File protection method, rule configuration method and computing device

Abstract

The embodiment of the invention provides a file protection method, a rule configuration method and computing equipment. Wherein a driving program in the kernel detects a file access request initiated by an application program; determining a container identifier of a target container to which the application program belongs; searching a container label associated with the container identifier; searching at least one corresponding file defense rule according to the container label; and according to the at least one file defense rule, determining whether to execute a defense action on the file access request. According to the technical scheme provided by the embodiment of the invention, effective protection of the container file is realized, and the protection stability and the protection efficiency are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a file protection method, a rule configuration method, and a computing device. Background Art

[0002] With the advent of the cloud-native era, using container technology to provide users with secure and portable cloud services has become a development trend. How to protect files in containers from malicious tampering has also become a technical problem that needs to be solved.

[0003] Although current container management tools such as K8s (Kubernetes, an open source container management platform) provide resource isolation between containers, making it impossible for applications in one container to access files in another container, this file protection method can only protect files between containers, and there are still security risks, and it is impossible to effectively protect container files. Summary of the invention

[0004] The embodiments of the present application provide a file protection method, a rule configuration method and a computing device to solve the technical problem that container files in the prior art have security risks and cannot effectively implement file protection.

[0005] In a first aspect, an embodiment of the present application provides a file protection method, which is applied to a driver in a kernel, and the method includes:

[0006] Detect file access requests initiated by applications;

[0007] Determine a container identifier of a target container to which the application belongs;

[0008] Finding a container tag associated with the container identifier;

[0009] According to the container tag, searching for at least one corresponding file defense rule;

[0010] According to the at least one file defense rule, it is determined whether to perform a defense action on the file access request.

[0011] In a second aspect, an embodiment of the present application provides a file protection method, which is applied to a driver in a kernel, and the method includes:

[0012] Detect file access requests initiated by applications and determine file information;

[0013] Determine a container identifier of a target container corresponding to the application;

[0014] Sending the container identifier and the file information to a defense program, so that the defense program searches for a container tag associated with the container identifier, searches for at least one corresponding file defense rule according to the container tag, and generates indication information according to a matching result between the file information and the at least one file defense rule;

[0015] Determine whether to perform a defense action on the file access request according to the indication information sent by the defense program.

[0016] In a third aspect, an embodiment of the present application provides a file protection method, which is applied to a defense program, and the method includes:

[0017] Obtaining a container identifier and file information sent by a driver; the file information is determined by the driver detecting a file access request initiated by an application; the container identifier is obtained based on a search by the application;

[0018] Finding a container tag associated with the container identifier;

[0019] According to the container tag, searching for at least one corresponding file defense rule;

[0020] Generate indication information according to a matching result between the file information and the at least one file defense rule;

[0021] The indication information is sent to the driver; the indication information is used to indicate whether to perform a defense action on the file access request.

[0022] In a fourth aspect, an embodiment of the present application provides a rule configuration method, including:

[0023] Provide rule configuration prompt information in the rule configuration interface;

[0024] In response to a user configuration operation, determining a file defense rule configured by the user and a container tag set for the file defense rule;

[0025] Sending the file defense rule and the container tag to a defense program so that the defense program can determine an association between the file defense rule and the container tag;

[0026] The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching the association relationship; the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

[0027] In a fifth aspect, an embodiment of the present application provides a file protection method, including:

[0028] Get file defense rules;

[0029] Obtain a container label set for the file defense rule;

[0030] Determining an association relationship between the file defense rule and the container tag;

[0031] The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching the association relationship; the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

[0032] In a sixth aspect, an embodiment of the present application provides a computing device, including a processing component and a storage component;

[0033] The storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the file protection method as described in the first aspect above, or the file protection method as described in the second aspect above, or the file protection method as described in the third aspect above, or the rule configuration method as described in the fourth aspect above, or the file protection method as described in the fifth aspect above.

[0034] In the seventh aspect, a computer storage medium is provided in an embodiment of the present application, storing a computer program, which, when executed by a computer, implements the file protection method as described in the first aspect above, or the file protection method as described in the second aspect above, or the file protection method as described in the third aspect above, or the rule configuration method as described in the fourth aspect above, or the file protection method as described in the fifth aspect above.

[0035] In an embodiment of the present application, a driver in the kernel detects a file access request initiated by an application, thereby determining the container identifier of the target container from which the application comes, and determining the corresponding container tag based on the container identifier, thereby finding at least one corresponding file defense rule based on the container tag; according to at least one file defense rule, it is possible to determine whether to perform a defense action on the file access request, and the defense scope applicable to the file defense rule is set based on the container tag, thereby achieving protection of different defense scopes, achieving effective protection of container files, and combining the kernel driver to implement defense actions, thereby improving protection stability and protection efficiency.

[0036] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 A system architecture diagram is shown in which the technical solution of the embodiment of the present application is applied;

[0039] Figure 2 A flowchart of an embodiment of a file protection method provided by the present application is shown;

[0040] Figure 3 A flowchart of another embodiment of a file protection method provided by the present application is shown;

[0041] Figure 4 A flowchart of another embodiment of a file protection method provided by the present application is shown;

[0042] Figure 5 A flowchart of an embodiment of a rule configuration method provided by the present application is shown;

[0043] Figure 6 A schematic diagram showing a display of a rule configuration interface in an actual application of an embodiment of the present application is shown;

[0044] Figure 7 A flowchart of another embodiment of a file protection method provided by the present application is shown;

[0045] Figure 8 A schematic structural diagram of an embodiment of a document protection device provided by the present application is shown;

[0046] Fig. 9 A structural schematic diagram of another embodiment of a file protection device provided by the present application is shown;

[0047] Fig.10 A structural schematic diagram of another embodiment of a file protection device provided by the present application is shown;

[0048] Fig.11 A schematic diagram showing the structure of an embodiment of a rule configuration device provided by the present application is shown;

[0049] Fig.12A structural schematic diagram of another embodiment of a file protection device provided by the present application is shown;

[0050] Fig.13 A schematic diagram of the structure of an embodiment of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0052] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0053] The technical solution of the embodiment of the present application is applicable to container file protection scenarios, such as container file protection scenarios in cloud computing scenarios. A container may refer to a container running in a physical machine or a container running in a virtual machine built in a physical machine, and this application does not limit this.

