A method, apparatus, device, medium, and product for file security level checking based on Windows operating system API hooking.

Abstract

This application discloses a file security level checking method, apparatus, device, medium, and product based on Windows operating system API hooking, relating to the field of computer software applications. The method includes registering a callback function using a driver module; when the Windows operating system creates a process, the callback function sends the created process ID to a user-mode service module and receives a service completion message from the service module; within the service module, based on a DLL injection mechanism, the DLL injection program of the API hooking module is injected into the memory space of the created process; after the DLL injection program is injected, the API hooking module modifies the entry address of the target process's API and points this entry address to a custom hook function; the target process is the created process; when an application opens a file corresponding to the target process, the security level judgment logic of the hook function is called to determine whether the user's security level allows opening the file corresponding to the target process. This application avoids the problem of high-security file leakage.

Description

Technical Field

[0001] This application relates to the field of computer software applications, and in particular to document security and confidentiality and document classification checks. Background Technology

[0002] In many countries and regions, governments and industry organizations have clear legal and regulatory requirements for the protection of sensitive information. Assigning security classifications is an important means of meeting these compliance requirements. In certain industries (such as finance, healthcare, and defense), industry standards and best practices require the classification and protection of sensitive information.

[0003] Classification settings ensure that only personnel with the appropriate classification level can access files of a specific classification level. Lower-class users cannot read or modify higher-class files, thus preventing unauthorized access to sensitive information. Classification settings limit the scope of information dissemination, ensuring that sensitive information is shared only within necessary limits and reducing the risk of information leakage. In cross-departmental collaboration, classification settings ensure that only personnel with the appropriate classification level can access and process files of a specific classification level, thereby guaranteeing information security and integrity.

[0004] By establishing security classifications, employees and relevant personnel can enhance their security awareness, understanding the importance and protection requirements of documents at different classification levels. This serves as part of security training and guidance, helping employees correctly understand and implement information protection measures.

[0005] In summary, assigning classification levels to documents is a crucial means of ensuring information security, compliance, and risk management within a secure and confidential system. Classification effectively controls access to and dissemination of information, preventing unauthorized access and data breaches, while simultaneously meeting legal, regulatory, and industry standards. Furthermore, classification helps improve work efficiency and employee security awareness, ensuring that information is appropriately protected throughout its entire lifecycle.

[0006] Currently, most software on the market implements file security level checks at the level of its own developed functions. For example, when downloading a file, the system checks whether the user's security level is higher than that of the file being downloaded before downloading; similarly, viewing file content also checks whether the user's security level is higher than that of the downloaded file. This security level check ensures file security at the code level.

[0007] However, software is not an isolated system; files or data often flow from one software system to another. For example, a self-developed software X has a security classification mechanism. User A uses software X to create a file named a.txt, sets its security classification to confidential, and saves the association between the security classification and the file. When user B opens the a.txt file using software X, software X checks whether user B's security classification is higher than that of a.txt. Since X is self-developed software, this checking logic is written in X's code. If user B does not use software X to open the a.txt file, but instead uses Windows Notepad, which lacks a security classification check mechanism, the file will be compromised.

[0008] In summary, when an operator launches an application and opens a classified file, if the application is third-party commercial software that did not consider file security levels during development, it will not perform security level checks when opening the file, resulting in the leakage of high-security file content to low-security users. Summary of the Invention

[0009] The purpose of this application is to provide a method, apparatus, device, medium, and product for checking file security levels based on Windows operating system API hooks, in order to solve the problem that when third-party commercial software opens classified files, the contents of high-security files are leaked to low-security users.

[0010] To achieve the above objectives, this application provides the following solution:

[0011] Firstly, this application provides a file security level check method based on Windows operating system API hooking, including:

[0012] A callback function is registered using the driver module. When the Windows operating system creates a process, the created process ID is sent to the user-mode service module within the callback function, and the service completion message is received from the service module. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system.

