Abnormal recovery method, security protection system, electronic equipment and storage medium

Abstract

The invention provides an exception recovery method, a security protection system, electronic equipment and a storage medium, and relates to the technical field of computers. The exception recovery method is applied to an exception recovery module in the security protection system, the security protection system further comprises a security service process and at least one product process, and the method comprises the following steps: monitoring whether the security service process disappears or not; when it is monitored that the security service process disappears, the security service process is restarted; and under the condition that the security service process is successfully restarted, sending notification information representing that the security service process is successfully restarted to each product process, so that each product process rescheduling the security capability in the security service process based on the notification information. According to the scheme, the product process does not need to wait for the next polling cycle, the security capability can be rescheduled, and compared with the prior art, the probability that a neutral period of one polling cycle occurs in security protection is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to an exception recovery method, a security protection system, an electronic device and a storage medium. BACKGROUND

[0002] The existing security capabilities such as protection engine and basic driver are usually executed in a security service process (hereinafter referred to as security service process), and the product process (i.e. the process requiring security service of the security service process) schedules the security capabilities in the security service process through IPC (process communication).

[0003] At present, the product process periodically polls whether the security service process is restarted, and cannot realize real-time sensing of whether the security service process is successfully restarted. Further, the security capabilities of the security service process cannot be rescheduled in time, causing an interval of at most one polling cycle in security protection. SUMMARY

[0004] The present application provides an exception recovery method, a security protection system, an electronic device and a storage medium to solve the problem that all product processes cannot reschedule the security capabilities of the security service process in time, causing an interval of at most one polling cycle in security protection in the prior art.

[0005] In a first aspect, the present application provides an exception recovery method applied to an exception recovery module in a security protection system, the security protection system further comprising a security service process and at least one product process, and the method comprises: monitoring whether the security service process disappears; in the case that the security service process is monitored to disappear, restarting the security service process; in the case that the security service process is successfully restarted, sending notification information representing that the security service process is successfully restarted to each product process, so that each product process reschedules the security capabilities in the security service process based on the notification information.

[0006] In the present application, the exception recovery module will restart the security service process in the case that the security service process disappears. And, the exception recovery module will send notification information representing that the security service process is successfully restarted to each product process after the security service process is restarted, so that each product process can reschedule the security capabilities in the security service process based on the notification information. Therefore, the product process can also reschedule the security capabilities without waiting for the next polling cycle, and the probability of an interval of at most one polling cycle in security protection is reduced compared with the prior art.

[0007] With the technical solution provided in the first aspect above, in some possible implementation manners, when restarting the security service process, the method further comprises: transmitting a specified parameter to the security service process; so that the security service process sends target information representing successful restart in response to the specified parameter in the case of successful restart; and determining that the security service process is successfully restarted in the case of detecting that the security service process sends the target information.

[0008] In the embodiments of the present application, the specified parameter is transmitted to the security service process, so that the security service process can determine that the target information needs to be sent based on the specified parameter, and then the abnormal recovery module can determine that the security service process has been successfully restarted according to the target information. In this way, the abnormal recovery module can accurately determine whether the security service process is successfully restarted, and the accuracy of the present solution is improved.

[0009] With the technical solution provided in the first aspect above, in some possible implementation manners, the target information comprises a specified string; the security service process sends the target information representing successful restart in response to the specified parameter comprises: writing the specified string into the product installation directory; and correspondingly, determining that the security service process is successfully restarted in the case of detecting that the security service process sends the target information comprises: determining that the security service process is successfully restarted in the case of detecting that a file in the product installation directory is changed and the changed file comprises the specified string.

[0010] In the embodiments of the present application, the security service process writes the specified string into the product installation directory, so that the abnormal recovery module can detect the file in the product installation directory to achieve the effect of detecting that the security service process is successfully restarted.