[0054] In order to facilitate understanding of the technical solution of the present application, the following first explains the technical terms that may be involved in the present application:

[0055] Container technology: effectively divide the resources of a single operating system into isolated groups in order to better balance conflicting resource usage requirements between isolated groups. This technology is container technology. Containers created based on container technology are similar to virtual machines, but they have relaxed isolation properties and can share operating systems between applications. The container in the embodiment of the present application can be created in a host machine, which can be a physical host or a virtual machine, such as a cloud server, and this application does not limit this.

[0056] Kubernetes: K8s for short, an open source container management platform that can be used to manage containers on multiple machines in a cloud computing platform.

[0057] Virtual machine (VM for short) is a complete computer system that runs in a completely isolated environment and has complete hardware system functions, simulated by software. In cloud computing scenarios, a virtual machine can refer to an elastic cloud server, for example.

[0058] Container image: The relationship between a container image and a container is similar to that between a class and an instance in object-oriented programming. An image is a static definition, and a container refers to an entity at runtime of a container image.

[0059] Host: It can be a physical machine or a virtual machine. It can run containers and other applications. Applications can also run inside containers. The difference between it and the former running on the host is that unless the container is specially configured, it can generally only access specific resources or data in the container.

[0060] Kernel: The core of the operating system, which is the first layer of software expansion based on hardware. It provides the most basic functions of the operating system and is the basis for the operation of the operating system. It is responsible for managing the system's processes, memory, device drivers, files, and network systems, and determines the system's performance and stability.

[0061] Application layer (user state): Modern operating systems provide two operating states: user state and kernel state. All applications (processes) generally run in user state. At this time, the process cannot directly access hardware resources or system data. If necessary, the process enters the kernel through a system call and continues to obtain relevant resources or data through the kernel. Finally, the process returns to the user state to continue running.

[0062] System call (abbreviated as: syscall, full name in English: system call): is a programmed way for a computer program to request services from the operating system (kernel) that executes the program. Services may include hardware-related services (for example, access to the hard drive or access to the device's camera), creation and execution of new processes, and communication with integrated kernel services (such as process scheduling). System calls provide a basic interface between processes and the operating system. In the embodiments of the present application, the file access operations of the application program need to call system calls to implement.

[0063] Application: An executable program created in a container to perform different execution operations. Each application corresponds to a process. In cloud computing scenarios, users can run different applications in one or more containers. Of course, applications can also be created and run on a host running outside a container.

[0064] In a practical application, the technical solution of the embodiment of the present application can be applied to cloud computing scenarios. Cloud computing is one of the fastest-growing trends in computer technology, which involves providing hosting services over the Internet. A cloud computing environment provides computing and storage resources as services to end users. End users can make requests to the provided services for processing. The processing capacity of the service is usually limited by the configured resources.

[0065] It should be understood that although the present application includes detailed descriptions about cloud computing, the implementation of the teachings described herein is not limited to cloud computing environments. Instead, the embodiments of the present application can be implemented in conjunction with any other type of computing environment now known or later developed.

[0066] Cloud computing is a service delivery model that enables on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider.

[0067] A cloud server is a cloud computing service provided by a cloud computing provider. A cloud computing provider can use a multi-tenant model to pool resources to provide services to multiple tenants. The user referred to in this article refers to the tenant. You can purchase the resources of a cloud computing provider to build a cloud server that meets your needs. Users can register user accounts with cloud computing providers, and cloud computing providers use user accounts to distinguish different users. One or more containers can be created in a cloud server.

[0068] In the process of implementing the present application, the inventor discovered that although the current container management tools such as K8s (Kubernetes, an open source container management platform) provide resource isolation functions between containers, so that applications in one container cannot access files in another container, this file protection method can only achieve file protection between containers. In actual applications, for example, there are specific files in a container that do not want to be maliciously modified by certain applications, and these applications are not excluded from the same container. At this time, the resource isolation method provided by K8s will not be able to effectively protect the files, resulting in security risks.

[0069] In order to improve the effectiveness of file protection and avoid security risks, the inventors have proposed a technical solution of the embodiment of the present application after a series of studies. In the embodiment of the present application, the driver in the kernel detects the file access request initiated by the application, so that the container identification of the target container from the application can be determined, and the corresponding container label can be determined according to the container identification, so that at least one corresponding file defense rule can be found according to the container label; according to at least one file defense rule, it can be determined whether to perform a defense action on the file access request, and the defense scope applicable to the file defense rule is set based on the container label, so as to realize protection of different defense scopes and realize effective protection of container files, and realize defense actions in combination with the kernel driver, thereby improving protection stability and protection efficiency.

[0070] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0071] Figure 1 A system architecture diagram that can be applied to a technical solution of an embodiment of the present application is shown. The system architecture may include a server 101, in which an operating system and at least one container 102 are deployed. The operating system may include a kernel 103 and an application layer 104. In addition, the operating system includes different system types, such as the currently popular Windows, Linux, MacOS, etc., which are not limited in the present application. The present application is applicable to any system that can support a container environment, such as Linux.