[0013] Within the service module, based on the DLL injection mechanism, the DLL injection program of the API HOOK module is injected into the memory space of the created process;

[0014] After the DLL injection program is injected, the API HOOK module is used to modify the entry address of the target process's API and point that entry address to a custom hook function; the target process is the process that was created.

[0015] When the application opens the file corresponding to the target process, the security level judgment logic of the hook function is called to determine whether the user's security level is sufficient to open the file corresponding to the target process.

[0016] Secondly, this application provides a file security level checking device based on Windows operating system API hooking, comprising:

[0017] Driver module, service module, and API hook module;

[0018] The driver module is used to register callback functions. When the Windows operating system creates a process, the callback function sends the created process ID to the user-mode service module and receives the service completion message from the service module. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system.

[0019] The service module is used to inject the DLL injection program of the API HOOK module into the memory space of the created process based on the DLL injection mechanism, and when the application opens the file corresponding to the target process, call the security level judgment logic of the hook function to determine whether the user's security level is sufficient to open the file corresponding to the target process.

[0020] The API HOOK module is used to modify the entry address of the target process's API after the DLL injection program injects, and to point the entry address to a custom hook function; the target process is the process created.

[0021] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the file security level checking method based on Windows operating system API HOOK as described above.

[0022] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the file security level checking method based on Windows operating system API HOOK as described above.

[0023] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the file security level checking method based on the Windows operating system API HOOK described above.

[0024] According to the specific embodiments provided in this application, the following technical effects are disclosed:

[0025] This application hooks the Windows operating system's file operation application programming interface (API) and the target process of the driver injection DLL injection program, enabling any process launched by the Windows operating system to perform security level checks when reading and writing files. The entire mechanism runs at the Windows operating system level, and the application is unaware of it. Because it hooks the underlying API of the Windows operating system, it is independent of the file opening method. Even when using third-party commercial software, security level checks are required when opening files, thus avoiding the problem of high-security file leakage.

[0026] Furthermore, this application can apply a single hook to all applications and programs, with simple logic and wide-ranging and rapid effects; this application does not require monitoring file read and write events of the entire file system, but only needs to hook system APIs, resulting in low system resource overhead; the core code of this application runs in user mode of the Windows operating system, thus having minimal impact on the operating system. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 A flowchart illustrating a file security level check method based on Windows operating system API hooking, provided in an embodiment of this application;

[0029] Figure 2 This is a schematic diagram of a DLL injection mechanism provided in an embodiment of this application;

[0030] Figure 3 This is a schematic diagram illustrating the basic principle of API HOOK provided in an embodiment of this application;

[0031] Figure 4 This is a flowchart of an API hook provided in an embodiment of this application;

[0032] Figure 5 This is a schematic diagram illustrating the relationship between user mode and kernel mode provided in an embodiment of this application;

[0033] Figure 6 This is a diagram illustrating the information interaction between various modules within a file security level checking device based on Windows operating system API hooks, as provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0035] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0036] This application provides a file security level check method based on Windows operating system API hooking. This method is executed by a computer device, specifically a terminal or server, or both. In this application embodiment, for example... Figure 1 As shown, the method includes the following steps.

[0037] S1: The driver module registers a callback function. When the Windows operating system creates a process, the callback function sends the created process ID to the user-mode service module and receives the service completion message from the service module. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system.

[0038] S2: Within the service module, based on the DLL injection mechanism, the DLL injection program of the API HOOK module is injected into the memory space of the created process.

[0039] S3: After the DLL injection program is injected, the API HOOK module is used to modify the entry address of the target process's API and point the entry address to the custom hook function; the target process is the process created.

[0040] S4: When the application opens the file corresponding to the target process, the security level judgment logic of the hook function is called to determine whether the user's security level is sufficient to open the file corresponding to the target process.

[0041] In an exemplary embodiment, S1 can be replaced by the following steps.

