Information management method and device, electronic equipment, storage medium and computer program product

Abstract

The invention discloses an information management method. The method comprises the following steps: monitoring a file operation of a first application process in a process running process; obtaining first file information of a first file corresponding to the file operation; and based on the first file information, updating trusted measurement information of the first application process. The invention further discloses an information management device, electronic equipment, a storage medium and a computer program product.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to an information management method, device, electronic device, storage medium and computer program product. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase, and the threat challenges are becoming increasingly severe. Cryptography technology is the core technology and important means to achieve cryptographic security to protect network information systems. At present, in the process of implementing cryptography technology, trusted computing is usually used to implement cryptography technology. Among them, trusted computing is a secure computing method based on cryptography and distributed computing technology. It protects the security and integrity of the system by introducing tamper-proof hardware trusted security chips in the computing environment. Trusted computing is currently widely used in various scenarios, including cloud computing, the Internet of Things, industrial control, blockchain, etc. It has made rapid progress and has become one of the research hotspots in the computer field. In the process of trusted computing application, it is also often used to perform trusted computing on upper-level applications (Application, APP). The APP is started only after the trusted measurement of the APP is successful, which ensures the security of the system environment of the running APP.

[0003] However, in the current management process of APP, the path of temporary files generated by the App is usually set in the whitelist. Since the files in the whitelist path are not trusted during the management process, the temporary files in the whitelist will not be trusted, resulting in the possibility that malicious software may control the operation of the App by modifying the temporary files in the whitelist path, seriously threatening the security of system operation and data security.

[0004] Application Contents

[0005] In order to solve the above technical problems, the present application hopes to provide an information management method, device, electronic device, storage medium and computer program product, which solves the problem that malware may control the operation of the App by modifying the temporary files in the whitelist path due to the current lack of trust measurement for temporary files in the whitelist path, and proposes a method for dynamic trust measurement of temporary files running in the App to ensure the reliability and security of the operation coefficient and operation data.

[0006] The technical solution of this application is implemented as follows:

[0007] The present application provides an information management method, the method comprising:

[0008] Monitoring file operations of the first application process during the process running;

[0009] Obtaining first file information of a first file corresponding to the file operation;

[0010] Based on the first file information, the trust metric information of the first application process is updated.

[0011] In the above solution, the step of obtaining the first file information of the first file corresponding to the file operation includes:

[0012] Acquire the first file information of the first file at a preset time interval;

[0013] Or, if an operation end mark for the first file is detected, the first file information of the first file is obtained.

[0014] In the above solution, the first file information at least includes file path information of the first file and the first file, or the first file information at least includes file path information and summary information of the first file.

[0015] In the above solution, the file operation includes a write operation on the file.

[0016] In the above solution, updating the trust metric information of the first application process based on the first file information includes:

[0017] Performing hash processing on the first file information to obtain a first hash value group;

[0018] The trust metric information is updated using the first hash value group.

[0019] In the above solution, before monitoring the file operation of the first application process during the process running, the method further includes:

[0020] Determining the first application process to be monitored;

[0021] Detecting whether a monitoring function for monitoring file operations on the first application process has been enabled;

[0022] If the monitoring function is not enabled, enable the monitoring function.

[0023] In the above scheme, the method further comprises:

[0024] If a start instruction for instructing to start running the first application process is detected, second file information of m second files corresponding to the first application process is determined; wherein m is an integer greater than or equal to 1;

[0025] Performing hash processing on the m groups of the second file information to obtain m groups of second hash value groups;

[0026] Determining a control operation in response to the start instruction based on the m groups of the second hash value groups and the trustworthy metric information;

[0027] The control operation for the first application process is performed.

[0028] In the above solution, determining the control operation in response to the start instruction based on the m groups of the second hash value groups and the trust metric information includes:

[0029] If all of the m groups of the second hash value groups match the measurement information in the trusted measurement information, determining that the control operation is a start operation of starting the first application process;

[0030] If at least one of the m groups of second hash values ​​does not match the measurement information in the trusted measurement information, the control operation is determined to be a prohibition operation for prohibiting the start of the first application process.

[0031] In the above scheme, the method further comprises:

[0032] Based on the control operation, generating prompt information;

[0033] The prompt information is displayed.

