based on the mapping relationship between the virtual directory and the real storage directory when responding to the access request.

[0127] In actual applications, multiple files may be stored in the same directory. Based on this, the second device creates a virtual file in the virtual directory while creating the virtual directory, and establishes a mapping relationship between the virtual file and the local real file. For example, when the virtual directory / sdcard / share / is created, a virtual file / sdcard / share / spyxx.exe in / sdcard / share / is created, and a mapping relationship is established between / sdcard / share / spyxx.exe and the local real file / sdcard / Download / spyxx.exe in the real storage directory / sdcard / Download / .

[0128] Based on this, after the second device obtains the access request sent by the first device and determines that the target shared file corresponding to the access request is spyxx.exe, it obtains the target shared file based on the mapping relationship between the virtual directory and the real storage directory and the mapping relationship between the virtual file and the real file.

[0129] S404, sending the target shared file to the first device, so that when the first device determines that the risk file determination condition is met, the target shared file is executed in the isolated environment of the first device, and the target shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device.

[0130] After obtaining the target shared file, the target shared file is sent to the first device, so that when the first device determines that the risk file determination condition is met, the target shared file is executed in the isolated environment of the first device. The target shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device, thereby achieving the purpose of avoiding the target shared file from affecting the system environment of the first operating system and ensuring the security of the first device.

[0131] As an example, there may be multiple target shared files in the second device, and the multiple target shared files are stored in different real storage directories. Based on this, when establishing a virtual directory, a first mapping relationship between the third directory and the virtual directory is established, and a second mapping relationship between the fourth directory and the virtual directory is established. In response to an access request, the target shared file is obtained based on the mapping relationship between the virtual directory and the real storage directory of the target shared file according to the first mapping relationship and / or the second mapping relationship, wherein the third directory and the fourth directory are storage directories in the second device, the third directory is not visible in the first device, and the fourth directory is not visible in the first device.

[0132] Of course, there can be multiple real storage directories that have a mapping relationship with the virtual directory, such as Figure 5In the virtual directory and its corresponding mapping relationship diagram shown, there are four real storage directories with mapping relationships between the virtual directory / DeviceA / , namely C: / Windows / , C: / , D: / 123 / and E: / . In addition, four virtual files / DeviceA / 123.txt, / DeviceA / 222.txt, / DeviceA / 1.pdf and / DeviceA / a.doc are established under the virtual directory, wherein there is a mapping relationship between the virtual file / DeviceA / 123.txt and the real file C: / Windows / 123.txt, there is a mapping relationship between the virtual file / DeviceA / 222.txt and the real file C: / 222.txt, there is a mapping relationship between the virtual file / DeviceA / 1.pdf and the real file D: / 123 / 1.pdf, and there is a mapping relationship between the virtual file / DeviceA / a.doc and the real file E: / a.doc. There is also a mapping relationship between the F drive of the first device and the virtual directory / DeviceA / of the second device.

[0133] When the first device accesses / DeviceA / 1.pdf under the virtual directory / DeviceA / based on the F drive, based on the above mapping relationship, the first device can access the real file D: / 123 / 1.pdf, and when accessing the real file D: / 123 / 1.pdf, other real files on the second device (including but not limited to C: / Windows / 123.txt, C: / 222.txt and E: / a.doc) are not visible on the first device. Therefore, the embodiment of the present application enables the first device to access the target shared file on the second device by establishing a virtual directory and a virtual file, which not only effectively ensures the security of other files on the second device except the target shared file, but also achieves lower implementation cost and maintenance cost.

[0134] Furthermore, the second device can also perform file sharing for the first device without receiving an access request. Specifically, the second device sends the file that meets the detection requirements to the first device, so that the first device determines whether the file that meets the detection requirements meets the risk file determination condition and whether it poses a risk to the first operating system of the first device, and obtains the judgment result of the first device to determine whether the file that meets the detection requirements is a dangerous file based on the judgment result of the first device.