[0042] S11: Within the driver module, a custom callback function is registered via PsSetCreateProcessNotifyRoutineEx to listen for the CreateProcessAPI call from the Windows operating system;

[0043] S12: When the Windows operating system creates a process, the callback function is triggered. Within the callback function, the created process ID is sent to the user-mode service module. At the same time, the created process is suspended until the callback function receives the service completion message from the service module, at which point the process state is restored and the process continues to run.

[0044] In practical applications, the Windows operating system kernel provides a series of event notification and callback mechanisms. The callback mechanism provides drivers with a general method to send and receive certain types of notifications. These notifications can be generated when the state of a system component changes, or when a developer-defined condition is met.

[0045] `PsSetCreateProcessNotifyRoutineEx` is an API in the Windows kernel used to register or remove a callback function to receive notifications when a process is created or destroyed in the kernel. The function's parameter, `NotifyRoutine`, contains a pointer to the callback function, which the kernel calls when a process is created or destroyed.

[0046] The operating mechanism of this driver module is as follows:

[0047] Step 1: This driver module runs in the kernel layer of the Windows operating system. It registers a custom callback function through PsSetCreateProcessNotifyRoutineEx to listen for the system's CreateProcessAPI calls.

[0048] Step 2: When the Windows operating system creates a process, the callback function registered in Step 1 is triggered. In the callback function, the created process ID is sent to the user-mode service module. The created process is the task that the user directly opens in the Windows operating system, such as opening a Word document.

[0049] At this point, the created process is in an early initialization state, suspended by the operating system. Only a portion of the process resources have been initialized, and user-space code has not yet begun execution; it is waiting for the callback function to return. Here, user space refers to the independent memory region allocated by the operating system for each process, used to store the process's code, data, stack, and other information. In this application, this information refers to the code and data of the created process.

[0050] Step 3: The callback function receives the service completion message from the service module and then exits. The Windows operating system restores the state of the newly created process, and the process continues to run.

[0051] In an exemplary embodiment, before S2, the method further includes: starting the DLL injection program as a Windows service with the identity of a system administrator; the DLL injection program has the highest privileges.

[0052] In one exemplary embodiment, S2 is followed by:

[0053] A remote thread is created in the target process, and the target process calls LoadLibrary to trigger the dllmain function of the dll injection program.

[0054] The target process API is hooked based on the dllmain function.

[0055] Once the hook is complete, a service completion message is sent to the driver module; the service completion message indicates whether the hook was successful or failed.

[0056] In practical applications, in step 2 of the driver module, after the service module receives the created process ID sent by the driver module, it injects the API-hooked DLL program into the newly created process based on the DLL injection runtime mechanism.

[0057] Since DLL injection needs to be performed on all processes, the injected DLL program must have high privileges. Therefore, the injection program is made into a Windows service and started as a system administrator.

[0058] In the Windows operating system, each running process lives in its own program space (protected mode). Theoretically, each process running on the operating system is independent of the others; that is, each process has its own independent address space. For example, if process B modifies data at address 0x4000000, the data at address 0x4000000 in process C will not change as a result of B's ​​modification. Furthermore, process C may not own the memory at address 0x4000000; that is, the operating system may not have mapped this memory for process C.

[0059] Because processes have independent address spaces (protected mode), it is difficult to write applications that can control other processes.

[0060] In this application, DLL injection refers to forcibly loading a.dll provided by program B into program A, and executing the code within a.dll provided by program B, such as... Figure 2 As shown. Note that a.dll provided by program B would not originally be actively loaded by program A. However, when program B uses some means to make program A "load" a.dll, program A will execute the code in a.dll. At this time, a.dll enters the address space of program A. Since the program logic of the a.dll module is designed by the developer of program B, the developer of program B can modify the behavior of program A.

[0061] In this application, DLL injection is performed on the target process launched in the Windows operating system within the service.

[0062] The DLL injection mechanism of this service module is as follows:

[0063] Step 1: The service module allocates a memory space in the target process and writes the path of the injected DLL into the memory space.