[0011] With the technical solution provided in the first aspect above, in some possible implementation manners, the security service process sends the target information representing successful restart in response to the specified parameter comprises: writing the specified string into a target file under the product installation directory; and correspondingly, determining that the security service process is successfully restarted in the case of detecting that the security service process sends the target information comprises: determining that the security service process is successfully restarted in the case of detecting that the target file exists in the product installation directory and the specified string exists in the target file.

[0012] In the embodiments of the present application, the security service process writes the specified string into the newly created target file in the product installation directory, and therefore, the abnormal recovery module only needs to detect whether the specified string exists in the target file. It is not necessary to detect other changed files in the product installation directory, and the workload of the abnormal recovery module is reduced.

[0013] In some possible implementation manners, the specified string includes timestamp information, and in a case where it is detected that a file in the product installation directory is changed and the changed file includes the specified string, it is determined that the security service process is successfully restarted, comprising: in a case where it is detected that a file in the product installation directory is changed and the changed file includes the specified string, and the difference between the timestamp information included in the specified string and the current time is less than a preset time threshold, it is determined that the security service process is successfully restarted.

[0014] In the embodiments of the present application, the writing time of the specified string can be presented through the timestamp information, so that whether the specified string in the product installation directory is the specified string representing that the security service process is successfully restarted in the current situation can be determined through the time information. Thus, the previous specified string is prevented from being misrecognized as the information representing that the security service process is successfully restarted this time.

[0015] In a second aspect, the present application provides an exception recovery method applied to a security service process in a security protection system, the security protection system further including an exception recovery module and at least one product process, the method comprising: after successful startup, detecting whether a specified parameter transmitted by the exception recovery module is received; in a case where the specified parameter is detected, sending target information representing successful restart in response to the specified parameter, so that the exception recovery module sends notification information representing that the security service process is restarted to each product process in response to the target information.

[0016] In the embodiments of the present application, the exception recovery module transmits a specified parameter to the security service process, so that the security service process can determine that the target information needs to be sent based on the specified parameter, and then the exception recovery module can determine that the security service process has been successfully restarted according to the target information. In this way, the exception recovery module can accurately determine whether the security service process is successfully restarted, and the accuracy of the present solution is improved.

[0017] In some possible implementation manners, the target information includes a specified string, and the sending of the target information representing successful restart in response to the specified parameter comprises: writing the specified string into the product installation directory; so that the exception recovery module determines that the security service process is successfully restarted in a case where it is detected that a file in the product installation directory is changed and the changed file includes the specified string.

[0018] In the embodiments of the present application, the specified string is written into the product installation directory, so that the abnormal recovery module can detect the file in the product installation directory to achieve the effect of detecting the successful restart of the security service process.

[0019] In some possible implementation manners, in combination with the technical solutions of the second aspect, the sending of the target information indicating the successful restart comprises: determining whether the target file exists in the product installation directory; creating the target file in the product installation directory if the target file does not exist in the product installation directory, and writing the specified string into the target file; and writing the specified string into the target file if the target file exists in the product installation directory; so that the abnormal recovery module determines that the security service process is restarted successfully if the target file exists in the product installation directory and the specified string exists in the target file.

[0020] In the embodiments of the present application, the specified string is written into the target file in the product installation directory, so that the abnormal recovery module only needs to detect whether the specified string exists in the target file, and does not need to detect other files in the product installation directory that have changed, thereby reducing the workload of the abnormal recovery module.

[0021] In some possible implementation manners, in combination with the technical solutions of the second aspect, after the target information indicating the successful restart is sent, the method further comprises: receiving a scheduling instruction sent by the product process; and scheduling a security capability corresponding to the scheduling instruction to protect the product process.

[0022] In a third aspect, the present application provides a security protection system, comprising: a security service process, an abnormal recovery module, and at least one product process, wherein the security service process is configured to execute the method in the second aspect and / or any of the implementation manners of the second aspect; the abnormal recovery module is configured to execute the method in the first aspect and / or any of the implementation manners of the first aspect; and the product process is configured to reschedule a security capability in the security service process based on the notification information if the notification information sent by the abnormal recovery module is received.

