File integrity checking method and device, computer equipment and storage medium

Abstract

The invention relates to a file integrity checking method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring an integrity check list for a to-be-checked file; extracting an initial file list in the integrity check list; determining target file information corresponding to the initial file information; according to the target file information, updating the initial file list to obtain an updated file list; the updated file list comprises historical file information of the updated file corresponding to the to-be-checked file; determining current file information corresponding to the updated file, and determining an exception check result corresponding to the updated file according to the difference between the historical file information and the current file information; and determining an integrity check result of the to-be-checked file according to the exception check result. By adopting the method, the file integrity checking efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a file integrity checking method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] At present, in order to ensure the security of files, it is very important to check the integrity of files.

[0003] In traditional technology, when checking the integrity of a file, it is usually mainly done manually; however, this method tends to consume a lot of time, resulting in low efficiency in checking the integrity of the file. Summary of the invention

[0004] Based on this, it is necessary to provide a file integrity checking method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the efficiency of file integrity checking in response to the above technical problems.

[0005] In a first aspect, the present application provides a file integrity checking method, comprising:

[0006] Acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked;

[0007] Extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked;

[0008] Determining target file information corresponding to the initial file information;

[0009] According to the target file information, the initial file list is updated to obtain an updated file list; the updated file list includes the updated file corresponding to the file to be checked and the historical file information corresponding to the updated file;

[0010] Determine current file information corresponding to the updated file, and determine an abnormality check result corresponding to the updated file based on a difference between the historical file information and the current file information;

[0011] According to the abnormality check result, the integrity check result of the file to be checked is determined.

[0012] In one embodiment, determining the target file information corresponding to the initial file information includes:

[0013] Obtaining type information of each of the initial file information;

[0014] Filtering out, from each of the initial file information, the initial file information whose type information meets the preset type information as candidate file information;

[0015] Determine the target file information corresponding to the candidate file information.

[0016] In one embodiment, determining the target file information corresponding to the candidate file information includes:

[0017] Determine the associated file information corresponding to the candidate file information, and obtain the status information and version information corresponding to each of the associated file information;

[0018] From each of the associated file information, the associated file information whose status information and version information both meet preset conditions is screened out as the target file information.

[0019] In one embodiment, the historical file information includes the historical data volume, historical attributes and historical summary information corresponding to the updated file, and the current file information includes the current data volume, current attributes and current summary information corresponding to the updated file;

[0020] The determining, based on the difference between the historical file information and the current file information, an abnormality check result corresponding to the updated file includes:

[0021] In the case where the historical data volume is inconsistent with the current data volume, and / or the historical attributes are inconsistent with the current attributes, and / or the historical summary information is inconsistent with the current summary information, determining that the updated file is an abnormal file;

[0022] When the historical data volume is consistent with the current data volume, the historical attributes are consistent with the current attributes, and the historical summary information is consistent with the current summary information, it is determined that the updated file is a normal file.

[0023] In one embodiment, before extracting the initial file list in the integrity check list, the method further includes:

[0024] Performing digest signature processing on the integrity check list to obtain current digest information corresponding to the integrity check list;

[0025] Obtaining historical summary information corresponding to the integrity check list;

[0026] comparing the current summary information with the historical summary information;

[0027] The step of extracting the initial file list from the integrity check list comprises:

[0028] When the current summary information is consistent with the historical summary information, an initial file list in the integrity check list is extracted.

[0029] In one embodiment, obtaining an integrity check list for the file to be checked includes:

[0030] Obtaining a list of integrity checks to be processed and a key corresponding to the list of integrity checks to be processed;

[0031] The to-be-processed integrity check list is decrypted according to the key to obtain the integrity check list.

[0032] In a second aspect, the present application also provides a file integrity checking device, comprising:

[0033] A list acquisition module, used to acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked;

[0034] A list extraction module, used to extract an initial file list in the integrity check list; the initial file list includes initial file information corresponding to the file to be checked;

[0035] An information determination module, used to determine target file information corresponding to the initial file information;

[0036] A list updating module, used to update the initial file list according to the target file information to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked;

[0037] an abnormality determination module, used to determine the current file information corresponding to the updated file, and determine the abnormality inspection result corresponding to the updated file according to the difference between the historical file information and the current file information;

[0038] The result determination module is used to determine the integrity check result of the file to be checked according to the abnormality check result.