[0072] In each container 102 , one or more applications (processes) 105 may be run.

[0073] A defense program 106 may be deployed in the application layer 104. After the defense program 106 is started, a corresponding driver 107 may be run in the kernel 103. The driver 107 may detect all system calls related to file access in the kernel to determine whether to perform defense actions on file access requests initiated by any application in any container.

[0074] In the embodiments of the present application, the server 101 may refer to a physical host, and may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology.

[0075] It should be noted that the embodiments of the present application may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0076] The implementation details of the technical solution of the embodiment of the present application are elaborated in detail below.

[0077] Figure 2 This is a flowchart of an embodiment of a file protection method provided in an embodiment of the present application. The technical solution of this embodiment is executed by a driver in the kernel. The method may include the following steps:

[0078] 201: Detects file access requests initiated by applications.

[0079] The application may call a system call in the kernel to initiate a file access request for a target file. The driver may determine whether there is an application initiating a file access request by detecting a system call related to the file access operation in the kernel.

[0080] Among them, the file access request may include file information of the target file, and the file information may include, for example, the file path, file name, file type and / or operation type of the target file, wherein the operation type is used to indicate different file access operations, for example, may include read operations, write operations, modify operations, etc.

[0081] 202: Determine the container identifier of the target container to which the application belongs.

[0082] The corresponding container identifier can be found according to the process information of the application program. The process information may include, for example, the process identifier.

[0083] Optionally, the container identifier corresponding to the application can be found from the kernel data. Kernel data refers to the data in the system kernel that can be accessed after the application enters the system kernel state. The current of the kernel data (an information field in the kernel data) contains information related to the process of the application, and the corresponding container identifier can be found from the current of the kernel data. The application in the container that initiates the file access request enters the kernel through a system call. At this time, the driver can obtain the data of the application (process) by accessing the current in the kernel data, and further determine the container identifier to which the application belongs based on this data.

[0084] As an optional manner, the container identifier may be represented by a container ID (Identity document, identity authentication identifier).

[0085] As another optional method, since the container ID is usually a 64-byte string, information search based on the container ID has a large matching overhead and slow information search messages. Therefore, optionally, a namespace identifier can be used to represent the container identifier. The namespace identifier is usually a 32-bit unsigned integer data, which can reduce the matching overhead and improve the information search message.

[0086] The namespace identifier may be, for example, a network namespace identifier (abbreviated as net-ns, full name: network-namespace), a process namespace identifier (abbreviated as pid-ns, full name: Process Identifier-namespace), a file namespace identifier (abbreviated as mnt-ns, full name: mount-namespace), etc. Since different containers usually use independent and different file namespaces, the file namespace identifier can uniquely identify the file system, and therefore the file namespace identifier can be used as a container identifier to distinguish different containers.

[0087] The target container may refer to a container to which the application belongs, and is named “target container” for the convenience of description.

[0088] 203: Find the container tag associated with the container ID.

[0089] 204: Search for at least one corresponding file defense rule according to the container label.

[0090] In the embodiment of the present application, container tags corresponding to different file defense rules may be pre-configured, and the container tags are used to limit the file defense scope of the file defense rules. Among them, the container tag can be used to identify the cluster, image, or application type corresponding to the container to limit the file defense scope. Therefore, optionally, the container tag may include at least one of an application tag for identifying an application type, a cluster tag for identifying a cluster, and an image tag for identifying a container image.

[0091] Among them, the application tag is used to identify the application type corresponding to the container, so that file protection can be performed from the application dimension. The cluster tag is used to identify the cluster corresponding to the container, which can be implemented using the cluster ID, so that file protection can be performed from the cluster dimension. The image tag is used to indicate the image corresponding to the container, which can be implemented using the image ID, so that file protection can be performed from the image dimension.

[0092] Among them, since the defense program can detect and know the startup operation of any container, it can determine the cluster label of the cluster to which the container belongs, the image label of the image to which it belongs, the namespace identifier of the corresponding container, or the container identifier of the container itself, etc., and accordingly generate container-related information and send it to the driver. Therefore, the driver can search for the container label associated with the container identifier based on the container-related information sent by the defense program. The container-related information may include the correspondence between the container identifier and the container label. When the container identifier is a namespace identifier, the container-related information includes the correspondence between the namespace identifier and the container label. The defense program can associate the container label with the namespace identifier, generate container-related information and send it to the driver. The container-related information can exist in the form of a data table such as a hash table, a red-black tree, etc., and of course, this application does not limit this.

[0093] Optionally, corresponding file defense rules may be set for one or more tags.

[0094] When the container tag associated with the container identifier includes multiple tags, it is possible to obtain at least one file defense rule by searching for corresponding file defense rules for one or more of the tags.

[0095] In actual applications, the defense program can be installed on the host first. After the defense program is installed and started, the defense program can install a driver in the kernel to detect system calls related to file operations. The defense program can send the container labels corresponding to the pre-configured different file defense rules to the driver.

[0096] The defense program can detect the start and stop of containers on the host. For started containers, the defense program can obtain the container ID and container label, and send both data to the driver. For stopped containers, the defense program can still obtain its container ID and send it to the driver to delete its corresponding associated label.

[0097] Therefore, the driver can search for the container label corresponding to the container identifier based on the associated container identifier and container label issued by the defense program, and search for the file defense rules corresponding to the container label based on the container label corresponding to different file defense rules issued by the defense program.

[0098] 205: Determine whether to perform a defense action on the file access request according to at least one file defense rule.

