Method and system for desensitizing file data of operating system

Abstract

The invention relates to the technical field of operating systems, in particular to a method and a system for desensitizing file data of an operating system, which comprises the following steps of: in an operating system kernel, searching a kernel function table based on kprobe, replacing an openat system call function by registering an ftracefunction function, and executing a desensitization process on the file data of the operating system; constructing and storing an ftrace hook data structure containing a function name, a new function address, an original function address and ftrace operation information; the method has the beneficial effects that a file data desensitization security module is realized, file name capital writing, file data reverse-order writing and user keyword star number display are supported, a data desensitization function on an operating system level is realized, the security of the operating system is improved, and higher security capability is provided for applications such as cloud computing, big data and databases.

Description

Technical Field

[0001] The present invention relates to the technical field of operating systems, and particularly to a method and system for implementing data desensitization of operating system file data. Background Art

[0002] As a key element of the operating system, files carry data generated by various applications. Among these data, there is a lot of sensitive information of users, such as names, ID numbers, residential addresses, contact numbers, etc. Once these information are leaked, it will pose a serious threat to user privacy. When a user logs in to the operating system and accesses these files, without appropriate protection measures, almost all the contents of the files can be browsed without obstacles, which undoubtedly increases the risk of leakage of sensitive information.

[0003] In view of this security risk, the industry has taken certain preventive measures at the application level, such as desensitizing the read file data to ensure that sensitive details are not directly exposed during the display process. However, this protection mechanism is only limited to the application level, and the operating system itself does not have a built-in data desensitization function, and the risk of data leakage still exists. Summary of the Invention

[0004] The purpose of the present invention is to provide a method and system for implementing data desensitization of operating system file data to solve the problems raised in the above background art.

[0005] To achieve the above purpose, the present invention provides the following technical solution: A method for implementing data desensitization of operating system file data, including the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, and replace the openat system call function by registering the ftrace_function function, and construct and save the ftrace_hook data structure including function name, new function address, original function address, and ftrace operation information.

[0006] When it is detected that an open operation is performed on a specific file in a specified directory, intercept the openat system call, obtain the name of the opened file, convert the file name to uppercase, and then call the original openat system call to complete the file opening operation.

[0007] Preferably, it includes the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, replace the write system call function by registering the ftrace_function function, construct and save the ftrace_hook data structure containing the function name, new function address, original function address, and ftrace operation information; when it is detected that a write operation is performed on a specific file in a specified directory, intercept the write system call, obtain the data of the file to be written, reverse the data, and then call the original write system call to write the reversed data to the file.

[0008] Preferably, it includes the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, replace the read system call function by registering the ftrace_function function, construct and save the ftrace_hook data structure containing the function name, new function address, original function address, and ftrace operation information; when it is detected that a read operation is performed on a specific file in a specified directory, intercept the read system call, obtain the content of the file read, and perform a flip display process on the content; identify the process that calls the read operation, and if the calling process is not a specific process, perform an asterisk hiding display process on specific keywords in the file content. After the process is completed, call the original read system call to return the processed file content.

[0009] Preferably, the step of obtaining the name of the opened file and converting it to uppercase is specifically as follows: Register a new openat system call function. In the implementation of the new function, obtain the name of the opened file from the system call parameters; use a string conversion function to convert the obtained file name to uppercase; replace the original file name with the converted uppercase file name, and then call the original openat system call to complete the file opening operation.

[0010] Preferably, the step of performing an asterisk hiding display process on specific keywords in the file content is specifically as follows: In the implementation of the new read system call function, perform a flip display process on the content of the file read; use a string search function to search for specific keywords in the file content; when a specific keyword is found, perform an asterisk hiding display process on the keyword according to a preset rule. After the process is completed, continue to search for and process subsequent keywords until the file content is processed.

[0011] A system for implementing a method of desensitizing operating system file data includes a file data desensitization security module. The file data desensitization security module is a data desensitization security kernel module for operating specific files in a specified directory. It intercepts the corresponding openat system call, file read system call read, and file write system call write through the hook mechanism to implement the file data desensitization function. When installed, this security module searches the kernel function table based on kprobe, replaces the new openat, read, and write system call functions by registering the ftrace_function function, and restores the original implementation logic when uninstalled. Among them, the ftrace_hook data structure is constructed to record the function name, new function address, original function address, and ftrace operation information.

[0012] Preferably, the file data desensitization security module has the function of converting file names to uppercase. The specific implementation method is as follows: register a new openat system call function hook_openat. In the hook_openat function, obtain the name of the opened file, convert the file name to uppercase through the string_upper function, replace the original file name with the fully uppercase file name after conversion, and then call the original openat system call to complete the file opening operation.

[0013] Preferably, the file data desensitization security module has the function of writing file data in reverse order. The specific implementation method is as follows: register a new write system call function hook_write. In the hook_write function, obtain the data to be written to the file, perform a reverse transformation on this data. For example, transform "testuser1123" to "3211resutset", then write the transformed data to the file, and finally call the original file writing function to complete the writing operation.