[0023] In a fourth aspect, the present application provides an electronic device, comprising: a memory and a processor, which are connected; the memory is configured to store a process implementation program and a control program; the processor is configured to call the process program stored in the memory to implement an exception recovery module, a security service process and at least one product process, and to call the control program stored in the memory to execute the method of the first aspect and / or any one of the implementation manners of the first aspect, and / or execute the method of the second aspect and / or any one of the implementation manners of the second aspect.

[0024] In a fifth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a computer to execute the method of the first aspect and / or any one of the implementation manners of the first aspect, and / or execute the method of the second aspect and / or any one of the implementation manners of the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation to the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor.

[0026] Figure 1 A flowchart of a first exception recovery method shown in the embodiments of the present application;

[0027] Figure 2 A flowchart of a second exception recovery method shown in the embodiments of the present application;

[0028] Figure 3 A structure block diagram of a security protection system shown in the embodiments of the present application;

[0029] Figure 4 A data interaction diagram inside a first security protection system shown in the embodiments of the present application;

[0030] Figure 5 A data interaction diagram inside a second security protection system shown in the embodiments of the present application;

[0031] Figure 6 A structure block diagram of an electronic device shown in the embodiments of the present application. DETAILED DESCRIPTION

[0032] The technical solutions of the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0033] It should be noted that like reference numerals and characters refer to like elements throughout the following description with like reference numerals and characters referring to like elements throughout the following description and across different drawings indicated to be reference numerals and characters in the drawings and like elements have the same or similar function in the same or similar contexts. Also, the terms "first", "second", and the like, in the description do not necessarily connote an absolute sequence or order among, but can be used to modify a name of an entity or action. Furthermore, the terms "comprise", "include", or "contain" or any other variant thereof are intended to cover a non-exclusive inclusion, such that processes, methods, articles, or apparatuses that comprise, include, or contain an element or a list of elements do not include only those elements but can include other elements not expressly listed or inherent to such processes, methods, articles, or apparatuses.

[0034] The technical solutions of the present application will be described in detail below with reference to the drawings.

[0035] The present application provides an exception recovery method applied to an exception recovery module in a security protection system, the security protection system further comprising a security service process and at least one product process.

[0036] Please refer to Figure 1 , Figure 1 A flowchart of an exception recovery method shown in an embodiment of the present application is shown below, and the steps contained therein will be described below. Figure 1

[0037] S100: Monitor whether the security service process disappears.

[0038] In one embodiment, the specific way of monitoring whether the security service process disappears can be that the Windows platform can use system APIs (such as the API WaitForSingleObject) to detect the exit event of the security service process, so as to determine whether the security service process disappears. The Linux platform can obtain the exit event of the security service process by listening to the change of the / proc / [pid] directory through system APIs (such as the API inotify), so as to determine whether the security service process disappears.

[0039] Alternatively, the specific way of monitoring whether the security service process disappears can also be that all running processes are queried through a preset query command. It is determined whether the security service process exists in all running processes. If it exists, it indicates that the security service process is running normally. If it does not exist, it indicates that the security service process disappears.

[0040] ​Alternatively, the specific way of monitoring whether the security service process disappears can also be that the security service process is periodically sent a heartbeat packet through inter-process communication, and if M heartbeat packets successively exist without response, it is considered that the security service process disappears. M is a positive integer.

[0041] In addition to the above manner, the security service process can also be monitored for disappearance through other manners.

[0042] S200: In the case where it is monitored that the security service process disappears, the security service process is restarted.

[0043] The security service process is restarted, that is, the security service process is pulled up. The specific implementation manner of pulling up the process is known to those skilled in the art, and is not described here for brevity.

[0044] In one embodiment, when the security service process is restarted, the abnormal recovery method further comprises: transmitting a specified parameter to the security service process. In the case where it is detected that the security service process sends target information, it is determined that the security service process is successfully restarted. In the case where it is not detected that the security service process sends the target information, no other operation is performed.