[0099] Optionally, it may be to determine whether the file information in the file access request matches at least one file defense rule; and determine whether to perform a defense action on the file access request based on the determination result. If the determination result is that the file information matches any file defense rule, a defense action on the file access request may be performed; if the determination result is that the file information does not match at least one file defense rule, the file access request may be released, thereby enabling protection of the file within the file defense scope defined by the container tag (such as application dimension, cluster dimension, or image dimension, etc.), improving file access security, and preventing an application belonging to a certain application type, a certain cluster, or a certain image from performing a file access operation on the target file.

[0100] Among them, the file defense rule may include the file path, file name or file type to be defended, etc. Therefore, it is possible to determine whether the file access request hits the file defense rule based on the file information in the file access request and the file path, file name or file type to be defended in the file defense rule. If it hits, the file information matches the file defense rule, and it can be determined to perform a defense action on the file access request. Otherwise, the file access request can be released to call the kernel to continue to perform the corresponding file access operation, etc.

[0101] In addition, the file defense rules may also include a process whitelist, which is used to set the application information that is allowed to access the file path, file name or file type to be defended, etc. Optionally, the process whitelist can be empty. Therefore, according to the file defense rules, it can be first determined whether the application is in the process whitelist. If so, the file access request can be directly released. Otherwise, it can be combined with the file information in the file access request, and the file path, file name or file type to be defended in the file defense rules, etc., to determine whether the file access request hits the file defense rules.

[0102] In addition, the file defense rule may also include an action type, which is used to set the defense action to be performed when the file defense rule is hit, and the action type may include, for example, outputting alarm information or performing interception operations, etc. Therefore, when determining to perform a defense action on a file access request, the corresponding defense action may be performed according to the action type in the file defense rule. If the file information hits multiple file defense rules, multiple defense actions may be performed according to the action types corresponding to the multiple file defense rules.

[0103] In addition, the multiple tags included in the container tag can also be set with priorities, and the file defense rules corresponding to each tag can be searched in order from high to low priority. If there is a corresponding file defense rule, the search can be stopped. The file defense rule is the final corresponding file defense rule. When the application tag and the cluster tag are found according to the container identifier, the application tag has the highest priority, and it can be searched first to see if there is a file defense rule corresponding to the application tag. If so, the file defense rule is used to perform the operation of step 205. Otherwise, the corresponding file defense rule can be searched according to the cluster tag.

[0104] In this embodiment, the driver program in the kernel detects the file access request initiated by the application program, thereby determining the container identifier of the target container from the application program, and determining the corresponding container tag based on the container identifier, thereby finding the corresponding file defense rule based on the container tag; according to the file defense rule, it can be determined whether to perform a defense action on the file access request, and the defense scope applicable to the file defense rule is set based on the container tag, thereby realizing protection of different defense scopes, realizing effective protection of container files, and realizing defense actions in combination with the kernel driver program, thereby improving the protection stability and efficiency.

[0105] In some embodiments, as can be seen from the above description, the container tag includes at least one of an application tag for identifying an application type, a cluster tag for identifying a cluster, and an image tag for identifying a container image;

[0106] The method may also include: obtaining an association relationship between a file defense rule issued by a defense program and a container tag;

[0107] The searching for the corresponding file defense rule according to the container tag may include: searching for an association relationship according to the container tag to determine the corresponding file defense rule.

[0108] That is, the defense program can obtain user configuration information and send the association between the file defense rules and container tags to the driver, so that the driver can find the corresponding file defense rules accordingly.

[0109] Figure 3 This is a flowchart of another embodiment of a file protection method provided in an embodiment of the present application. The technical solution of this embodiment can be executed by a driver in the kernel. The method may include the following steps:

[0110] 301: Detect the file access request initiated by the application and determine the file information.

[0111] The application may call a system call in the kernel to initiate a file access request for a target file. The driver may determine whether there is an application initiating a file access request by detecting a system call related to the file access operation in the kernel.

[0112] The file access request may include file information, so that the file information can be obtained. The file information may include, for example, a file path, a file name, a file type, and / or an operation type, etc., wherein the operation type is used to indicate different file access operations, such as a read operation, a write operation, a modify operation, etc.

[0113] 302: Determine the container identifier of the target container corresponding to the application.

[0114] The specific execution operation of step 302 can be found in step 202, and will not be repeated here.

[0115] 303: Send the container identifier and the file information to the defense program, so that the defense program can search for the container tag associated with the container identifier, and search for at least one corresponding file defense rule according to the container tag, and generate indication information according to the matching result between the file information and the at least one file defense rule.

[0116] 304: Determine whether to perform a defense action on the file access request according to the instruction information sent by the defense program.

[0117] This embodiment and Figure 2 The difference between the illustrated embodiments is that the driver sends the container identifier and file information to the defense program, which searches for the container tag, finds the file defense rule based on the container tag, and performs a matching operation.

[0118] Among them, as an optional method, the indication information may include a matching result, and the driver may determine whether to perform a defensive action on the file access request based on the matching result. If the matching result shows that the file information matches the file defense rule, a defensive action is performed on the file access request; otherwise, the file access request may be released.

[0119] As another optional method, the defense program can generate an execution instruction according to the matching result, and the instruction information can include the execution instruction generated according to the matching result. The execution instruction can instruct the driver whether to perform a defense action, so that the driver does not need to perform a judgment operation.

[0120] The association relationship between the file defense rules and the container tags may be pre-saved in the defense program, so that the association relationship may be searched according to the container tag to determine at least one corresponding file defense rule.

[0121] When the defense program detects the startup operation of any container, it can obtain the container-related information, and thus find the container tag associated with the container identifier based on the container-related information.

[0122] Among them, the file defense rule may include the file path, file name or file type to be defended, etc. Therefore, the defense program can determine whether the file access request hits the file defense rule based on the file information in the file access request and the file path, file name or file type to be defended in the file defense rule, etc. If it hits, the file information matches the file defense rule, otherwise it is considered that the file information does not match the file defense rule.