[0039] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0040] Acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked;

[0041] Extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked;

[0042] Determining target file information corresponding to the initial file information;

[0043] According to the target file information, the initial file list is updated to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked;

[0044] Determine current file information corresponding to the updated file, and determine an abnormality check result corresponding to the updated file based on a difference between the historical file information and the current file information;

[0045] According to the abnormality check result, the integrity check result of the file to be checked is determined.

[0046] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0047] Acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked;

[0048] Extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked;

[0049] Determining target file information corresponding to the initial file information;

[0050] According to the target file information, the initial file list is updated to obtain an updated file list; the updated file list includes the updated file corresponding to the file to be checked and the historical file information corresponding to the updated file;

[0051] Determine current file information corresponding to the updated file, and determine an abnormality check result corresponding to the updated file based on a difference between the historical file information and the current file information;

[0052] According to the abnormality check result, the integrity check result of the file to be checked is determined.

[0053] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0054] Acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked;

[0055] Extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked;

[0056] Determining target file information corresponding to the initial file information;

[0057] According to the target file information, the initial file list is updated to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked;

[0058] Determine current file information corresponding to the updated file, and determine an abnormality check result corresponding to the updated file based on a difference between the historical file information and the current file information;

[0059] According to the abnormality check result, the integrity check result of the file to be checked is determined.

[0060] The above-mentioned file integrity check method, apparatus, computer equipment, storage medium and computer program product first obtain an integrity check list for the file to be checked, then extract the initial file list in the integrity check list, and determine the target file information corresponding to the initial file information. Then, according to the target file information, the initial file list is updated to obtain an updated file list, and then the current file information corresponding to the updated file is determined, and according to the difference between the historical file information and the current file information, the abnormality check result corresponding to the updated file is determined. Finally, according to the abnormality check result, the integrity check result of the file to be checked is determined. In this way, when performing an integrity check on a file, after obtaining the integrity check list for the file to be checked, the target file information corresponding to the initial file list in the integrity check list can be quickly determined, so that the initial file list can be quickly updated to obtain an updated file list, and then the abnormal check result corresponding to the updated file can be quickly determined from the updated file list, which is conducive to improving the efficiency of determining the integrity check result of the file to be checked, thereby improving the efficiency of the integrity check of the file; moreover, the entire process does not require human intervention, avoiding the defect that manual verification and checking of files is easy to take a lot of time, resulting in low efficiency of file integrity checking, and further improving the efficiency of file integrity checking. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 A schematic diagram of a process flow of a file integrity checking method in one embodiment;

[0063] Figure 2 A flowchart of the steps of determining target file information corresponding to initial file information in one embodiment;

[0064] Figure 3 A schematic diagram of a process of decrypting an integrity check list in one embodiment;

[0065] Figure 4 is a flowchart of a file integrity checking method in another embodiment;

[0066] Figure 5 is a structural block diagram of a file integrity checking device in one embodiment;

[0067] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0069] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0070] In an exemplary embodiment, Figure 1As shown, a file integrity check method is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, and tablet computers; the server can be implemented as an independent server or a server cluster consisting of multiple servers. In this embodiment, the method includes the following steps:

[0071] Step S101, obtaining an integrity check list for files to be checked; the integrity check list includes historical file information of each file to be checked.

[0072] The files to be checked refer to files that need to be checked for integrity.

[0073] The integrity check list refers to the list information corresponding to the integrity check of the files to be checked, including the historical file information of each file to be checked, as shown in Table 1.

[0074] Table 1 Completeness check list

[0075]

[0076] The historical file information refers to the file information of each file to be checked that was saved in the past, including the file name, file size, file attributes, etc.

[0077] Exemplarily, the server obtains the integrity check list to be processed, and decrypts the integrity check list to be processed to obtain an integrity check list including historical file information of each file to be checked.