[0014] Preferably, the file data desensitization security module has the function of displaying user keywords with asterisks. The specific implementation method is as follows: register a new read system call function hook_read. After calling the original file reading function to read the file content in the hook_read function, display the read content in reverse and support displaying keywords with asterisks. For example, transform "3211resutset" to "testuser1123", and transform "testuser1123" to "t*****3"; at the same time, identify the calling process. If it is the md5sum program, the above transformation is not performed.

[0015] Preferably, the ftrace_hook data structure is defined to include the function name, the new function address, the original function address, the corresponding address of the existing function, and the ftrace operation information. The acquisition of the original function address is implemented through the fh_resolve_hook_address function. In this function, kprobe is registered, and the address of the specified function is obtained by using kallsyms_lookup_name and the original function address is stored.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0017] The method and system for realizing data desensitization of operating system file data proposed by the present invention implement a file data desensitization security module, support capitalization of file names, support reverse writing of file data, support asterisk display of user keywords, realize the function of data desensitization at the operating system level, improve the security of the operating system, and provide higher security capabilities for applications such as cloud computing, big data, and databases. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of the method of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] In order to clearly and completely describe the objectives, technical solutions of the present invention, and make the advantages clearer, the following further details the embodiments of the present invention with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are some embodiments of the present invention, rather than all embodiments, and are only used to explain the embodiments of the present invention, not to limit the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

[0020] Embodiment 1, the present invention provides a technical solution: a method for realizing data desensitization of operating system file data. Through this method, a file data desensitization security module is realized, which supports capitalization of file names, reverse writing of file data, and asterisk display of user keywords.

[0021] The specific function diagram is as follows:

[0022] 1. File data desensitization security module

[0023] Implement a data desensitization security kernel module for operating on specific files in a specified directory, use the hook mechanism to intercept the corresponding openat system call, file read system call read, and file write system call write, and support functions such as capitalization of file names, reverse writing of file data, and asterisk display of user keywords.

[0024] When the file data desensitization security module is installed, the kernel function table is searched based on kprobe, and the original implementation logic is restored when the security module is uninstalled by registering the ftrace_function function to replace the three system call functions of openat, read, and write with new ones.

[0025] Construct the ftrace_hook data structure to record information such as function name, new function address, original function address, and ftrace operation. The sample code is as follows:

[0026]

[0027]

[0028] 2. File name in uppercase

[0029] Register the new openat system call function hook_openat, obtain the name of the opened file, and convert the file name to uppercase through the string_upper function.

[0030] Code sample:

[0031]

[0032] 3. Reverse writing of file data

[0033] Register the new write system call function hook_write to reverse the data written to the file. For example, "testuser1123" is transformed into "3211resutset", and the transformed data is written to the file.

[0034] Code sample:

[0035]

[0036]

[0037] 4. Asterisk display of user keywords

[0038] Register the new read system call function hook_read to display the read content in reverse and support asterisk display of keywords. For example, "3211resutset" is transformed into "testuser1123", and "testuser1123" is transformed into "t*****3"; identify the calling process, and if it is md5sum, the above transformation is not performed.

[0039] Code sample:

[0040]

[0041]

[0042]

[0043] Example 2. Based on Example 1, a system for implementing the method for desensitizing operating system file data according to claim 5 is proposed, including a file data desensitization security module. The file data desensitization security module is a data desensitization security kernel module for specific files in the specified directory of the operation. It intercepts the corresponding openat system call, file read system call read, and file write write system call through the hook mechanism to implement the file data desensitization function. When installed, the security module searches the kernel function table based on kprobe, replaces the new openat, read, and write system call functions by registering the ftrace_function function, and restores the original implementation logic when uninstalled. Among them, the ftrace_hook data structure is constructed to record the function name, new function address, original function address, and ftrace operation information.

[0044] The file data desensitization security module has the function of capitalizing file names. The specific implementation method is as follows: register a new openat system call function hook_openat. In the hook_openat function, obtain the name of the opened file, convert the file name to uppercase through the string_upper function, replace the original file name with the fully capitalized file name after conversion, and then call the original openat system call to complete the file opening operation.

[0045] The file data desensitization security module has the function of writing file data in reverse order. The specific implementation method is as follows: register a new write system call function hook_write. In the hook_write function, obtain the data to be written to the file, perform a reverse transformation on the data. For example, transform "testuser1123" into "3211resutset", and then write the transformed data to the file. Finally, call the original file writing function to complete the writing operation.

[0046] The file data desensitization security module has the function of displaying user keywords with asterisks. The specific implementation method is as follows: register a new read system call function hook_read. After calling the original file reading function to read the file content in the hook_read function, display the read content in reverse and support displaying keywords with asterisks. For example, transform "3211resutset" into "testuser1123", and transform "testuser1123" into "t*****3"; at the same time, identify the calling process. If it is the md5sum program, the above transformation is not performed.