[0123] In addition, the file defense rules may also include a process whitelist, which is used to set the application information that is allowed to access the file path, file name or file type to be defended. Optionally, the process whitelist can be empty. Therefore, the defense program first determines whether the application is in the process whitelist. If so, it can be considered that the file information does not match the file defense rules. Otherwise, it can be combined with the file information and the file path, file name or file type to be defended in the file defense rules to determine whether the file access request hits the file defense rules.

[0124] In addition, the file defense rule may also include an action type, which is used to set the defense action to be performed when the file defense rule is hit, and the action type may include, for example, outputting an alarm message or performing an interception operation, etc. Therefore, when the defense program determines that the file information matches at least one file defense rule, the action type may also be sent to the driver program, and the instruction information may include the action type to instruct the driver program to perform the corresponding defense action according to the action type.

[0125] In this embodiment, the driver program in the kernel detects the file access request initiated by the application program, thereby determining the container identifier of the target container from the application program, and handing it over to the defense layer sequence to determine the corresponding container tag according to the container identifier, thereby finding at least one corresponding file defense rule according to the container tag; according to the at least one file defense rule, it is possible to determine whether to perform a defense action on the file access request, and the defense scope applicable to the file defense rule is set based on the container tag, thereby realizing protection of different defense scopes, realizing effective protection of container files, and realizing defense actions in combination with the kernel driver program, thereby improving protection stability and protection efficiency.

[0126] Figure 4 The flowchart of another embodiment of a file protection method provided by the embodiment of the present application, the technical solution of this embodiment is executed by a defense program, the defense program runs in the application layer of the operating system, in actual application, the defense program is first installed in the host machine, after the defense program is installed and started, the defense program can install a driver in the kernel to detect system calls related to file operations, the method may include the following steps:

[0127] 401: Get the container identifier and file information sent by the driver.

[0128] The file information is determined by the driver detecting a file access request initiated by the application, and the container identifier is obtained based on the application search. The driver can determine the container identifier from kernel data.

[0129] The container identifier may be implemented by using a namespace identifier, such as a file namespace identifier that identifies a file system.

[0130] 402: Find the container tag associated with the container ID.

[0131] 403: Search for at least one corresponding file defense rule according to the container tag.

[0132] The defense program can detect the start and stop of containers on the host. For the started container, the defense program can obtain the container identifier and container label. Since the defense program can detect and know the startup operation of any container, it can determine the cluster label of the cluster to which the container belongs, the image label of the image to which it belongs, the corresponding namespace identifier, or the container identifier of the container itself, etc., and the container related information can be generated accordingly. Therefore, the container label associated with the container identifier can be found according to the container related information. The container related information may include the correspondence between the container identifier and the container label. When the container identifier is a namespace identifier, the container related information includes the correspondence between the namespace identifier and the container label. The defense program can associate the container label with the namespace identifier, generate container related information and send it to the driver. The container related information can exist in the form of a data table such as a hash table or a red-black tree, etc., of course, this application does not limit this.

[0133] 404: Generate indication information according to the matching result between the file information and at least one file defense rule.

[0134] 405: Sending instruction information to the driver; the instruction information is used to indicate whether to perform a defense action on the file access request.

[0135] Among them, as an optional method, the indication information may include a matching result, and the driver may determine whether to perform a defensive action on the file access request based on the matching result. If the matching result shows that the file information matches the file defense rule, a defensive action is performed on the file access request; otherwise, the file access request may be released.

[0136] As another optional method, the defense program can generate an execution instruction according to the matching result, and the instruction information can include the execution instruction generated according to the matching result. The execution instruction can instruct the driver whether to perform a defense action, so that the driver does not need to perform a judgment operation.

[0137] The association relationship between the file defense rules and the container tags may be pre-saved in the defense program, so that the association relationship may be searched according to the container tag to determine at least one corresponding file defense rule.

[0138] When the defense program detects the startup operation of any container, it can obtain the container-related information, and thus find the container tag associated with the container identifier based on the container-related information.

[0139] In this embodiment, the driver program in the kernel detects the file access request initiated by the application program, thereby determining the container identifier of the target container from the application program, and handing it over to the defense layer to determine the corresponding container tag according to the container identifier, so that the corresponding file defense rule can be found according to the container tag; according to the file defense rule, it can be determined whether to perform a defense action on the file access request, and the defense scope applicable to the file defense rule is set based on the container tag, thereby realizing protection of different defense scopes, realizing effective protection of container files, and realizing defense actions of file access requests in combination with the kernel driver program, thereby improving protection stability and protection efficiency.

[0140] In addition, file defense rules can be configured by the user, see Figure 5 , which is a flow chart of an embodiment of a rule configuration method provided in an embodiment of the present application. The technical solution of this embodiment can be executed by a user end. The method may include the following steps:

[0141] 501: Provides rule configuration prompt information in the rule configuration interface.

[0142] The rule configuration prompt information is used to prompt the user to perform configuration operations, etc.

[0143] 502: In response to the user configuration operation, determine the file defense rule configured by the user and the container label set for the file defense rule.

[0144] The rule configuration prompt information may include, for example, rule setting prompt information and label setting prompt information.

[0145] The rule setting prompt information may include file information setting prompt information, whitelist setting prompt information, action setting prompt information, and the like.

[0146] The file information setting prompt information is used to prompt the user to configure the file information, the whitelist setting prompt information is used to prompt the user to configure the process whitelist, the action setting prompt information is used to prompt the user to configure the action type, etc., so that the file information can be combined. In addition, the process whitelist and / or action type can be combined to obtain file defense rules.