[0078] Step S102, extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked.

[0079] The initial file list includes initial file information corresponding to the file to be checked.

[0080] The initial file information refers to the file information whose corresponding version timestamp is v0 in the integrity check list, as shown in Table 1.

[0081] Exemplarily, the server determines the initial file information corresponding to the file to be checked from the integrity check list, and extracts the initial file list in the integrity check list based on the initial file information.

[0082] For example, referring to Table 1, starting from the first record in the integrity check list, access in ascending order according to the file name until the end of the "initial version separator", read the "file name", "size", "attribute", "type", "summary information", "status" and other fields of these files to obtain the initial file list.

[0083] Step S103, determining the target file information corresponding to the initial file information.

[0084] The target file information refers to the file information corresponding to the initial file information, whose "type" value is dynamic, "status" value is normal, and whose version is the latest version.

[0085] Exemplarily, the server determines from the integrity check list the file information corresponding to the initial file information, whose "type" value is dynamic, "status" value is normal, and whose version is the latest version, as the target file information.

[0086] It should be noted that the target file information can also be determined by a file processing instruction sent manually. Further, the server receives the file processing instruction sent by the terminal, and determines the target file information corresponding to the version information according to the version information carried in the file processing instruction as the target file information corresponding to the initial file information.

[0087] For example, referring to Table 1, when the "status" values ​​of files D(v1), D(v2), E(v1), E(v2), and E(v3) are all normal, the target files corresponding to the initial files are D(v2) and E(v3) files.

[0088] Step S104, updating the initial file list according to the target file information to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked.

[0089] The updated file list includes historical file information of updated files corresponding to the files to be checked.

[0090] The updated file is used to indicate a file corresponding to the file information obtained by updating the initial file list according to the target file information.

[0091] The historical file information refers to the file information corresponding to the updated file recorded in the integrity check list.

[0092] Exemplarily, the server updates the initial file list according to the target file information to obtain the historical file information of the updated file corresponding to the file to be checked; then, the server uses the file list composed of the historical file information as the updated file list.

[0093] For example, referring to Table 1, when the target file information corresponding to the initial file information is the information of the D(v2) and E(v3) files, the updated file list includes the following file information: A, B, C, D(v2), E(v3).

[0094] Step S105, determining the current file information corresponding to the updated file, and determining the abnormality check result corresponding to the updated file according to the difference between the historical file information and the current file information.

[0095] The current file information corresponding to the updated file is obtained by invoking an operating system API (Application Programming Interface).

[0096] The abnormality check result is used to indicate whether the updated file is an abnormal file.

[0097] Exemplarily, the server queries the current file information corresponding to the updated file by calling the operating system API; then, the server determines the abnormality check result corresponding to the updated file according to the difference between the historical file information and the current file information.

[0098] Step S106: Determine the integrity check result of the file to be checked according to the abnormality check result.

[0099] Among them, the integrity check result is used to indicate the situation of abnormal files in the files to be checked (the number of abnormal files, which is subdivided into the number of deleted files, the number of tampered files, the number of files with abnormal attributes, the number of files with abnormal sizes, the number of inaccessible files, and other information).

[0100] Exemplarily, based on the abnormality check results, the server determines the number of deleted files, the number of tampered files, the number of files with abnormal attributes, the number of files with abnormal sizes, the number of inaccessible files, and other information in the files to be checked, all of which are used as the integrity check results of the files to be checked.

[0101] In the above-mentioned file integrity check method, firstly, an integrity check list for the file to be checked is obtained, then an initial file list in the integrity check list is extracted, and the target file information corresponding to the initial file information is determined, then, according to the target file information, the initial file list is updated to obtain an updated file list, then, the current file information corresponding to the updated file is determined, and according to the difference between the historical file information and the current file information, the abnormal check result corresponding to the updated file is determined, and finally, according to the abnormal check result, the integrity check result of the file to be checked is determined. In this way, when performing an integrity check on a file, after obtaining the integrity check list for the file to be checked, the target file information corresponding to the initial file list in the integrity check list can be quickly determined, so that the initial file list can be quickly updated to obtain an updated file list, and then the abnormal check result corresponding to the updated file can be quickly determined from the updated file list, which is conducive to improving the efficiency of determining the integrity check result of the file to be checked, thereby improving the efficiency of the integrity check of the file; moreover, the whole process does not require manual intervention, avoiding the defect that it is easy to spend a lot of time to manually check and check the file, resulting in low efficiency of the integrity check of the file, and further improving the efficiency of the integrity check of the file.