[0045] The specified parameter is used to cause the security service process to send target information representing successful restart in response to the specified parameter in the case where the security service process is successfully restarted.

[0046] The specific setting manner of the specified parameter can be set according to actual needs, for example, it can be a string composed of characters, numbers, etc. The specific composition manner thereof is not limited here.

[0047] By transmitting the specified parameter to the security service process, the security service process can determine that the target information needs to be sent based on the specified parameter, so that the abnormal recovery module can determine that the security service process has been successfully restarted according to the target information. In this way, the abnormal recovery module can perceive that the security service process has been successfully restarted in real time, improving the real-time performance of the present scheme.

[0048] In one embodiment, the security service process can directly send the target information to the abnormal recovery module, and in the case where the abnormal recovery module receives the target information, it is determined that the security service process is successfully restarted.

[0049] In one embodiment, the target information sent by the security service process can include a specified string. The specific manner in which the security service process sends target information representing successful restart in response to the specified parameter is that the security service process writes the specified string into the product installation directory.

[0050] Correspondingly, in the case that the target information is detected to be sent by the security service process, the specific manner of determining that the security service process is successfully restarted is that: in the case that it is detected that a file in the product installation directory is changed, and the changed file includes the specified string, it is determined that the security service process is successfully restarted.

[0051] In the case that it is detected that the file in the product installation directory is not changed, and in the case that it is detected that the file in the product installation directory is changed but the changed file does not include the specified string, it is determined that the security service process is not successfully restarted.

[0052] In an implementation, the specified string can include a unique identification string, and when it is detected that the identification string exists in the product installation directory, it is determined that the security service process is not successfully restarted.

[0053] Optionally, the specified string can further include timestamp information, and the writing time of the specified string is determined through the timestamp information.

[0054] The timestamp information represents the time when the specified string is written into the file in the product installation directory (which can be the time when the security service process triggers the action of writing the specified string, or can also be the time when the security service process completes the action of writing the specified string).

[0055] In order to facilitate understanding of the specific implementation manner of the specified string, examples will be given below. For example, the specified string can be represented as:

[0056]

[0057] The recover is the identification string, indicating that this string is the specified string. The 1710231782 is the timestamp information, representing the time when the specified string is written into the target file.

[0058] Optionally, the specified string can be set to a preset format, for example, a json (JavaScript Object Notation, JS object notation) format.

[0059] The security service process writes the specified string into the product installation directory, so that the abnormal recovery module can detect the file change in the product installation directory to achieve the effect of detecting whether the security service process is successfully restarted.

[0060] Optionally, the security service process may respond to this specified parameter by sending target information indicating a successful restart in the following ways: It may also check if the target file exists in the product installation directory; if not, create the target file in the product installation directory and write the specified string into the target file; or, if the target file exists in the product installation directory, directly write the specified string into the target file.

[0061] Correspondingly, the specific way the exception recovery module determines that the security service process has restarted successfully when it detects that the security service process has sent target information can be as follows: if the target file exists in the product installation directory and the target file contains the specified string, then the security service process has restarted successfully.

[0062] Alternatively, the exception recovery module can determine if the security service process has restarted successfully by detecting that the security service process has sent target information. Specifically, it could monitor whether the target file has changed; if so, read the content of the target file (if the content is encrypted, it needs to be decrypted). If the content of the target file includes a specified string, the security service process is considered to have restarted successfully.

[0063] Optionally, when the specified string includes timestamp information, the specific method to determine if the security service process has restarted successfully can be as follows: If a file in the product installation directory has changed, and the changed file includes the specified string, obtain the timestamp information included in the specified string. Confirm whether the difference between the timestamp information and the current time is less than a preset time threshold. If the difference between the timestamp information included in the specified string and the current time is less than the preset time threshold, determine that the security service process has restarted successfully.

[0064] The preset time threshold can be set according to actual needs, such as 1ms, 2ms, 3ms, 4ms...10ms, 20ms, 100ms, 200ms, etc. The examples here are only for convenience and should not be taken as limitations on this application.