[0147] The label setting prompt information can be used to prompt the user to set the container label.

[0148] 503: Send the file defense rule and the container label to the defense program so that the defense program can determine the association relationship between the file defense rule and the container label.

[0149] Optionally, the file defense rules and container tags may be sent to the defense program through the control terminal.

[0150] The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by finding an associated relationship; and the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

[0151] As an optional method, the defense program can determine the association between the file defense rules and the container tags, and send the file defense rules and the association to the driver; the driver is used to detect the file access request initiated by the application, find the container identifier of the target container corresponding to the application, and find the association relationship based on the container tag associated with the container identifier to determine at least one corresponding file defense rule, and determine whether to perform a defense action on the file access request according to the at least one file defense rule.

[0152] In addition, the defense program can detect the start and stop of containers on the host. For started containers, the defense program can obtain the container ID and container label, and send both data to the driver. For stopped containers, the defense program can still obtain its container ID and send it to the driver to delete its corresponding associated label.

[0153] Therefore, the driver can search for the container label corresponding to the container identifier based on the associated container identifier and container label issued by the defense program, and search for the file defense rules corresponding to the container label based on the container label corresponding to different file defense rules issued by the defense program.

[0154] As an optional method, the defense program can determine the association between the file defense rule and the container tag, obtain the container identifier and file information sent by the driver, and search for the container tag associated with the container identifier; and according to the container tag, search for at least one corresponding file defense rule; and according to the matching result between the file information and at least one file defense rule, generate indication information, and send the indication information to the driver.

[0155] The driver can detect the file access request initiated by the application and determine the file information; determine the container identifier of the target container corresponding to the application; send the container identifier and file information to the defense program, and determine whether to perform a defense action on the file access request based on the instruction information sent by the defense program.

[0156] For ease of understanding, Figure 6 A schematic diagram of the rule configuration interface is shown in FIG. Figure 6The rule configuration interface shown may include rule setting prompt information and label setting prompt information 601; wherein the rule setting prompt information may include file information setting prompt information 602, whitelist setting prompt information 603, action setting prompt information 604, etc. The rule configuration interface may also include confirmation prompt information, for the user to perform a confirmation operation on the configured file defense rules and container labels, thereby triggering the file defense rules and container labels to be sent to the defense program.

[0157] Among them, the tag setting prompt information may include at least one tag type selection prompt information and tag input prompt information corresponding to each tag selection prompt information. At least one tag type selection prompt information may be displayed first, and in response to the tag type selected by the user, the tag input prompt information corresponding to the selected tag type may be displayed, etc.

[0158] In addition, in some embodiments, the method may further include:

[0159] In response to the update operation on the file defense rule, a corresponding processing operation is performed.

[0160] The update operation may include, for example, deletion or modification, wherein the modification operation may include modification operations on file information, a process whitelist, an action type, or a corresponding container tag.

[0161] Figure 7 This is a flowchart of another embodiment of a file protection method provided in an embodiment of the present application. The technical solution of this embodiment can be executed by a defense program. The method may include the following steps:

[0162] 701: Get file defense rules.

[0163] 702: Get the container label set for the file defense rule.

[0164] The file defense rules and container tags may be determined by the user end in response to a user configuration operation, and the user end may send the file defense rules and container tags to the defense program through the control end.

[0165] 703: Determine the association between the file defense rule and the container tag.

[0166] The defense program can establish an association relationship between file defense rules and container tags. Thus, the driver detects the file access request initiated by the application and determines the container identifier of the target container corresponding to the application; wherein the container identifier is used to determine the associated container tag, and the container tag is used to determine the corresponding at least one file defense rule by looking up the association relationship; and the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

[0167] As an optional method, the defense program can determine the association between the file defense rules and the container tags, and send the file defense rules and the association to the driver; the driver is used to detect the file access request initiated by the application, find the container identifier of the target container corresponding to the application, and find the association relationship based on the container tag associated with the container identifier to determine at least one corresponding file defense rule, and determine whether to perform a defense action on the file access request according to the at least one file defense rule.

[0168] As an optional method, the defense program can determine the association between the file defense rule and the container tag, obtain the container identifier and file information sent by the driver, and search for the container tag associated with the container identifier; and according to the container tag, search for at least one corresponding file defense rule; and according to the matching result between the file information and at least one file defense rule, generate indication information, and send the indication information to the driver.

[0169] The driver can detect the file access request initiated by the application and determine the file information; determine the container identifier of the target container corresponding to the application; send the container identifier and file information to the defense program, and determine whether to perform a defense action on the file access request based on the instruction information sent by the defense program.

[0170] In some embodiments, the defense program may also send the file defense rules and association relationships to the driver.

[0171] The driver can thus detect the file access request initiated by the application, determine the container identifier of the target container corresponding to the application, and find the corresponding file defense rule based on the container tag associated with the container identifier, and determine whether to perform a defense action on the file access request according to the file defense rule.

[0172] In some embodiments, the method may further include:

[0173] When a startup operation of any container is detected, the container-related information of the container is sent to the driver; the driver searches for a container tag associated with the container identifier based on the container-related information.

[0174] Figure 8 A schematic diagram of a structure of an embodiment of a file protection device provided in an embodiment of the present application, the device may include:

[0175] A first detection module 801, used to detect a file access request initiated by an application;

[0176] A first determination module 802 is used to determine a container identifier of a target container to which the application belongs;

[0177] A first search module 803 is used to search for a container tag associated with a container identifier;

[0178] A second search module 804 is used to search for at least one corresponding file defense rule according to the container tag;

[0179] The first execution module 805 is used to determine whether to execute a defense action on a file access request according to at least one file defense rule.