[0064] Step 2: Create a remote thread in the target process, which is the execution unit within the process, and have the target process call LoadLibrary with the memory space requested in Step 1 as the parameter.

[0065] Step 3: LoadLibrary triggers the dllmain function in the dll program, in which the Windows operating system API is hooked.

[0066] Step 4: The service module sends a service completion message to the driver module. The driver callback function exits, and the process resumes execution. In this application, the service module and the driver module can agree on a data type for this service completion message, such as sending the number 0 to indicate success, the number 1 to indicate injection failure, and the number 2 to indicate hooking failure, etc.

[0067] This technique has many advantages. First, it obtains the address space before the application begins execution. Second, since the application is not a debugger, both the application and the injected DLL are very easy to debug and relatively difficult to detect.

[0068] In one exemplary embodiment, S4 can be replaced by the following steps.

[0069] S41: When the application opens the file corresponding to the target process, intercept the NTCreateFileAPI of the Windows operating system, call the security level judgment logic of the hook function, and determine the user security level and the file security level;

[0070] S42: Determine whether the user's security level is sufficient to open the file corresponding to the target process based on the user's security level and the file's security level.

[0071] In an exemplary embodiment, S42 can be replaced by the following steps.

[0072] S411: Determine whether the file security level is lower than the user security level. If yes, execute S412; otherwise, execute S413.

[0073] S412: Call the NTCreateFileAPI to open the file corresponding to the target process.

[0074] S413: Returns an error directly.

[0075] In practical applications, Windows API Hook is a technique used to intercept and modify application calls to Windows APIs. Through API Hook, developers can insert custom code before and after API calls to achieve various functionalities such as debugging, monitoring, security protection, and performance analysis.

[0076] The basic principle of API hooking is to modify the entry address of the target API so that it points to a custom hook function, such as... Figure 3 As shown.

[0077] The API HOOK module is the core module of this application. By hooking the file operation API of the Windows operating system, it intercepts the NTCreateFile API of the Windows operating system when the application opens a file and calls the security level judgment logic.

[0078] like Figure 4 As shown, the mechanism of this API HOOK module, that is, the specific process of step 3 in the service module, is as follows: Step 1: When the application calls NTCreateFileAPI, it will actually call our hook function.

[0079] Step 2: In the hook function, retrieve the security level of the file to be opened from the database or other system.

[0080] Step 3: Retrieve the user's security level from the database or other systems in the hook function.

[0081] Step 4: If the file's security level is lower than the user's security level, the system's native NTCreateFile API will be called, and the application will open the file normally. Otherwise, an error will be returned directly.

[0082] Based on the same inventive concept, this application also provides a file security level checking device based on Windows operating system API HOOK for implementing the file security level checking method based on Windows operating system API HOOK described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the file security level checking device based on Windows operating system API HOOK provided below can be found in the limitations of the file security level checking method based on Windows operating system API HOOK described above, and will not be repeated here.

[0083] In one exemplary embodiment, such as Figures 5-6 As shown, this application provides a file security level checking device based on Windows operating system API HOOK, including: a driver module, a service module, and an API HOOK module.

[0084] The driver module is used to register callback functions. When the Windows operating system creates a process, the callback function sends the created process ID to the user-mode service module and receives the service completion message from the service module. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system.

[0085] The service module is used to inject the DLL injection program of the API HOOK module into the memory space of the created process based on the DLL injection mechanism, and when the application opens the file corresponding to the target process, call the security level judgment logic of the hook function to determine whether the user's security level is sufficient to open the file corresponding to the target process.

[0086] The API HOOK module is used to modify the entry address of the target process's API after the DLL injection program injects, and to point the entry address to a custom hook function; the target process is the process created.

[0087] In an exemplary embodiment, a computer device is provided, which may be a server or a terminal. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores file security level checking data based on operating system API hooks. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a file security level checking method based on Windows operating system API hooks.