[0135] As an example, if the judgment result of the first device indicates that the file that meets the detection requirements poses a risk to the first operating system of the first device, the second device deletes the file that meets the detection requirements according to the judgment result to avoid the first device or other devices accessing the file that meets the detection requirements and causing security risks. Among them, the other device belongs to the same local area network as the first device and the second device, and the other device can also access the files on the second device. In this way, the security of the local area network to which the second device belongs and each device in the local area network is effectively guaranteed.

[0136] Among them, the file that meets the detection requirements is a file that cannot be executed on the second device. For example, if the second operating system of the second device is an Android system, the .exe file on the second device can be determined as a file that meets the detection requirements.

[0137] The present application also provides a first device. Since the principle of solving the problem by the first device in the present application is similar to the above-mentioned control method of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0138] Figure 6 The schematic diagram of the structure of the first device provided in the embodiment of the present application is shown, which specifically includes:

[0139] An acquisition module 601 is configured to acquire a shared file from a second device;

[0140] A determination module 602, configured to determine whether the shared file meets a risk file determination condition;

[0141] An execution module 603 is configured to execute the shared file in the isolation environment of the first device, wherein the shared file runs in the isolation environment without affecting the system environment of the first operating system of the first device;

[0142] The first device has a first operating system, the second device has a second operating system, the first operating system is different from the second operating system, and the shared file does not pose a risk to the second operating system of the second device.

[0143] In an embodiment of the present application, after the first device obtains the shared file of the second device and determines that the shared file meets the risk file determination condition, the shared file is executed in an isolated environment of the first device, wherein the running of the shared file in the isolated environment does not affect the system environment of the first operating system of the first device, that is, the impact of the shared file on the system environment of the first operating system is effectively avoided, thereby ensuring the security of the first device.

[0144] The present application also provides a second device. Since the principle of solving the problem by the second device in the present application is similar to the above-mentioned control method of the present application, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0145] Figure 7 The schematic diagram of the structure of the second device provided in the embodiment of the present application is shown, which specifically includes:

[0146] An establishing module 701 is configured to establish a virtual directory, wherein the virtual directory can realize file sharing between a first device and a second device, wherein the first device has a first operating system, and the second device has a second operating system, and the first operating system is different from the second operating system;

[0147] An obtaining module 702 is configured to obtain an access request from the first device to a target shared file under the virtual directory;

[0148] A response module 703 is configured to respond to the access request and obtain the target shared file based on a mapping relationship between the virtual directory and the real storage directory of the target shared file;

[0149] The sending module 704 is configured to send the target shared file to the first device so that when the first device determines that the risk file determination condition is met, the target shared file is executed in the isolated environment of the first device, and the target shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device.

[0150] The embodiment of the present application enables the first device to access the target shared file on the second device through the established virtual directory and virtual file, which not only effectively ensures the security of other files on the second device except the target shared file, but also achieves lower implementation and maintenance costs.

[0151] In addition, although exemplary embodiments have been described herein, the scope includes any and all embodiments based on the present application with equivalent elements, modifications, omissions, combinations (e.g., various embodiments intersecting schemes), adaptations or changes. The elements in the claims will be interpreted broadly based on the language adopted in the claims, and are not limited to the examples described in this specification or during the implementation of the application, and the examples will be interpreted as non-exclusive. Therefore, this specification and examples are intended to be considered as examples only, and the true scope and spirit are indicated by the following claims and the full scope of their equivalents.

[0152] The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more of them) can be used in combination with each other. For example, those of ordinary skill in the art can use other embodiments when reading the above description. In addition, in the above-mentioned specific embodiments, various features can be grouped together to simplify the application. This should not be interpreted as an intention that a disclosed feature that does not require protection is necessary for any claim. On the contrary, the subject matter of the present application may be less than all the features of a specific disclosed embodiment. Thus, the following claims are incorporated into the specific embodiments as examples or embodiments, wherein each claim is independently used as a separate embodiment, and it is considered that these embodiments can be combined with each other in various combinations or arrangements. The scope of the present application should be determined with reference to the attached claims and the full scope of equivalent forms granted by these claims.

