Dynamic virtual container file access control method and system based on Hook technology
By intercepting and redirecting file operations to the virtual container space using Hook technology, dynamically generating target files and implementing delayed write-back differential management, the problems of large storage space consumption and weak security are solved, achieving lightweight and flexible container environment management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-25
- Publication Date
- 2026-04-07
AI Technical Summary
When running Windows programs on non-Windows operating systems through compatibility layers such as Wine, existing solutions suffer from large storage space consumption, low initialization efficiency, and weak security due to the pre-generated complete directory, making it difficult to achieve lightweight and flexible container environment management.
It uses Hook technology to intercept file operation requests from the target process, identifies the access path and redirects it to an independent virtual container space, and dynamically generates the file only when the target file does not exist. Combined with delayed write-back and incremental differential management, it supports on-demand loading and multiple versions coexisting.
It effectively solves the problems of large storage space consumption and weak security, while realizing flexible file loading and fast rollback, and supporting fast switching and management of multi-version compatible environments.
Smart Images
Figure CN121807445A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of mobile terminal file system virtualization technology, and in particular to a dynamic virtual container file access control method and system based on Hook technology. Background Technology
[0002] On non-Windows operating systems, when running Windows programs through compatibility layers like Wine, a pre-defined directory called wineprefix is typically used to simulate a Windows file environment. This directory needs to be fully generated during initialization, consuming significant storage space and having fixed content, leading to insufficient security isolation, severe space redundancy, and an inability to manage dynamically as needed. Existing isolation solutions using path mapping or image mounting are mostly statically bound, making it difficult to achieve lightweight and flexible container environment management while ensuring security. Summary of the Invention
[0003] To address the technical problems of existing solutions, such as large storage space consumption and low initialization efficiency due to pre-generated complete directories, as well as weak security caused by direct path exposure, this invention provides a dynamic virtual container file access control method and system based on Hook technology.
[0004] The first aspect of this invention discloses a dynamic virtual container file access control method based on Hook technology, the method comprising:
[0005] Intercepting the target process's requests to operate on the host file system using Hook technology;
[0006] Identify the access path of the operation request and determine whether the access path points to a predefined virtual container root directory or prefix;
[0007] When the access path points to the root directory or prefix of the virtual container, the access is redirected from the path in the host file system and isolated to a path in an independent virtual container space;
[0008] Redirected file operations are performed within the virtual container space, wherein: the target file is dynamically generated on demand only if the target file pointed to by the redirected access does not exist; for write operations, delayed write-back and incremental differential management are implemented.
[0009] As an optional implementation, in the first aspect of the present invention, the method further includes:
[0010] Monitor and record the sequence of file access operations performed by the target process on the virtual container space;
[0011] Based on the analysis of the recorded operation sequence, a list of predicted files that may be accessed in the future and the corresponding access confidence scores are obtained;
[0012] Based on the list of predicted files and the access confidence level, a hierarchical pre-generation strategy is executed, which performs different levels of pre-generation operations on the predicted files.
[0013] As an optional implementation, in a first aspect of the present invention, redirecting and isolating the access from the path in the host file system to a path in an independent virtual container space includes:
[0014] Obtain the process identifier of the target process, or the context information of the thread that initiated the operation request;
[0015] Based on the process identifier or thread context information, the corresponding virtual container identifier is mapped to;
[0016] Based on the virtual container identifier, the host root path portion of the access path is replaced with the path of the virtual container space corresponding to the identifier.
[0017] As an optional implementation, in the first aspect of the present invention, the method further includes:
[0018] The independent virtual container space is marked with a unique container identifier;
[0019] Based on different container identifiers, multiple independent virtual container spaces are maintained to support the coexistence of compatible environments with different versions or instances, as well as rapid switching and rollback.
[0020] A second aspect of this invention discloses a dynamic virtual container file access control system based on Hook technology, comprising:
[0021] The interception module is used to intercept the target process's operation requests to the host file system using Hook technology;
[0022] The identification module is used to identify the access path of the operation request and determine whether the access path points to a predefined virtual container root directory or prefix.
[0023] The redirection and isolation module is used to redirect and isolate the access from the path in the host file system to a path in an independent virtual container space when the access path points to the root directory or prefix of the virtual container.
[0024] The execution module is used to perform redirected file operations within the virtual container space, wherein: the target file is dynamically generated on demand only when the target file pointed to by the redirected access does not exist; and for write operations, delayed write-back and incremental differential management are implemented.
[0025] As an optional implementation, in a second aspect of the present invention, the system further includes:
[0026] The monitoring and recording module is used to monitor and record the file access operation sequence of the target process to the virtual container space;
[0027] The analysis module is used to analyze the recorded operation sequence to obtain a list of predicted files that may be accessed in the future and their corresponding access confidence levels;
[0028] The pre-generation module is used to execute a hierarchical pre-generation strategy based on the list of predicted files and access confidence, performing different levels of pre-generation operations on the predicted files.
[0029] As an optional implementation, in a second aspect of the present invention, the redirection and isolation module includes:
[0030] The acquisition submodule is used to acquire the process identifier of the target process or the context information of the thread that initiated the operation request when the identification module determines that the access path points to the root directory or prefix of the virtual container.