[0180] In some embodiments, the first search module specifically searches for a container tag associated with a container identifier based on container-related information sent by a defense program; the defense program is configured to send the acquired corresponding container-related information to a driver program when a startup operation of any container is detected.

[0181] In some embodiments, the container tag includes at least one of an application tag for identifying an application type, a cluster tag for identifying a cluster, and an image tag for identifying a container image;

[0182] The device may also include:

[0183] A first acquisition module is used to acquire the association relationship between the file defense rule issued by the defense program and the container tag;

[0184] The second search model may specifically search for an association relationship based on a container tag to determine at least one corresponding file defense rule.

[0185] In some embodiments, the first determination module may specifically search for a namespace identifier corresponding to the application from kernel data; the namespace identifier is used to identify a target container to which the application belongs.

[0186] In some embodiments, the namespace identifier includes a file namespace identifier.

[0187] In some embodiments, the first execution module may specifically determine whether the file information in the file access request matches at least one file defense rule; and determine whether to perform a defense action on the file access request based on the determination result.

[0188] Figure 8 The file protection device can perform Figure 2 The implementation principle and technical effect of the file protection method described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the file protection device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0189] Fig. 9A schematic diagram of the structure of another embodiment of a file protection device provided in an embodiment of the present application, the device may include:

[0190] The second detection module 901 is used to detect a file access request initiated by an application and determine file information;

[0191] A second determination module 902 is used to determine a container identifier of a target container corresponding to the application program;

[0192] The first sending module 903 is used to send the container identifier and the file information to the defense program, so that the defense program can search for the container tag associated with the container identifier, and search for at least one corresponding file defense rule according to the container tag, and generate indication information according to the matching result between the file information and the at least one file defense rule;

[0193] The second execution module 904 is used to determine whether to execute a defense action on the file access request according to the instruction information sent by the defense program.

[0194] Fig. 9 The file protection device can perform Figure 3 The implementation principle and technical effect of the file protection method described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the file protection device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0195] Fig.10 A schematic diagram of the structure of another embodiment of a file protection device provided in an embodiment of the present application, the device may include:

[0196] The second acquisition module 1001 is used to acquire the container identifier and file information sent by the driver; the file information is determined by the driver detecting the file access request initiated by the application; the container identifier is obtained based on the application search;

[0197] The third search module 1002 is used to search for a container tag associated with the container identifier;

[0198] The fourth search module 1003 is used to search for at least one corresponding file defense rule according to the container tag;

[0199] A matching module 1004, configured to generate indication information according to a matching result between the file information and at least one file defense rule;

[0200] The second sending module 1005 is used to send indication information to the driver; the indication information is used to indicate whether to perform a defense action on the file access request.

[0201] Fig.10The file protection device can perform Figure 4 The implementation principle and technical effect of the file protection method described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the file protection device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0202] Fig.11 A schematic diagram of a structure of an embodiment of a rule configuration device provided in an embodiment of the present application, the device may include:

[0203] The first display module 1101 is used to provide rule configuration prompt information on the rule configuration interface;

[0204] The first processing module 1102 is used to determine the file defense rule configured by the user and the container tag set for the file defense rule in response to the user configuration operation;

[0205] The third sending module 1103 is used to send the file defense rule and the container tag to the defense program, so that the defense program can determine the association relationship between the file defense rule and the container tag;

[0206] The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching for an associated relationship; and the at least one file defense rule is used to determine whether to perform a defense action on a file access request.

[0207] Fig.11 The rule configuration device can execute Figure 5 The implementation principle and technical effect of the rule configuration method described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the rule configuration device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0208] Fig.12 A schematic diagram of a structure of another embodiment of a file protection device provided in an embodiment of the present application, the device may include:

[0209] The third acquisition module 1201 is used to acquire the file defense rule; and acquire the container tag set for the file defense rule;

[0210] A relationship determination module 1202, used to determine the association relationship between the file defense rule and the container tag;

[0211] The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching for an associated relationship; and the at least one file defense rule is used to determine whether to perform a defense action on a file access request.

[0212] In some embodiments, the device may further include:

[0213] The fourth sending module is used to send the file defense rules and the association relationship to the driver, so that the driver can detect the file access request initiated by the application, determine the container identifier of the target container corresponding to the application, and find the association relationship to determine at least one corresponding file defense rule according to the container tag associated with the container identifier, and determine whether to perform a defense action on the file access request according to the at least one file defense rule.

[0214] In some embodiments, the device may further include:

[0215] The fifth sending module is used to detect the start operation of any container and send the container related information of the container to the driver; the driver searches for the container tag associated with the container identifier according to the container related information.

[0216] Fig.12 The file protection device can perform Figure 6 The implementation principle and technical effect of the file protection method described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the file protection device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0217] The embodiment of the present application further provides a computing device, as shown in FIG13 , the computing device may include a storage component 1301 and a processing component 1302;

[0218] The storage component 1301 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 1302 to implement the following steps: Figure 2 The file protection method of the embodiment shown or Figure 3 The file protection method of the embodiment shown or Figure 4 The file protection method of the embodiment shown in the figure or the file protection method of the embodiment shown in the figure or Figure 6 The file protection method of the illustrated embodiment.

[0219] Among them, the computing device can run one or more containers.

[0220] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0221] The processing components in the computing device are used to implement the following Figure 4 In the case of the rule configuration method of the illustrated embodiment, the computing device may further include a display component to perform corresponding display operations.

[0222] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc. The communication component is configured to facilitate wired or wireless communication between the computing device and other devices.

[0223] The processing component may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0224] The storage component is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0225] The display component may be an electroluminescent (EL) element, a liquid crystal display or a micro display having a similar structure, or a retinal direct display or a similar laser scanning display.