[0034] The present application provides an information management device, the device comprising: a monitoring unit, an acquisition unit and an update unit; wherein:

[0035] The monitoring unit is used to monitor file operations of the first application process during the process running;

[0036] The acquiring unit is used to acquire first file information of a first file corresponding to the file operation;

[0037] The updating unit is used to update the trust metric information of the first application process based on the first file information.

[0038] The present application provides an electronic device, the device comprising: a memory, a processor and a communication bus; wherein:

[0039] The memory is used to store executable instructions;

[0040] The communication bus is used to realize the communication connection between the processor and the memory;

[0041] The processor is used to execute the information management program stored in the memory to implement the steps of the information management method as described in any one of the above items.

[0042] The present application provides a storage medium, on which an information management program is stored. When the information management program is executed, it is used to implement the steps of any of the above-mentioned information management methods.

[0043] The present application provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned information management methods when executed by a processor.

[0044] The embodiments of the present application provide an information management method, apparatus, device, storage medium and computer program product, which monitor the file operation of the first application process during the process running through an electronic device, obtain the first file information of the first file corresponding to the file operation, and then update the trust measurement information of the first application process based on the first file information. In this way, the trust measurement information is updated by using the first file information of the first file corresponding to the file operation during the running of the first application process, so as to realize the updating of the trust measurement information according to the real-time file, solve the problem that the temporary files in the whitelist path are not trusted at present, which may cause malware to control the running of the App by modifying the temporary files in the whitelist path, and propose a method for dynamic trust measurement of temporary files running APP to perform trust measurement, thereby improving the reliability and security of the running coefficient and running data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of the process of the information management method provided in the embodiment of the present application Figure 1 ;

[0046] Figure 2 Schematic diagram of the process of the information management method provided in the embodiment of the present application Figure 2 ;

[0047] Figure 3 Schematic diagram of the process of the information management method provided in the embodiment of the present application Figure 3 ;

[0048] Figure 4 Schematic diagram of the process of the information management method provided in the embodiment of the present application Figure 4 ;

[0049] Figure 5 A schematic diagram of a flow chart of an application implementation of an information management method provided in an embodiment of the present application;

[0050] Figure 6 A schematic diagram of the structure of an information management device provided in an embodiment of the present application;

[0051] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0053] The embodiment of the present application provides an information management method, referring to Figure 1 As shown, the method is applied to an electronic device, and the method comprises the following steps:

[0054] Step 101: Monitor file operations of a first application process during the process running.

[0055] In the embodiment of the present application, the electronic device is a device with computing capability and capable of running application processes, such as a computer device, an intelligent mobile terminal device, etc. The intelligent mobile terminal device may be, for example, a smart phone, an intelligent mobile car, etc. The electronic device monitors the application programs it runs, detects which application programs are running, and performs file operations during the running process.

[0056] Step 102: Obtain first file information of a first file corresponding to the file operation.

[0057] In the embodiment of the present application, the first file may be a file generated by the first application process during the process running, may be a newly generated temporary file, may be a newly generated non-temporary file, or may be an existing file. The file operation may be, for example, an operation of writing a file, such as adding, deleting, and modifying.

[0058] When the electronic device detects a file operation, first file information of a first file of the file operation is obtained, where the first file information is attribute characteristic information of the first file, for example, storage characteristic information and file characteristic information of the first file.

[0059] Step 103: Based on the first file information, update the trust metric information of the first application process.

[0060] In an embodiment of the present application, the electronic device processes the first file information to obtain the measurement information corresponding to the first file, and uses the measurement information corresponding to the first file to update the trusted measurement information of the first application process, wherein the update may be an operation to replace the existing measurement information in the trusted measurement information of the first application process, or may be an operation to store the measurement information in the first application process when there is no measurement information in the trusted measurement information of the first application process. The trusted measurement information of the first application process is a total information set used to perform trusted computing on the first application process.