[0102] In an exemplary embodiment, Figure 2 As shown, the above step S103, determining the target file information corresponding to the initial file information, specifically includes the following steps:

[0103] Step S201, obtaining type information of each initial file information.

[0104] Step S202: Filter out the initial file information whose type information meets the preset type information from each initial file information as candidate file information.

[0105] Step S203: determine the target file information corresponding to the candidate file information.

[0106] The type information includes static and dynamic.

[0107] Among them, the preset type information refers to dynamic.

[0108] The candidate file information refers to information of files whose type information is dynamic.

[0109] Exemplarily, the server obtains type information of each initial file information from the initial file list; then, the server filters out the initial file information whose type information meets the preset type information from each initial file information, and uses these initial file information as candidate file information; then, the server determines the target file information corresponding to the candidate file information.

[0110] For example, referring to Table 1, the initial file list is traversed to obtain a record, and the "type" field in the record is read; if the "type" is static, it means that the file corresponding to the current record has only one version, and it is directly confirmed whether the file is abnormal through steps S408 and S409. If the "type" is dynamic, it means that the file corresponding to the current record may have multiple versions, and the next step is performed.

[0111] In this embodiment, by obtaining the type information of each initial file information and screening out the initial file information that meets the preset type information as candidate file information, accurate classification and screening of files can be achieved, avoiding indiscriminate processing of all files, which is conducive to improving the targetedness of subsequent operations.

[0112] In an exemplary embodiment, the above step S203, determining the target file information corresponding to the candidate file information, specifically includes the following contents: determining the associated file information corresponding to the candidate file information, and obtaining the status information and version information corresponding to each associated file information; from each associated file information, filtering out the associated file information whose status information and version information both meet the preset conditions as the target file information.

[0113] The associated file information refers to the information of all new versions of files corresponding to the candidate file. As shown in Table 1, the associated file information refers to the information of files D(v1), D(v2), E(v1), E(v2), and E(v3).

[0114] The status information refers to the "status" value in the integrity check list.

[0115] The version information refers to the "version timestamp" value in the integrity check list.

[0116] The preset condition refers to the file whose "status" value is normal and whose "version timestamp" value is the latest. Referring to Table 1, when the "status" values ​​of files D(v1), D(v2), E(v1), E(v2), and E(v3) are all normal, the target file information corresponding to the initial file information is D(v2) and E(v3).

[0117] Exemplarily, the server determines all new versions of file information corresponding to the candidate file information as associated file information; then, the server obtains the status information and version information corresponding to each associated file information from the integrity check list; then, the server filters out the associated file information whose status information and version information meet preset conditions from each associated file information, and uses these associated file information as target file information.

[0118] In this embodiment, the status information and version information of the associated file information are obtained, and the target file information is obtained by screening based on preset conditions, so that the file information that meets the conditions can be accurately screened out, providing a data basis for subsequent integrity check processing.

[0119] In an exemplary embodiment, the historical file information includes the historical data volume, historical attributes and historical summary information corresponding to the updated file, and the current file information includes the current data volume, current attributes and current summary information corresponding to the updated file.

[0120] Then, the above step S105 determines the abnormality check result corresponding to the updated file based on the difference between the historical file information and the current file information, which specifically includes the following contents: when the historical data volume is inconsistent with the current data volume, and / or the historical attributes are inconsistent with the current attributes, and / or the historical summary information is inconsistent with the current summary information, it is determined that the updated file is an abnormal file; when the historical data volume is consistent with the current data volume, the historical attributes are consistent with the current attributes, and the historical summary information is consistent with the current summary information, it is determined that the updated file is a normal file.