[0088] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0089] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the methods described above.

[0090] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the methods described above.

[0091] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0092] In this application, all actions to acquire signals, information, or data are carried out in compliance with the relevant data protection laws and policies of the country where the location is situated, and with the authorization granted by the owner of the relevant device.

[0093] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0094] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for checking file security levels based on Windows operating system API hooking, characterized in that, The file security level check method based on Windows operating system API hook includes: By registering a callback function using the driver module, when the Windows operating system creates a process, the callback function sends the created process ID to the user-mode service module and receives the service completion message from the service module. Specifically, this includes: Within the driver module, a custom callback function is registered via PsSetCreateProcessNotifyRoutineEx to listen for Windows operating system's CreateProcess API calls; When the Windows operating system creates a process, the callback function is triggered. Within the callback function, the created process ID is sent to the user-mode service module. Simultaneously, the created process is suspended until the callback function receives a service completion message from the service module, at which point the process state is restored and the process continues to run. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system. Within the service module, based on the DLL injection mechanism, the DLL injection program of the API HOOK module is injected into the memory space of the created process; After the DLL injection program is injected, the API HOOK module is used to modify the entry address of the target process's API and point that entry address to a custom hook function; the target process is the process that was created. A remote thread is created in the target process, and the target process calls LoadLibrary to trigger the dllmain function of the dll injection program; the API of the target process is hooked based on the dllmain function; when the hooking is completed, a service completion message is sent to the driver module; the service completion message indicates whether the hooking was successful or failed. When the application opens the file corresponding to the target process, the security level judgment logic of the hook function is called to determine whether the user's security level allows them to open the file corresponding to the target process. Specifically, this includes: When the application opens the file corresponding to the target process, the Windows operating system's NTCreateFile API is intercepted, and the security level judgment logic of the hook function is called to determine the user's security level and the file's security level. Based on the user security level and the file security level, determine whether the user security level is sufficient to open the file corresponding to the target process.

2. The file security level checking method based on Windows operating system API HOOK according to claim 1, characterized in that, Within the service module, based on the DLL injection mechanism, the DLL injection program of the API HOOK module is injected into the memory space of the created process. Prior to this, the following steps are also included: The DLL injection program is run as a Windows service and started with the system administrator privileges; the DLL injection program has the highest level of privileges.

3. The file security level checking method based on Windows operating system API HOOK according to claim 1, characterized in that, Determining whether a user's security level is sufficient to open the file corresponding to the target process based on the user's security level and the file's security level specifically includes: Determine whether the file's security level is lower than the user's security level; If so, call the NTCreateFile API to open the file corresponding to the target process; If not, return an error directly.

4. A file security level checking device based on Windows operating system API hooking, characterized in that, The file security level checking device based on Windows operating system API HOOK performs the file security level checking method based on Windows operating system API HOOK as described in any one of claims 1-3. The file security level checking device based on Windows operating system API HOOK includes: a driver module, a service module, and an API HOOK module. The driver module is used to register callback functions. When the Windows operating system creates a process, the callback function sends the created process ID to the user-mode service module and receives the service completion message from the service module. The driver module runs in the kernel layer of the Windows operating system. The created process is a task that the user directly opens in the Windows operating system. The service module is used to inject the DLL injection program of the API HOOK module into the memory space of the created process based on the DLL injection mechanism, and to call the security level judgment logic of the hook function when the application opens the file corresponding to the target process to determine whether the user's security level is sufficient to open the file corresponding to the target process. The API HOOK module is used to modify the entry address of the target process's API after the DLL injection program injects, and to point the entry address to a custom hook function; the target process is the process created.

5. A computer device, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the file security level checking method based on Windows operating system API HOOK as described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the file security level checking method based on Windows operating system API hook as described in any one of claims 1-3.

7. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the file security level checking method based on Windows operating system API hook as described in any one of claims 1-3.

Images