[0061] The information management method provided by the embodiment of the present application monitors the file operation of the first application process during the process running through the electronic device, obtains the first file information of the first file corresponding to the file operation, and then updates the trust measurement information of the first application process based on the first file information. In this way, the trust measurement information is updated by using the first file information of the first file corresponding to the file operation during the running of the first application process, so as to realize the updating of the trust measurement information according to the real-time file, solve the problem that the temporary files in the whitelist path are not trusted at present, which may cause malware to control the running of the App by modifying the temporary files in the whitelist path, and propose a method for dynamic trust measurement of temporary files running APP to perform trust measurement, thereby improving the reliability and security of the running coefficient and running data.

[0062] Based on the foregoing embodiments, an embodiment of the present application provides an information management method, which is applied to an electronic device and includes the following steps:

[0063] Step 201: Monitor file operations of a first application process during the process execution.

[0064] In an embodiment of the present application, an electronic device is taken as a computer device for example. The computer device is used to implement the process running of a first application process. During the running of the first application process, the computer device monitors the first application process to monitor whether it executes file operations.

[0065] Step 202: Obtain first file information of a first file corresponding to the file operation.

[0066] In an embodiment of the present application, when the computer device monitors a file operation of a first application process, a first file of the file operation is determined, and first file information of the first file is obtained.

[0067] Step 203: Based on the first file information, update the trust metric information of the first application process.

[0068] In an embodiment of the present application, the computer device uses the first file information to update the trust measurement information of the first application to ensure that the first file can be trusted in subsequent processes.

[0069] Based on the above embodiments, in other embodiments of the present application, step 202 may be implemented by step 202a or step 202b:

[0070] Step 202a: Obtain first file information of a first file at a preset time interval.

[0071] In the embodiment of the present application, the preset time interval can be an empirical time length obtained from a large number of experiments. In actual application scenarios, the preset time interval can be adjusted and set according to actual needs. The computer device obtains the file information of the first file according to the preset time interval to obtain the first file information.

[0072] Step 202b: If an operation end mark for the first file is detected, first file information of the first file is obtained.

[0073] In an embodiment of the present application, the operation end mark for the first file may be, for example, a mark indicating the end of the operation on the first file, for example, a file closing mark. Exemplarily, after opening the first file, modifying the content in the first file, and detecting the closing instruction corresponding to the first file, the first file information of the first file is obtained.

[0074] Based on the foregoing embodiment, in other embodiments of the present application, the first file information includes at least the file path information of the first file and the first file, or the first file information includes at least the file path information and summary information of the first file.

[0075] In the embodiment of the present application, the file path information of the first file is the storage path information of the first file, and the first file in the first file information refers to the entire first file content. The summary information is the file summary information of the first file, which is a brief description or summary of the first file, and generally includes the name, author, creation date, modification date, file size, file type, and file content of the first file.

[0076] Based on the foregoing embodiment, in other embodiments of the present application, the file operation includes a write operation on the file.

[0077] In an embodiment of the present application, a file write operation may be, for example, an operation of generating a new first file, or an operation of modifying an existing first file, for example, an operation of writing new content, or an operation of modifying, deleting, etc., existing content.

[0078] Based on the above embodiments, in other embodiments of the present application, step 203 can be implemented by steps 203a to 203b:

[0079] Step 203a: Perform hash processing on the first file information to obtain a first hash value group.

[0080] In an embodiment of the present application, a hash algorithm is used to hash the file path information in the first file information to obtain a path hash value, and a hash algorithm is used to hash the first file in the first file information to obtain a file hash value, so that a first hash value group including a path hash value and a file hash value can be obtained. Alternatively, a hash algorithm is used to hash the file path information in the first file information to obtain a path hash value, and a hash algorithm is used to hash the summary information in the first file information to obtain a summary hash value, so that a first hash value group including a path hash value and a summary hash value can be obtained.

[0081] Step 203b: Use the first hash value group to update the trust metric information.

[0082] In an embodiment of the present application, the first hash value group is used to update the trusted measurement information. For example, when there is no hash value group corresponding to the first file in the trusted measurement information, the hash value group of the first file is stored in the trusted measurement information corresponding to the first file. When there is a hash value group corresponding to the first file in the trusted measurement information, the latest first hash value group is used to replace the hash value group corresponding to the first file to implement the update operation.

[0083] Based on the above embodiments, in other embodiments of the present application, refer to Figure 2 As shown, before the electronic device executes step 201, it is also used to execute steps 204 to 206:

[0084] Step 204: Determine the first application process to be monitored.