[0047] The ftrace_hook data structure is defined to include the function name, the address of the new function, the address of the original function, the corresponding address of the existing function, and the ftrace operation information. The acquisition of the original function address is implemented through the fh_resolve_hook_address function. In this function, a kprobe is registered, and the address of the specified function is obtained by using kallsyms_lookup_name and the original function address is stored.

[0048] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing data desensitization of operating system file data, characterized in that: It includes the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, replace the openat system call function by registering the ftrace_function function, and construct and save the ftrace_hook data structure containing the function name, new function address, original function address, and ftrace operation information; When it is detected that an open operation is performed on a specific file in a specified directory, intercept the openat system call, obtain the name of the opened file, convert the file name to uppercase, and then call the original openat system call to complete the file opening operation.

2. The method for implementing data desensitization of operating system files according to claim 1, wherein: It includes the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, replace the write system call function by registering the ftrace_function function, and construct and save the ftrace_hook data structure containing the function name, new function address, original function address, and ftrace operation information; when it is detected that a write operation is performed on a specific file in a specified directory, intercept the write system call, obtain the data to be written to the file, reverse the data, and then call the original write system call to write the reversed data to the file.

3. The method for implementing data desensitization of operating system files according to claim 2, wherein: It includes the following steps: In the operating system kernel, based on kprobe, search for the kernel function table, replace the read system call function by registering the ftrace_function function, and construct and save the ftrace_hook data structure containing the function name, new function address, original function address, and ftrace operation information; when it is detected that a read operation is performed on a specific file in a specified directory, intercept the read system call, obtain the content of the read file, and perform a flip display process on the content; Identify the process that calls the read operation. If the calling process is not a specific process, perform an asterisk hiding display process on specific keywords in the file content. After the processing is completed, call the original read system call to return the processed file content.

4. The method for implementing data desensitization of operating system files according to claim 3, wherein: The steps to obtain the name of the opened file and convert it to uppercase are specifically as follows: register a new openat system call function. In the implementation of the new function, obtain the name of the opened file from the system call parameters; use a string conversion function to convert the obtained file name to uppercase; replace the original file name with the converted uppercase file name, and then call the original openat system call to complete the file opening operation.

5. A method for implementing data desensitization of operating system files according to claim 4, characterized in that: The steps to perform an asterisk hiding display process on specific keywords in the file content are specifically as follows: in the implementation of the new read system call function, perform a flip display process on the content of the read file; use a string search function to search for specific keywords in the file content; when a specific keyword is found, perform an asterisk hiding display process on the keyword according to the preset rules, and continue to search and process subsequent keywords after the processing is completed until the file content processing is completed.

6. A system for implementing the method for desensitizing operating system file data according to claim 5, characterized in that: It includes a file data desensitization security module. The file data desensitization security module is a data desensitization security kernel module for operating specific files in a specified directory. It intercepts the corresponding openat system call, file read system call read, and file write system call write through the hook mechanism to implement the file data desensitization function. When installed, this security module searches the kernel function table based on kprobe, replaces the new openat, read, and write system call functions by registering the ftrace_function function, and restores the original implementation logic when uninstalled. Among them, a ftrace_hook data structure is constructed to record the function name, new function address, original function address, and ftrace operation information.

7. A system according to claim 6, characterized in that: The file data desensitization security module has the function of converting file names to uppercase. The specific implementation method is as follows: register a new openat system call function hook_openat. In the hook_openat function, obtain the name of the opened file, convert the file name to uppercase through the string_upper function, replace the original file name with the fully uppercase file name after conversion, and then call the original openat system call to complete the file opening operation.

8. A system according to claim 6, characterized in that: The file data desensitization security module has the function of writing file data in reverse order. The specific implementation method is as follows: register a new write system call function hook_write. In the hook_write function, obtain the data to be written to the file, perform a reverse transformation on this data. For example, transform "testuser1123” to "3211resutset”, and then write the transformed data to the file. Finally, call the original file writing function to complete the writing operation.

9. A system according to claim 6, characterized in that: The file data desensitization security module has the function of displaying user keywords with asterisks. The specific implementation method is as follows: register a new read system call function hook_read. After calling the original file reading function to read the file content in the hook_read function, display the read content in reverse and support the display of keywords with asterisks. For example, transform "3211resutset” to "testuser1123” and transform "testuser1123” to "t*****3”; at the same time, identify the calling process. If it is the md5sum program, the above transformation will not be performed.

10. A system according to claim 6, wherein: The ftrace_hook data structure is defined to include the function name, new function address, original function address, corresponding address of the existing function, and ftrace operation information. The acquisition of the original function address is implemented through the fh_resolve_hook_address function. In this function, kprobe is registered, and the address of the specified function is obtained using kallsyms_lookup_name and the original function address is stored.

Images