[0065] The storage path of the target file in the product installation directory can be predetermined, so that the existence of the target file can be determined based on the predetermined storage path.

[0066] Alternatively, a naming convention for the target file can be pre-defined, such as a fixed name or a name containing a fixed field. If a file with that fixed name (or a name containing a fixed field) is detected in the product installation directory, it indicates that the file is a target file.

[0067] Correspondingly, in the case that the target file is detected, the target file can be parsed to determine whether the specified string exists in the target file.

[0068] Optionally, the target file can be a file representing a security service process in a product installation directory. After the security service process is successfully restarted, the target file should exist in the product installation directory. In this case, the security service process writes the specified string in the target file. In the case that the target file does not exist in the product installation directory, the security service process newly creates the target file in the product installation directory and writes the specified string in the newly created target file.

[0069] For example, the target file is recover.dat and the specified string is exception. In the case that the abnormal recovery module detects that the recover.dat file in the product installation directory changes, the content in the recover.dat file is read. If the content in the recover.dat file is exception, it is determined that the security service process has successfully completed the restart. The example is only for the convenience of understanding and should not be regarded as a limitation to the present application.

[0070] Optionally, the specific manner in which the security service process writes the specified string in the target file can be that the specified string in a preset format is first encrypted to obtain encrypted data. Then the encrypted data is written in the target file.

[0071] Correspondingly, in the case that the abnormal recovery module detects that the target file changes, the content in the target file needs to be first read and decrypted. Then it is determined whether the decrypted data is the specified string.

[0072] S300: In the case that the security service process is successfully restarted, notification information representing that the security service process is successfully restarted is sent to each product process.

[0073] By sending the notification information to each product process, each product process can reschedule the security capability in the security service process based on the notification information.

[0074] Based on the same technical concept, the present application further provides an abnormal recovery method applied to a security service process in a security protection system.

[0075] Please refer to Figure 2 , Figure 2 A flowchart of an abnormal recovery method according to an embodiment of the present application is shown in the figure, and the steps contained therein will be described below. Figure 2

[0076] ​S400: After the start is successful, it is detected whether the specified parameter transmitted by the abnormal recovery module is received.

[0077] The security service process determines whether the start is a restart after the start is successful by detecting whether the specified parameter transmitted by the abnormal recovery module is received, and determines whether the target information representing the restart success needs to be sent.

[0078] In the case where the specified parameter is detected, it is determined that the start is a restart; in the case where the specified parameter is not detected, it is determined that the start is not a restart.

[0079] S500: In the case where the specified parameter is detected, the target information representing the restart success is sent in response to the specified parameter.

[0080] The target information is used to cause the abnormal recovery module to send the notification information representing the restart of the security service process to each product process in response to the target information.

[0081] In an implementation, the target information can be directly sent to the abnormal recovery module, and in the case where the abnormal recovery module receives the target information, it is determined that the security service process is successfully restarted.

[0082] In an implementation, the target information can include a specified string, and the specific manner of sending the target information representing the restart success in response to the specified parameter can be that the specified string is written into the product installation directory; so that the abnormal recovery module determines that the security service process is restarted successfully in the case where it is detected that the file in the product installation directory is changed and the changed file includes the specified string.

[0083] By writing the specified string into the product installation directory, the abnormal recovery module can detect the security service process restart success by detecting the file in the product installation directory.

[0084] Optionally, the specific manner of sending the target information representing the restart success in response to the specified parameter can be that it is determined whether the target file exists in the product installation directory. If the target file does not exist in the product installation directory, the target file is newly created in the product installation directory and the specified string is written into the target file. If the target file exists in the product installation directory, the specified string is written into the target file. So that the abnormal recovery module determines that the security service process is restarted successfully in the case where it is detected that the target file exists in the product installation directory and the specified string exists in the target file.

[0085] The specific implementation and principle of the target file and the specified string have been described in the foregoing, and will not be described again here for brief description.