[0085] In the embodiment of the present application, the electronic device determines the application process that needs to be monitored and obtains the first application process.

[0086] Step 205: Detect whether a monitoring function for monitoring file operations on the first application process has been enabled.

[0087] In an embodiment of the present application, the electronic device monitors whether a monitoring function for monitoring a first application process is enabled, and obtains an enabled state, wherein the enabled state includes a first state and a second state, the first state indicates that it is not enabled, and the second state indicates that it is enabled.

[0088] Step 206: If the monitoring function is not enabled, enable the monitoring function.

[0089] In the embodiment of the present application, when the enabled state is the first state, that is, the monitoring function is not enabled, the monitoring function of the first application process is started to monitor the first application process. When the enabled state is the second state, it indicates that the monitoring function of the first application process is enabled, and the first application process is directly monitored.

[0090] Based on the above embodiments, in other embodiments of the present application, refer to Figure 3 As shown, the electronic device is also used to perform steps 207 to 210:

[0091] Step 207: If a start instruction for instructing to start running the first application process is detected, second file information of m second files corresponding to the first application process is determined.

[0092] Here, m is an integer greater than or equal to 1.

[0093] In an embodiment of the present application, the startup instruction may be generated after being triggered by a user, or may be an instruction automatically triggered and generated during the operation of the application program to instruct the first application process included therein to start running. When a startup instruction for instructing the first application process to start running is detected, the m second files already existing in the first application process are determined, and the second file information of the m second files is obtained, where m is the number of all second files corresponding to the first application process. The information content in the second file information corresponds to the information content of the first file information, for example, when the first file information is the file path information of the first file and the first file, the corresponding second file information is the file path information of the second file and the second file; or when the first file information includes at least the file path information and summary information of the first file, the corresponding second file information is the file path information of the second file and the summary information of the second file.

[0094] Step 208: Perform hash processing on the m groups of second file information to obtain m groups of second hash value groups.

[0095] Step 209: Determine a control operation in response to the start instruction based on the m groups of second hash values ​​and the trust metric information.

[0096] In the embodiment of the present application, the m groups of second hash value groups are compared and analyzed with the stored trust metric information to obtain a comparison analysis result, and the control operation in response to the start instruction is determined according to the comparison analysis result.

[0097] Step 210: Execute a control operation on the first application process.

[0098] In the embodiment of the present application, after the control operation for the first application process is determined, the control operation is performed on the first application process.

[0099] It should be noted that steps 207 to 210 may be executed before step 201 or after step 206, which may be determined based on the actual application scenario. For example, in an embodiment including steps 201 to 203, steps 207 to 210 may be executed before step 201; in an embodiment including steps 201 to 206, steps 207 to 210 may be executed before step 201 and after step 206.

[0100] Based on the above embodiments, in other embodiments of the present application, step 209 may be implemented by step 209a or step 209b:

[0101] Step 209a: If the m groups of second hash value groups all match the measurement information in the trusted measurement information, determine that the control operation is a start operation of starting the first application process.

[0102] In the embodiment of the present application, when each of the m groups of second hash value groups matches the measurement information in the trusted measurement information, the control operation is determined to be a startup operation, that is, an operation of running the first application process. If there is a group of hash value groups in the trusted measurement information that has the same value as the corresponding group of second hash value groups, it is determined that the group of second hash value groups matches the trusted measurement information.

[0103] Step 209b: if at least one of the m second hash value groups does not match the measurement information in the trusted measurement information, determine that the control operation is a prohibition operation for prohibiting the start of the first application process.

[0104] In the embodiment of the present application, when at least one of the m second hash value groups does not match the measurement information of the trusted measurement information, the control operation is determined to be a prohibited operation, that is, the first application process is not run.

[0105] Based on the above embodiments, in other embodiments of the present application, refer to Figure 4 As shown, the electronic device is also used to perform steps 211 to 212:

[0106] Step 211: Generate prompt information based on the control operation.

[0107] In the embodiment of the present application, according to the determined control operation, corresponding prompt information is generated to prompt the user whether the first application process is running. In some application scenarios, prompt information can be generated only when the control operation is a prohibited operation.

[0108] Step 212: Display prompt information.