[0121] The historical data volume refers to the "size" value corresponding to the updated file recorded in the integrity check list.

[0122] The historical attribute refers to the "attribute" value corresponding to the updated file recorded in the integrity check list.

[0123] The historical summary information refers to the “summary information” value corresponding to the updated file recorded in the integrity check list.

[0124] The current data volume refers to the "size" value corresponding to the updated file obtained by calling the operating system API.

[0125] The current attribute refers to the "attribute" value corresponding to the updated file obtained by calling the operating system API.

[0126] The current summary information refers to the "summary information" value corresponding to the updated file obtained by calling the operating system API.

[0127] Exemplarily, the server obtains the historical data volume, historical attributes and historical summary information of the updated file from the integrity check list, and queries the current data volume, current attributes and current summary information corresponding to the updated file by calling the operating system API; when the historical data volume is inconsistent with the current data volume, and / or the historical attributes are inconsistent with the current attributes, and / or the historical summary information is inconsistent with the current summary information, it is determined that the updated file is an abnormal file; when the historical data volume is consistent with the current data volume, the historical attributes are consistent with the current attributes, and the historical summary information is consistent with the current summary information, it is determined that the updated file is a normal file.

[0128] For example, the server calls the operating system API to query the file size, file owner and group, 9-segment read / write information (e.g. -rwxrwxr-x), and other extended information corresponding to the "file name" of record file A, and compares them with the "size" and "attributes" of record file A; if the file does not exist or the "size" and "attributes" are inconsistent, a record of file abnormality is appended (new "file name", "size", "attributes", "type", "summary information" and "status" is tampered or does not exist); otherwise, the SM3 (Secure Hash Algorithm 3) summary of the file corresponding to the "file name" of record file A is calculated and compared with the "summary information" of record A. If the comparison results are the same, the current round of comparison ends; if they are different, a record of file abnormality is appended.

[0129] In this embodiment, by performing a comparison check on the data volume, attributes and summary information of the file in multiple dimensions, the one-sidedness and inaccuracy caused by relying on only a single factor to determine whether the file is abnormal is avoided, which is conducive to improving the accuracy of file inspection.

[0130] In an exemplary embodiment, before extracting the initial file list in the integrity check list, the following contents are specifically included: performing summary signature processing on the integrity check list to obtain current summary information corresponding to the integrity check list; obtaining historical summary information corresponding to the integrity check list; and comparing the current summary information with the historical summary information.

[0131] Then, the above step S102, extracting the initial file list in the integrity check list, specifically includes the following contents: when the current summary information is consistent with the historical summary information, extracting the initial file list in the integrity check list.

[0132] The current summary information refers to the summary information obtained by performing a summary signature on the integrity check list.

[0133] The historical summary information refers to the summary information saved in the past.

[0134] Exemplarily, the server performs summary signature processing on the integrity check list to obtain summary information corresponding to the integrity check list as current summary information; then, the server obtains summary information of the integrity check list that was previously saved as historical summary information; then, the server compares the current summary information with the historical summary information to obtain a comparison result; when the comparison result indicates that the current summary information is consistent with the historical summary information, the server extracts an initial file list in the integrity check list.

[0135] In this embodiment, by performing summary signature processing on the integrity check list to obtain current summary information, and comparing it with historical summary information, the data integrity of the integrity check list can be quickly verified as a whole, thereby ensuring the accuracy of the data.

[0136] In an exemplary embodiment, the above step S101, obtaining an integrity check list for the file to be checked, specifically includes the following contents: obtaining the integrity check list to be processed and the key corresponding to the integrity check list to be processed; decrypting the integrity check list to be processed according to the key to obtain the integrity check list.

[0137] The key is the working key.

[0138] Exemplarily, the server obtains a list of integrity checks to be processed; then, the server obtains a working key corresponding to the list of integrity checks to be processed; then, the server decrypts the list of integrity checks to be processed according to the working key to obtain the list of integrity checks, such as Figure 3 shown.

[0139] In this embodiment, by obtaining the key corresponding to the integrity check list and using the key to perform decryption processing, the decrypted integrity check list can be obtained, which further enhances the security of the integrity check list in the entire processing process.