[0086] In one implementation, after sending target information indicating a successful restart, the anomaly recovery method further includes: receiving a scheduling instruction sent by the product process; and scheduling the security capabilities corresponding to the scheduling instruction to protect the product process.

[0087] In the case of multiple product processes, the scheduling instructions sent by different product processes can be different, that is, the security capabilities of scheduling different product processes can be different.

[0088] Based on the same technical concept, this application also provides a security protection system, such as Figure 3 As shown, the security protection system 100 includes a security service process 110, an anomaly recovery module 120, and at least one product process 130.

[0089] The anomaly recovery module 120 is used to execute the steps described in S100-S300 above. The security service process 110 is used for the steps described in S400-S500. The specific implementation methods of S100-S300 and S400-S500 have been clearly described above, and will not be repeated here for the sake of brevity.

[0090] Product process 130 is used to reschedule security capabilities in security service process 110 based on notification information received from anomaly recovery module 120.

[0091] Product process 130 may reschedule security capabilities in security service process 110 by sending a scheduling instruction to security service process 110 via IPC.

[0092] Alternatively, product process 130 can restart itself, thereby rescheduling security capabilities. Since the product process typically automatically schedules security capabilities to security service process 110 after startup, restarting the product process allows for the rescheduling of security capabilities.

[0093] To better understand the specific working principle of the safety protection system 100, please refer to [link / reference]. Figure 4 , Figure 4 This is a data interaction diagram within the security protection system 100.

[0094] like Figure 4 As shown, product process 130 first registers a callback in the exception recovery module 120 so that the exception recovery module 120 can subsequently provide feedback notification information to product process 130 based on the callback. Then, product process 130 sends a scheduling instruction to security service process 110 via IPC, so that security service process 110 can schedule the security capabilities corresponding to the scheduling instruction to protect product process 130.

[0095] The abnormality recovery module 120 monitors whether the security service process 110 crashes. When detecting that the security service process 110 abnormally crashes, the abnormality recovery module 120 restarts the security service process 110 and transmits a specified parameter to the security service process 110.

[0096] After the security service process 110 is restarted, in a case where it is detected that the security service process 110 receives the specified parameter, the security service process 110 writes an encrypted specified string into a target file in a product installation directory. If the target file does not exist in the product installation directory, the security service process 110 creates the target file and then writes the encrypted specified string into the created target file.

[0097] The abnormality recovery module 120 detects that the target file exists in the product installation directory and that the target file changes (for example, the file size changes, the file update time changes, etc.), reads the content of the target file and decrypts it. If the decrypted content includes the specified string in the specified format, it is determined that the security service process 110 is restarted successfully. The notification information indicating that the security service process 110 is restarted successfully is sent to each product process 130. If the decrypted content does not include the specified string in the specified format, the target file is continuously monitored.

[0098] The product process 130 sends the scheduling instruction to the security service process 110 again through the IPC, so that the security service process 110 schedules the security capability corresponding to the scheduling instruction to protect the product process 130.

[0099] Figure 4 The specific implementation of each step is described above, and for brevity, it is not repeated here.

[0100] In order to facilitate understanding of the specific working principle of the security protection system 100, the security capability scheduled by the product process 130 is taken as a network driver for example, please refer to Figure 5 .

[0101] As shown in Figure 5 , first, the product process 130 registers a callback in the abnormality recovery module 120, so that the abnormality recovery module 120 feeds back the notification information to the product process 130 based on the callback subsequently. Then, the product process 130 sends the scheduling instruction for scheduling the network driver to the security service process 110 through the IPC (the IPC: createsession shown in Figure 5 ).

[0102] The security service process 110 sends the scheduling instruction to the network driver (the createsession shown in Figure 5 ) after receiving the scheduling instruction. The network driver feeds back the session number (the session number: 1 shown in Figure 5(Session_id shown). Security service process 110 returns this session number to product process 130.