[0109] In the embodiment of the present application, after the electronic device generates the prompt information, the prompt information is output and displayed to realize the display operation of the prompt information, so that the user can be reminded of the running status of the first application process, so as to quickly locate the problem and troubleshoot the problem. When the electronic device outputs the prompt information, the prompt information can be output to the display area of ​​the electronic device, for example, it can be displayed at the information display of the display screen of the electronic device; or the prompt information can be output to a third-party display device with display function that can communicate with the electronic device, such as a smart phone with communication link function with the electronic device, and displayed on the smart phone.

[0110] Based on the above embodiments, the embodiments of the present application provide an electronic device, which at least includes: a trusted measurement module (TMM), a trusted measurement list (ML) and an application file monitoring module (FMM).

[0111] TMM can run in the operating system (OS) kernel. Specifically, it can perform trust measurement on each upper-layer application App based on the locally maintained trusted measurement list (Trusted Measurement List, ML) according to the underlying trusted chip, such as the Trusted Cryptography Module (TCM) or the Trusted Platform Module.

[0112] ML is maintained locally by TMM on electronic devices, saving the files that each app needs to measure and the corresponding file hash value groups.

[0113] FMM is used to receive relevant control instructions from TMM and monitor file operations on the monitored App.

[0114] Correspondingly, the aforementioned electronic device is used to run a trusted computing platform, the trusted computing platform includes an OS operating system and an upper-layer application APP, the OS operating system includes TMM, FMM and ML, and correspondingly provides an information management method, referring to Figure 5 As shown, the specific implementation process includes at least the following implementation steps:

[0115] Step a11: When the process App_p of the upper-layer application App needs to start running, the TMM is triggered to perform trust measurement on the App.

[0116] Step a12, TMM calculates the Hash values ​​of all files included in the APP, and compares the Hash values ​​of all files included in the APP with the measurement values ​​of the corresponding files in the ML. If the Hash values ​​of all files included in the APP are consistent with the measurement values ​​of the corresponding files in the ML, execute step a13; if at least one Hash value among the Hash values ​​of all files included in the APP is inconsistent with the measurement value of the corresponding file in the ML, execute step a21.

[0117] If the Hash values ​​of all files included in the APP are consistent with the measurement values ​​of the corresponding files in ML, it means that the App measurement is successful. If at least one of the Hash values ​​of all files included in the APP is inconsistent with the measurement value of the corresponding file in ML, it means that the corresponding file may be tampered with. An error should be prompted or feedback should be given to the administrator, and the startup of App_p should be prohibited, and the process will exit.

[0118] Step a13, TMM determines whether FMM is running in the current trusted computing platform. If FMM is not running, execute step a14; if FMM is running, execute step a15.

[0119] Step a14: Start FMM.

[0120] Step a15: TMM sends the identification information of the process App_p to be monitored to FMM.

[0121] The identification information of the process App_p may be the process name of the process App_p or the identity information (Identity, ID) of the process App_p. The running process of the process App_p is monitored by the FMM.

[0122] Step a16: FMM monitors the file operations of the specified process App_p.

[0123] Step a17: TMM allows App_p to start and run normally.

[0124] Step a18: When FMM detects that process App_p performs file operations, it records the file operations.

[0125] The file operation may include, for example, a write operation such as generating a temporary file, modifying a configuration file, or modifying a database file.

[0126] Step a19, FMM determines the file corresponding to the file operation, calculates the Hash value of the file and the file path of the file, and sends the calculated file path and the Hash value of the file to TMM according to the corresponding strategy.

[0127] The corresponding strategy may be defined by sending time frequency, or completing a complete file operation, for example, generating a file, completing file modification, etc.

[0128] Step a20: TMM updates the received file path and file Hash value into ML.

[0129] Among them, the updated ML can be used for trusted computing.

[0130] Step a21, TMM prohibits starting process App_p.

[0131] Among them, prompt information can also be generated to enable management personnel to conduct further inspection to eliminate the risk of file tampering.