[0140] In an exemplary embodiment, Figure 4 As shown, another file integrity checking method is provided, which is described by taking the application of the method to a server as an example, and includes the following steps:

[0141] Step S401, obtaining a list of integrity checks to be processed and a key corresponding to the list of integrity checks to be processed.

[0142] Step S402: decrypt the integrity check list to be processed according to the key to obtain the integrity check list; the integrity check list includes historical file information of the file to be checked.

[0143] Step S403, perform summary signature processing on the integrity check list to obtain current summary information corresponding to the integrity check list; obtain historical summary information corresponding to the integrity check list; and compare the current summary information with the historical summary information.

[0144] Step S404: when the current summary information is consistent with the historical summary information, extract the initial file list in the integrity check list; the initial file list includes initial file information corresponding to the file to be checked.

[0145] Step S405, obtaining type information of each initial file information; and screening out the initial file information whose type information meets the preset type information from each initial file information as candidate file information.

[0146] Step S406, determining the associated file information corresponding to the candidate file information, and obtaining the status information and version information corresponding to each associated file information; from each associated file information, selecting the associated file information whose status information and version information both meet the preset conditions as the target file information.

[0147] Step S407, updating the initial file list according to the target file information to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked.

[0148] Step S408, determining the current file information corresponding to the updated file, and determining the abnormality check result corresponding to the updated file according to the difference between the historical file information and the current file information.

[0149] Step S409: Determine the integrity check result of the file to be checked according to the abnormality check result.

[0150] In the above-mentioned file integrity check method, when performing an integrity check on a file, after obtaining the integrity check list for the file to be checked, the target file information corresponding to the initial file list in the integrity check list can be quickly determined, so that the initial file list can be quickly updated to obtain an updated file list, and then the abnormal check result corresponding to the updated file can be quickly determined from the updated file list, which is conducive to improving the efficiency of determining the integrity check result of the file to be checked, thereby improving the efficiency of the file integrity check; moreover, the entire process does not require human intervention, avoiding the defect that manual verification and checking of files is easy to take a lot of time, resulting in low efficiency of file integrity checking, and further improving the efficiency of file integrity checking.

[0151] In an exemplary embodiment, in order to more clearly illustrate the file integrity check method provided by the embodiment of the present application, the file integrity check method is specifically described below with a specific embodiment. In one embodiment, the present application also provides a file integrity check method. When performing an integrity check on a file, first obtain an integrity check list for the file to be checked, then extract the initial file list in the integrity check list, and determine the target file information corresponding to the initial file information. Then, based on the target file information, update the initial file list to obtain an updated file list, then determine the current file information corresponding to the updated file, and based on the difference between the historical file information and the current file information, determine the abnormal check result corresponding to the updated file. Finally, based on the abnormal check result, determine the integrity check result of the file to be checked. Specifically include the following contents:

[0152] Step 1: Read the integrity check list into memory. If the read fails, call the interface to report the threat and then exit.

[0153] Step 2: Get the working key and decrypt the manifest.

[0154] Step 3: Sign the decrypted list with a digest and compare it with the digest information saved in the header. If they are different, call the interface to report the threat. Then exit.

[0155] Step 4: Traverse the list and build a list of files

[0156] Step 4.1: Starting from the first record in the list, access in ascending order according to ID (identity) until the end of the "initial version separator", read the fields "file name", "size", "attributes", "type", "summary information", and "status" to obtain the file list.

[0157] Step 4.2: Traverse the file list obtained in 4.1 and get a record

[0158] Step 4.2.1: Read the fields "File Name" and "Type" in the record; if "Type" is static, return to 4.2 to read the next record

[0159] Step 4.2.2: Based on the "File Name", start from the last record in the list and access in descending order according to the ID until the "Initial Version Separator". If the corresponding "File Name" is matched and the "Status" value is normal, update the "Size", "Attributes", "Type", and "Summary Information" of the current record to the file list.

[0160] Step 4.3: After step 4.2, the most recent normal file information is obtained. Traverse the file list and read the next record A.