[0103] Product process 130 again sends the session number and the rules for monitoring external domain names or IPs to security service process 110 via IPC. Security service process 110 forwards the session number and the rules for monitoring external domain names or IPs to the network driver. Afterwards, the network driver detects external network events on the local machine.

[0104] When the network driver detects an external network connection to the local machine, it reports the network event information to the security service process 110. The security service process 110 then reports the network event information to the product process 130 via IPC.

[0105] Then, product process 130 will send the session number and the processing instructions for the network event (e.g.) Figure 5 The block shown is also called an obstruction; except Figure 5 Besides the block instruction shown, other instructions can also be used (these are not restricted here) and are sent to the security service process 110. The security service process 110 forwards the session number and the processing instruction for the network event to the network driver. Then, the network driver responds to the processing instruction and blocks the network event.

[0106] When the security service process 110 crashes abnormally, the exception recovery module 120 detects that the security service process 110 in the product installation directory has crashed. The exception recovery module 120 then restarts the security service process 110 and transmits the specified parameters to the security service process 110.

[0107] After the security service process 110 is restarted, upon detecting that it has received the specified parameter, it writes the encrypted specified string to the target file in the product installation directory. If the target file does not exist in the product installation directory, it creates the target file and writes the encrypted specified string to the new target file. The exception recovery module 120, upon detecting that the target file exists in the product installation directory and that the target file has changed (e.g., file size or update time), reads and decrypts the contents of the target file. If the decrypted content includes the specified string in the specified format, it determines that the security service process 110 has restarted successfully. It then sends a notification message indicating that the security service process 110 has restarted successfully to each product process 130. If the decrypted content does not include the specified string in the specified format, it continues to monitor the target file.

[0108] Product process 130 again sends a scheduling instruction for the network driver to security service process 110 via IPC, so that security service process 110 can schedule and schedule the network driver to protect product process 130.

[0109] Figure 5 The specific implementation of each step is described above, and will not be repeated here for brief description.

[0110] Referring to Figure 6 The electronic device 200 provided by the embodiment of the present application. The electronic device 200 includes a processor 210, a memory 220.

[0111] The memory 220, processor 210, each element is directly or indirectly electrically connected to each other, to realize the transmission or interaction of data. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. Among them, the memory 220 is used to store computer programs, such as storing process implementation programs and control programs.

[0112] The processor 210 is configured to call the process program stored in the memory 220 to implement the exception recovery module, the security service process and at least one product process, and to call the control program stored in the memory 220 to execute the exception recovery method.

[0113] For example, the processor 210 can be used to monitor whether the security service process disappears; in the case of monitoring that the security service process disappears, restart the security service process; in the case of successful restart of the security service process, send notification information representing the successful restart of the security service process to each product process, so that each product process reschedules the security capabilities in the security service process based on the notification information.

[0114] Alternatively, the processor 210 can also be used to detect whether the specified parameter transmitted by the exception recovery module is received after the start is successful; in the case of detecting the specified parameter, send target information representing the successful restart in response to the specified parameter, so that the exception recovery module sends notification information representing the restart of the security service process to each product process in response to the target information.

[0115] The memory 220 can be, but is not limited to, a RAM (Random Access Memory), a ROM (Read Only Memory), a PROM (Programmable Read-Only Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electric Erasable Programmable Read-Only Memory), and the like.

[0116] The processor 210 can be an integrated circuit chip with a processing capability of signals. The processor can be a general processor, including a CPU (Central Processing Unit), an NP (Network Processor), and the like; or a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The processor can implement or execute the disclosed methods, steps, and logic block diagrams in the embodiments of the present application. The general processor can be a microprocessor or the processor 210 can also be any conventional processor.

[0117] The electronic device 200 can include, but is not limited to, a personal computer, a server, and the like.