[0226] It should be noted that the above computing device implements Figure 2 The file protection method of the embodiment shown or Figure 3 The file protection method of the embodiment shown or Figure 4 The file protection method of the embodiment shown or Figure 6 In the case of the file protection method of the embodiment shown, it can be a physical device or an elastic computing host provided by a cloud computing platform. It can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. The processing component can also be a running virtual machine to be implemented by the virtual machine. Figure 2 The file protection method of the embodiment shown or Figure 3The file protection method of the embodiment shown or Figure 4 The file protection method of the embodiment shown or Figure 6 The file protection method of the illustrated embodiment, etc.

[0227] The computing device described above implements Figure 5 In the case of the rule configuration method shown, it can be specifically implemented as an electronic device. The electronic device can refer to a device used by a user and having the computing, Internet access, communication and other functions required by the user, such as a mobile phone, tablet computer, personal computer, wearable device, etc.

[0228] The present application also provides a computer-readable storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 2 The file protection method of the embodiment shown or Figure 3 The file protection method of the embodiment shown or Figure 4 The file protection method of the embodiment shown in the figure or the file protection method of the embodiment shown in the figure or Figure 6 The file protection method of the illustrated embodiment. The computer readable medium may be included in the electronic device described in the above embodiment; or it may exist independently without being assembled into the electronic device.

[0229] The present application also provides a computer program product, which includes a computer program carried on a computer-readable storage medium. When the computer program is executed by a computer, the above-mentioned Figure 2 The file protection method of the embodiment shown or Figure 3 The file protection method of the embodiment shown or Figure 4 The file protection method of the embodiment shown in the figure or the file protection method of the embodiment shown in the figure or Figure 6 The file protection method of the illustrated embodiment. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable medium. When the computer program is executed by a processor, various functions defined in the system of the present application are executed.

[0230] It should be noted that the embodiments of the present application may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0231] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0232] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0233] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0234] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A file protection method, characterized in that: Applied to a driver in a kernel, the method comprises: Detect file access requests initiated by applications; Determine a container identifier of a target container to which the application belongs; Finding a container tag associated with the container identifier; According to the container tag, searching for at least one corresponding file defense rule; According to the at least one file defense rule, it is determined whether to perform a defense action on the file access request.

2. The method according to claim 1, characterized in that The step of searching for a container tag associated with the container identifier includes: According to the container related information sent by the defense program, the container tag associated with the container identifier is searched; when the defense program detects the startup operation of any container, the corresponding container related information obtained is sent to the driver.

3. The method according to claim 1, characterized in that The container tag includes at least one of an application tag for identifying an application type, a cluster tag for identifying a cluster, and an image tag for identifying a container image; The method further comprises: Obtain the association between the file defense rules and container tags issued by the defense program; The searching, according to the container tag, for at least one corresponding file defense rule comprises: According to the container tag, the association relationship is searched to determine at least one corresponding file defense rule.

4. The method according to claim 1, characterized in that The container identifier of the target container to which the application belongs includes: A namespace identifier corresponding to the application is searched from kernel data; the namespace identifier is used to identify a target container to which the application belongs.

5. The method according to claim 4, characterized in that The namespace identifier includes a file namespace identifier.

6. The method according to claim 1, characterized in that The determining, according to the file defense rule, whether to perform a defense action on the file access request comprises: Determining whether the file information in the file access request matches the at least one file defense rule; According to the determination result, it is determined whether to perform a defense action on the file access request.

7. A file protection method, characterized in that: Applied to a driver in a kernel, the method comprises: Detect file access requests initiated by applications and determine file information; Determine a container identifier of a target container corresponding to the application; Sending the container identifier and the file information to a defense program, so that the defense program searches for a container tag associated with the container identifier, searches for at least one corresponding file defense rule according to the container tag, and generates indication information according to a matching result between the file information and the at least one file defense rule; Determine whether to execute a defense action on the file access request according to the indication information sent by the defense program.

8. A file protection method, characterized in that: Applied to a defense program, the method comprises: Obtaining a container identifier and file information sent by a driver; the file information is determined by the driver detecting a file access request initiated by an application; the container identifier is obtained based on a search by the application; Finding a container tag associated with the container identifier; According to the container tag, searching for at least one corresponding file defense rule; Generate indication information according to a matching result between the file information and the at least one file defense rule; The indication information is sent to the driver; the indication information is used to indicate whether to perform a defense action on the file access request.

9. A rule configuration method, characterized in that: include: Provide rule configuration prompt information in the rule configuration interface; In response to a user configuration operation, determining a file defense rule configured by the user and a container tag set for the file defense rule; Sending the file defense rule and the container tag to a defense program so that the defense program can determine an association between the file defense rule and the container tag; The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching the association relationship; the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

10. A file protection method, characterized in that: include: Get file defense rules; Obtain a container label set for the file defense rule; Determining an association relationship between the file defense rule and the container tag; The driver is used to detect a file access request initiated by an application and determine a container identifier of a target container corresponding to the application; the container identifier is used to determine an associated container tag, and the container tag is used to determine at least one corresponding file defense rule by searching the association relationship; the at least one file defense rule is used to determine whether to perform a defense action on the file access request.

11. A computing device, characterized in that: including a processing component and a storage component; The storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement the file protection method as described in any one of claims 1 to 6, or the file protection method as described in claim 7, or the file protection method as described in claim 8, or the rule configuration method as described in claim 9, or the file protection method as described in claim 10.

12. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, it implements the file protection method as described in any one of claims 1 to 6, the file protection method as described in claim 7, the file protection method as described in claim 8, the rule configuration method as described in claim 9, or the file protection method as described in claim 10.

Images