[0161] Size, Properties, Summary Information of the

[0162] Step 4.3.1: Call the operating system API to query the file size, file owner and group, 9-segment read / write information (e.g. -rwxrwxr-x), and other extended information corresponding to the "file name" of record A, and compare them with the "size" and "attributes" of record A. If the file does not exist or the "size" and "attributes" are inconsistent, jump to 4.3.3.

[0163] Step 4.3.2: Calculate the SM3 summary of the file corresponding to the "file name" of record A, and compare it with the "summary information" of record A. If the comparison results are the same, end this round of comparison and return to step 4.3 to read the next record.

[0164] Step 4.3.3: Append a record (new file name, size, attributes, type, summary information, and status is tampered or does not exist) to the list. Call the interface to report the threat. Then return to 4.3 to read the next record.

[0165] Step 5: Summarize the integrity check results of step 4 and report audit information, including: the number of abnormal files found (broken down into the number of deleted files, the number of tampered files, the number of files with abnormal attributes, the number of files with abnormal sizes, the number of inaccessible files), and other information.

[0166] Overview, a polling mechanism is used to protect key files. Integrity verification process and report threat information.

[0167] In the above-mentioned embodiment, when performing an integrity check on a file, after obtaining the integrity check list for the file to be checked, the target file information corresponding to the initial file list in the integrity check list can be quickly determined, so that the initial file list can be quickly updated to obtain an updated file list, and then the abnormal check result corresponding to the updated file can be quickly determined from the updated file list, which is conducive to improving the efficiency of determining the integrity check result of the file to be checked, thereby improving the efficiency of the integrity check of the file; moreover, the entire process does not require manual intervention, avoiding the defect that manual verification and checking of the file is easy to consume a lot of time, resulting in low efficiency of the integrity check of the file, and further improving the efficiency of the integrity check of the file.

[0168] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0169] Based on the same inventive concept, the embodiment of the present application also provides a file integrity checking device for implementing the file integrity checking method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more file integrity checking device embodiments provided below can refer to the limitations of the file integrity checking method above, and will not be repeated here.

[0170] In an exemplary embodiment, Figure 5 As shown, a file integrity checking device is provided, comprising: a list acquisition module 501, a list extraction module 502, an information determination module 503, a list update module 504, an abnormality determination module 505 and a result determination module 506, wherein:

[0171] The list acquisition module 501 is used to acquire an integrity check list for the file to be checked; the integrity check list includes historical file information of the file to be checked.

[0172] The list extraction module 502 is used to extract the initial file list in the integrity check list; the initial file list includes initial file information corresponding to the file to be checked.

[0173] The file determination module 503 is used to determine the target file information corresponding to the initial file information.

[0174] The list updating module 504 is used to update the initial file list according to the target file information to obtain an updated file list; the updated file list includes the historical file information of the updated file corresponding to the file to be checked.

[0175] The abnormality determination module 505 is used to determine the current file information corresponding to the updated file, and determine the abnormality check result corresponding to the updated file according to the difference between the historical file information and the current file information.

[0176] The result determination module 506 is used to determine the integrity check result of the file to be checked according to the abnormality check result.

[0177] In an exemplary embodiment, the information determination module 503 is also used to obtain type information of each initial file information; filter out the initial file information whose type information meets the preset type information from each initial file information as candidate file information; and determine the target file information corresponding to the candidate file information.

[0178] In an exemplary embodiment, the information determination module 503 is also used to determine the associated file information corresponding to the candidate file information, and to obtain the status information and version information corresponding to each associated file information; from each associated file information, the associated file information whose status information and version information both meet the preset conditions is screened out as the target file information.

[0179] In an exemplary embodiment, the abnormality determination module 505 is also used to determine that the updated file is an abnormal file when the historical data volume is inconsistent with the current data volume, and / or the historical attributes are inconsistent with the current attributes, and / or the historical summary information is inconsistent with the current summary information; and to determine that the updated file is a normal file when the historical data volume is consistent with the current data volume, the historical attributes are consistent with the current attributes, and the historical summary information is consistent with the current summary information.