[0153] Multiple embodiments of the present application are described in detail above, but the present application is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications to the embodiments based on the concept of the present application, and these variations and modifications should all fall within the scope of protection required by the present application.

Claims

1. A control method, applied to a first device, comprising: Retrieve a shared file from a second device; Determining that the shared file meets a risk file determination condition; Execute the shared file in the isolated environment of the first device, wherein the shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device; The first device has a first operating system, the second device has a second operating system, the first operating system is different from the second operating system, and the shared file does not pose a risk to the second operating system of the second device.

2. According to the control method of claim 1, determining whether the shared file meets the risk file determination condition includes at least one or more of the following methods: Acquire a first path of the shared file on the first device, and determine whether the shared file meets a risk file determination condition based on the first path; Determine the file type of the shared file, and determine whether the shared file meets a risk file determination condition based on the file type; Authentication is performed on the shared file, and whether the shared file meets a risk file determination condition is determined according to the authentication result.

3. According to the control method of claim 2, the shared file satisfies at least one of the following risk file determination conditions: The first directory to which the first path belongs enables the first device to access the second device; Files of the file type can be run on the first device but cannot be run on the second device; The verification result indicates that the identity authentication of the shared file has failed.

4. The control method according to claim 1, executing the shared file in the isolated environment of the first device comprises: Determine a target process corresponding to executing the shared file; Monitoring access objects of the target process; Determining that the access object meets the redirection condition; Respond to the operation on the access object based on the isolation environment.

5. The control method according to claim 4, wherein determining that the access object satisfies the redirection condition comprises at least: The access object belongs to the first device, and the target process includes any execution operation of writing, modifying, starting or associating with other processes.

6. The control method according to claim 1, after determining that the shared file meets the risk file determination condition, comprises: Setting a risk mark for the shared file; The process of executing the shared file in the isolated environment of the first device also includes: Monitoring all processes running in the first device; Determine a process including the risk tag in the process file, and respond to the operation of the process based on the isolation environment.

7. The control method according to claim 1, wherein obtaining a shared file from the second device comprises: Determine a first directory to which a first path corresponding to the shared file belongs; Determine a second directory based on the first directory, where the second directory is a directory for storing file data of the shared file on the second device, and the second directory is not visible on the first device; The file data of the shared file is obtained according to the second directory.

8. A control method, applied to a second device, the control method comprising: Establishing a virtual directory, wherein the virtual directory can realize file sharing between a first device and the second device, wherein the first device has a first operating system, and the second device has a second operating system, and the first operating system is different from the second operating system; Obtaining an access request from the first device for a target shared file under the virtual directory; In response to the access request, the target shared file is obtained based on a mapping relationship between the virtual directory and a real storage directory of the target shared file; The target shared file is sent to the first device so that when the first device determines that the risk file determination condition is met, the target shared file is executed in the isolated environment of the first device, and the target shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device.

9. The control method according to claim 8, wherein the step of establishing a virtual target comprises: A first mapping relationship is established between a third directory and the virtual directory, and a second mapping relationship is established between a fourth directory and the virtual directory, and in response to the access request, the target shared file is obtained based on the mapping relationship between the virtual directory and the real storage directory of the target shared file according to the first mapping relationship and / or the second mapping relationship, wherein the third directory is not visible on the first device, and the fourth directory is not visible on the first device.

10. A first device, comprising: An acquisition module configured to acquire a shared file from a second device; A determination module configured to determine that the shared file meets a risk file determination condition; an execution module configured to execute the shared file in the isolated environment of the first device, wherein the shared file runs in the isolated environment without affecting the system environment of the first operating system of the first device; The first device has a first operating system, the second device has a second operating system, the first operating system is different from the second operating system, and the shared file does not pose a risk to the second operating system of the second device.

Images