[0132] In this way, monitoring and measurement are achieved with the process as the smallest granularity, thereby ensuring the full quantification of ML files, so that the App process files and related files accessed during App runtime are within the measurement range of TMM, and the trusted measurement list ML will be dynamically updated in real time according to the running status of each App process, thereby ensuring the synchronization of ML and preventing the generation of temporary files from causing security measurement errors at the next startup. Furthermore, in the implementation process, there is no need to modify the underlying hardware, only to add an application file monitoring module FMM, which can be implemented by software and has a high degree of compatibility with the original measurement protocol.

[0133] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0134] The information management method provided by the embodiment of the present application monitors the file operation of the first application process during the process running through the electronic device, obtains the first file information of the first file corresponding to the file operation, and then updates the trust measurement information of the first application process based on the first file information. In this way, the trust measurement information is updated by using the first file information of the first file corresponding to the file operation during the running of the first application process, so as to realize the updating of the trust measurement information according to the real-time file, solve the problem that the temporary files in the whitelist path are not trusted at present, which may cause malware to control the running of the App by modifying the temporary files in the whitelist path, and propose a method for dynamic trust measurement of temporary files running APP to perform trust measurement, thereby improving the reliability and security of the running coefficient and running data.

[0135] Based on the above embodiments, the embodiments of the present application provide an information management device, which can be applied to Figures 1 to 4 In the information management method provided in the corresponding embodiment, refer to Figure 6As shown, the information management device 3 may include: a monitoring unit 31, an acquisition unit 32 and an update unit 33; wherein:

[0136] A monitoring unit 31 is used to monitor file operations of the first application process during the process running;

[0137] An acquiring unit 32, configured to acquire first file information of a first file corresponding to the file operation;

[0138] The updating unit 33 is configured to update the trust metric information of the first application process based on the first file information.

[0139] In other embodiments of the present application, the acquisition unit is specifically used to implement the following steps:

[0140] Acquire first file information of a first file at a preset time interval;

[0141] Or, if an operation end mark for the first file is detected, first file information of the first file is obtained.

[0142] In other embodiments of the present application, the first file information includes at least file path information of the first file and the first file, or the first file information includes at least file path information and summary information of the first file.

[0143] In other embodiments of the present application, the file operation includes a write operation on the file.

[0144] In other embodiments of the present application, the updating unit includes: a processing module and an updating module; wherein:

[0145] A processing module, configured to perform hash processing on the first file information to obtain a first hash value group;

[0146] An updating module is used to update the trust metric information using the first hash value group.

[0147] In other embodiments of the present application, before the monitoring unit, the information management device further includes: a determination unit, a detection unit and a start unit; wherein:

[0148] A determination unit, configured to determine a first application process to be monitored;

[0149] A detection unit, used to detect whether a monitoring function for monitoring file operations on the first application process has been enabled;

[0150] The starting unit is used to start the monitoring function if the monitoring function is not enabled.

[0151] In other embodiments of the present application, the information processing device further includes: a processing unit and an execution unit; wherein:

[0152] The determining unit is further configured to determine the second file information of m second files corresponding to the first application process if a startup instruction for instructing to start running the first application process is detected; wherein m is an integer greater than or equal to 1;

[0153] A processing unit, configured to perform hash processing on the m groups of second file information to obtain m groups of second hash value groups;

[0154] The determination unit is further used to determine the control operation in response to the start instruction based on the m groups of second hash value groups and the trust measurement information;

[0155] The execution unit is used to execute a control operation on the first application process.

[0156] In other embodiments of the present application, when the determination unit performs the step of determining the control operation in response to the start instruction based on the m groups of second hash value groups and the trust metric information, it can be specifically implemented by the following steps:

[0157] If the m groups of second hash value groups all match the measurement information in the trusted measurement information, determining that the control operation is a start operation of starting the first application process;

[0158] If at least one of the m second hash value groups does not match the measurement information in the trusted measurement information, the control operation is determined to be a prohibition operation for prohibiting the start of the first application process.

[0159] In other embodiments of the present application, the information processing device further includes: a generating unit and a display unit; wherein:

[0160] A generating unit, used for generating prompt information based on the control operation;

[0161] The display unit is used to display prompt information.