[0180] In an exemplary embodiment, the file integrity check device also includes a summary comparison module, which is used to perform summary signature processing on the integrity check list to obtain current summary information corresponding to the integrity check list; obtain historical summary information corresponding to the integrity check list; compare the current summary information with the historical summary information; the list extraction module 502 is also used to extract the initial file list in the integrity check list when the current summary information is consistent with the historical summary information.

[0181] In an exemplary embodiment, the list acquisition module 501 is further used to acquire the integrity check list to be processed and the key corresponding to the integrity check list to be processed; and decrypt the integrity check list to be processed according to the key to obtain the integrity check list.

[0182] Each module in the above-mentioned file integrity checking device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0183] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as an integrity check list. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a file integrity check method is implemented.

[0184] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0185] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0186] In an exemplary embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0187] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0188] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0189] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0190] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A file integrity checking method, characterized in that: The method comprises: Acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked; Extracting an initial file list from the integrity check list; the initial file list includes initial file information corresponding to the file to be checked; Determining target file information corresponding to the initial file information; According to the target file information, the initial file list is updated to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked; Determine current file information corresponding to the updated file, and determine an abnormality check result corresponding to the updated file based on a difference between the historical file information and the current file information; According to the abnormality check result, the integrity check result of the file to be checked is determined.

2. The method according to claim 1, characterized in that The determining of the target file information corresponding to the initial file information includes: Obtaining type information of each of the initial file information; Filtering out, from each of the initial file information, the initial file information whose type information meets the preset type information as candidate file information; Determine the target file information corresponding to the candidate file information.

3. The method according to claim 2, characterized in that The determining of the target file information corresponding to the candidate file information includes: Determine the associated file information corresponding to the candidate file information, and obtain the status information and version information corresponding to each of the associated file information; From each of the associated file information, the associated file information whose status information and version information both meet preset conditions is screened out as the target file information.

4. The method according to claim 1, characterized in that: The historical file information includes the historical data volume, historical attributes and historical summary information corresponding to the updated file, and the current file information includes the current data volume, current attributes and current summary information corresponding to the updated file; The determining, based on the difference between the historical file information and the current file information, an abnormality check result corresponding to the updated file includes: In the case where the historical data volume is inconsistent with the current data volume, and / or the historical attributes are inconsistent with the current attributes, and / or the historical summary information is inconsistent with the current summary information, determining that the updated file is an abnormal file; When the historical data volume is consistent with the current data volume, the historical attributes are consistent with the current attributes, and the historical summary information is consistent with the current summary information, it is determined that the updated file is a normal file.

5. The method according to claim 1, characterized in that Before extracting the initial file list in the integrity check list, the method further includes: Performing digest signature processing on the integrity check list to obtain current digest information corresponding to the integrity check list; Obtaining historical summary information corresponding to the integrity check list; comparing the current summary information with the historical summary information; The step of extracting the initial file list from the integrity check list comprises: When the current summary information is consistent with the historical summary information, an initial file list in the integrity check list is extracted.

6. The method according to any one of claims 1 to 5, characterized in that: The step of obtaining an integrity check list for the file to be checked includes: Obtaining a list of integrity checks to be processed and a key corresponding to the list of integrity checks to be processed; The to-be-processed integrity check list is decrypted according to the key to obtain the integrity check list.

7. A file integrity checking device, characterized in that: The device comprises: A list acquisition module, used to acquire an integrity check list for a file to be checked; the integrity check list includes historical file information of the file to be checked; A list extraction module, used to extract an initial file list in the integrity check list; the initial file list includes initial file information corresponding to the file to be checked; An information determination module, used to determine target file information corresponding to the initial file information; A list updating module, used to update the initial file list according to the target file information to obtain an updated file list; the updated file list includes historical file information of the updated file corresponding to the file to be checked; an abnormality determination module, used to determine the current file information corresponding to the updated file, and determine the abnormality inspection result corresponding to the updated file according to the difference between the historical file information and the current file information; The result determination module is used to determine the integrity check result of the file to be checked according to the abnormality check result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images