[0118] The embodiments of the present application also provide a computer readable storage medium (hereinafter referred to as a storage medium) having a computer program stored thereon. When the computer program is run by a computer such as the electronic device 200 described above, the abnormal recovery method shown above is executed. The computer readable storage medium includes a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0119] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An abnormality recovery method characterized by comprising: An abnormality recovery module applied to a security protection system, the security protection system further comprising a security service process and at least one product process, the method comprising: monitoring whether the security service process disappears; in the case of monitoring that the security service process disappears, restarting the security service process; in the case of the security service process restarting successfully, sending notification information representing the security service process restarting successfully to each product process, so that each product process reschedules the security capability in the security service process based on the notification information.

2. The method of claim 1, wherein, In the case of restarting the security service process, the method further comprises: transmitting a specified parameter to the security service process, so that the security service process sends target information representing the restarting success in response to the specified parameter in the case of restarting successfully; in the case of detecting that the security service process sends the target information, determining that the security service process restarts successfully.

3. The method of claim 2, wherein, The target information comprises a specified string; the security service process sends target information representing the restarting success in response to the specified parameter, which comprises writing the specified string into the product installation directory; Correspondingly, in the case of detecting that the security service process sends the target information, determining that the security service process restarts successfully comprises: in the case of detecting that a file in the product installation directory changes and the changed file comprises the specified string, determining that the security service process restarts successfully.

4. The method of claim 3, wherein, The security service process sends target information representing the restarting success in response to the specified parameter, which comprises writing the specified string into a target file under the product installation directory; Correspondingly, in the case of detecting that the security service process sends the target information, determining that the security service process restarts successfully comprises: in the case of detecting that the target file exists in the product installation directory and the specified string exists in the target file, determining that the security service process restarts successfully.

5. The method of claim 3, wherein, The specified string comprises timestamp information, in the case of detecting that a file in the product installation directory changes and the changed file comprises the specified string, determining that the security service process restarts successfully comprises: in the case of detecting that a file in the product installation directory changes and the changed file comprises the specified string, and the difference between the timestamp information included in the specified string and the current time is less than a preset time threshold, determining that the security service process restarts successfully.

6. An abnormality recovery method characterized by comprising: A security service process applied to a security protection system, the security protection system further comprising an abnormality recovery module and at least one product process, the method comprising: after starting successfully, detecting whether a specified parameter transmitted by the abnormality recovery module is received; in the case of detecting the specified parameter, sending target information representing the restarting success in response to the specified parameter, so that the abnormality recovery module sends notification information representing the security service process restarting to each product process in response to the target information.

7. The method of claim 6, wherein, The target information includes a specified string, and the target information representing the successful restart is sent in response to the specified parameter, including: The specified string is written into the product installation directory, so that the abnormal recovery module determines that the security service process is successfully restarted when detecting that a file in the product installation directory is changed and the changed file includes the specified string.

8. The method of claim 7, wherein, The target information representing the successful restart is sent in response to the specified parameter, including: Confirming whether a target file exists in the product installation directory; If the target file does not exist in the product installation directory, creating a target file in the product installation directory and writing the specified string into the target file; If the target file exists in the product installation directory, writing the specified string into the target file; So that the abnormal recovery module determines that the security service process is successfully restarted when detecting that the target file exists in the product installation directory and the specified string exists in the target file.

9. The method of claim 6, wherein, After sending the target information representing the successful restart, the method further includes: Receiving a scheduling instruction sent by the product process; Scheduling a security capability corresponding to the scheduling instruction to protect the product process.

10. A safety shield system characterized by, It includes: A security service process, an abnormal recovery module and at least one product process The security service process is used to execute the method of any one of claims 6-9; The abnormal recovery module is used to execute the method of any one of claims 1-5; The product process is used to reschedule a security capability in the security service process based on the notification information when receiving the notification information sent by the abnormal recovery module.

11. An electronic device, comprising: It includes: A memory and a processor, and the memory and the processor are connected; The memory is used to store process implementation programs and control programs; The processor is used to call the process programs stored in the memory to implement an abnormal recovery module, a security service process and at least one product process, and is used to call the control programs stored in the memory to execute the method of any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program is executed by a computer to execute the method of any one of claims 1-9.

Images