[0162] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0163] The information management device provided in the embodiment of the present application monitors the file operation of the first application process during the process running through an electronic device, obtains the first file information of the first file corresponding to the file operation, and then updates the trust measurement information of the first application process based on the first file information. In this way, the trust measurement information is updated by using the first file information of the first file corresponding to the file operation during the running of the first application process, so as to realize the updating of the trust measurement information according to the real-time file, solve the problem that the temporary files in the whitelist path are not trusted at present, which may cause malware to control the running of the App by modifying the temporary files in the whitelist path, and propose a method for dynamic trust measurement of temporary files running APP to perform trust measurement, thereby improving the reliability and security of the running coefficient and running data.

[0164] Based on the above embodiments, the embodiments of the present application provide an electronic device, which can be applied to Figures 1 to 4 In the information management method provided in the corresponding embodiment, refer to Figure 7 As shown, the electronic device 4 may include: a memory 41, a processor 42 and a communication bus 43; wherein:

[0165] A memory 41, used for storing executable instructions;

[0166] A communication bus 43, used to realize the communication connection between the processor 42 and the memory 41;

[0167] The processor 42 is used to execute the information management method stored in the memory 41 to implement the following Figures 1 to 4 The implementation process of the information management method provided in the corresponding embodiment will not be repeated here.

[0168] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, referred to as a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement reference Figures 1 to 4 The implementation process of the information management method provided in the corresponding embodiment will not be repeated here.

[0169] Based on the foregoing embodiments, the embodiments of the present application further provide a computer program product, including a computer program, which can be executed by the processor 42 of the electronic device 4 to complete any of the foregoing method steps.

[0170] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0171] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information management method, characterized in that: The method comprises: Monitoring file operations of the first application process during the process running; Obtaining first file information of a first file corresponding to the file operation; Based on the first file information, the trust metric information of the first application process is updated.

2. The method according to claim 1, characterized in that: The obtaining first file information of the first file corresponding to the file operation includes: Acquire the first file information of the first file at a preset time interval; Or, if an operation end mark for the first file is detected, the first file information of the first file is obtained.

3. The method according to claim 1 or 2, characterized in that: The first file information includes at least file path information of the first file and the first file, or the first file information includes at least file path information and summary information of the first file.

4. The method according to claim 1 or 2, characterized in that: The file operation includes a write operation on a file.

5. The method according to claim 3, characterized in that: The updating of the trust metric information of the first application process based on the first file information includes: Performing hash processing on the first file information to obtain a first hash value group; The trust metric information is updated using the first hash value group.

6. The method according to claim 1, characterized in that Before monitoring the file operation of the first application process during the process running, the method further includes: Determining the first application process to be monitored; Detecting whether a monitoring function for monitoring file operations on the first application process has been enabled; If the monitoring function is not enabled, enable the monitoring function.

7. The method according to claim 6, characterized in that The method further comprises: If a start instruction for instructing to start running the first application process is detected, second file information of m second files corresponding to the first application process is determined; wherein m is an integer greater than or equal to 1; Performing hash processing on the m groups of the second file information to obtain m groups of second hash value groups; Determining a control operation in response to the start instruction based on the m groups of the second hash value groups and the trustworthy metric information; The control operation for the first application process is performed.

8. The method according to claim 7, characterized in that The determining, based on the m groups of the second hash value groups and the trustworthy metric information, a control operation in response to the start instruction comprises: If all of the m groups of the second hash value groups match the measurement information in the trusted measurement information, determining that the control operation is a start operation of starting the first application process; If at least one of the m groups of second hash values ​​does not match the measurement information in the trusted measurement information, the control operation is determined to be a prohibition operation for prohibiting the start of the first application process.

9. The method according to claim 7, characterized in that: The method further comprises: Based on the control operation, generating prompt information; The prompt information is displayed.

10. An information management device, characterized in that: The device comprises: a monitoring unit, an acquisition unit and an updating unit; wherein: The monitoring unit is used to monitor file operations of the first application process during the process running; The acquiring unit is used to acquire first file information of a first file corresponding to the file operation; The updating unit is used to update the trust metric information of the first application process based on the first file information.

11. An electronic device, characterized in that: The device comprises: a memory, a processor and a communication bus; wherein: The memory is used to store executable instructions; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information management program stored in the memory to implement the steps of the information management method according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium stores an information management program, which is used to implement the steps of the information management method according to any one of claims 1 to 9 when executed.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the steps of the information management method according to any one of claims 1 to 9.

Images