[0031] The mapping submodule is used to map the corresponding virtual container identifier based on the process identifier or thread context information;
[0032] The replacement submodule is used to replace the host root path portion of the access path with the path of the virtual container space corresponding to the virtual container identifier, based on the virtual container identifier.
[0033] As an optional implementation, in a second aspect of the present invention, the system further includes:
[0034] A tagging module is used to tag the independent virtual container space using a unique container identifier;
[0035] The maintenance module is used to maintain multiple independent virtual container spaces based on different container identifiers, so as to support the coexistence of compatible environments of different versions or instances, and to enable fast switching and rollback.
[0036] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:
[0037] The method provided by this invention includes the following steps: intercepting the target process's operation request to the host file system using Hook technology, identifying the access path of the operation request, and determining whether the access path points to a predefined virtual container root directory or prefix; when the access path points to the virtual container root directory or prefix, redirecting the access from the path in the host file system and isolating it to a path in an independent virtual container space, and performing the redirected file operation within the virtual container space, wherein: the target file is dynamically generated on demand only if the target file pointed to by the redirected access does not exist; for write operations, delayed write-back and incremental differential management are implemented.
[0038] This method can intercept and identify file access to a specific environment through Hook technology, and dynamically redirect it to an independent and isolated virtual container space. This effectively solves the problems of large storage space occupation and low initialization efficiency caused by pre-generating complete directories in traditional solutions, as well as the hidden dangers of weak security isolation caused by direct path exposure. At the same time, by leveraging containerized management and delayed differential write-back mechanism, it further realizes flexible on-demand loading of files in compatible environments, coexistence of multiple versions, and fast rollback.
[0039] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit the invention. Attached Figure Description
[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0041] Figure 1 This is a flowchart illustrating a dynamic virtual container file access control method based on Hook technology, according to an exemplary embodiment.
[0042] Figure 2 This is a block diagram illustrating a dynamic virtual container file access control system based on Hook technology, according to an exemplary embodiment.
[0043] Figure 3 This is a block diagram illustrating a file access control system according to another exemplary embodiment. Detailed Implementation
[0044] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.
[0045] Figure 1 This is a flowchart illustrating a dynamic virtual container file access control method based on Hook technology, according to an exemplary embodiment. Figure 1 As shown, this method includes the following steps.
[0046] Step 101: Intercept the target process's operation requests to the host file system using Hook technology.
[0047] In this embodiment of the invention, optionally, an inline hook can be performed on the libc layer file operation functions called by the target process to intercept operation requests; the file operation functions may include, but are not limited to, open, stat, access, readdir, unlink, and mkdir.
[0048] Step 102: Identify the access path of the operation request and determine whether the access path points to the predefined virtual container root directory or prefix. If the access path points to the virtual container root directory or prefix, proceed to step 103; if the access path does not point to the virtual container root directory or prefix, continue to proceed to step 102.
[0049] In this embodiment of the invention, one or more predefined path matching rules can be provided in advance. These rules typically include the root directory or prefix that needs to be pointed to in the virtual container space, such as ( / data / data / ). <pkg> / wineprefix / ...). After identifying the operation request (such as open or stat) in step 101, its access path is extracted and identified, and compared and matched with the predefined rules mentioned above. This comparison algorithm can be string prefix matching, regular expressions, or a configured path mapping table; this embodiment of the invention does not limit the specific algorithm. If the path match is successful, it can be determined that the access intent is to operate on resources within the virtual container space, and the process proceeds to step 103 to initiate the redirection and isolation mechanism. If the match fails, it is determined to be a normal access to a host ordinary file, and the request can bypass all virtualization processing and be directly allowed to the underlying native file system. Simultaneously, the system can continue to execute step 102 to identify the access paths of subsequent new operation requests using the same operation.
[0050] Step 103: Redirect the above access from the path in the host file system and isolate it to a path in a separate virtual container space.
[0051] In this embodiment of the invention, optionally, custom user identifiers, group identifiers, file permission bits, or SELinux security tags can be set for files and processes within the container to restrict container access boundaries, thereby achieving secure isolation between the independent virtual container space and the host file system.
[0052] As an optional implementation, the path that redirects and isolates the access from the host file system path to a separate virtual container space may include:
[0053] Obtain the process identifier of the target process, or the context information of the thread that initiated the operation request; map the corresponding virtual container identifier based on the process identifier or thread context information; replace the host root path part in the access path with the path of the virtual container space corresponding to the identifier based on the virtual container identifier.
[0054] As another optional implementation, the above method may further include:
[0055] Independent virtual container spaces are marked with a unique container identifier; multiple independent virtual container spaces are maintained based on different container identifiers to support the coexistence of compatible environments of different versions or instances, as well as rapid switching and rollback.
[0056] Step 104: Perform the redirected file operations within the virtual container space, wherein: the target file is dynamically generated on demand only if the target file pointed to by the redirected access does not exist; for write operations, implement delayed write-back and incremental differential management.
[0057] In this embodiment of the invention, the virtual container space is initially empty, containing only metadata. Only when the target file to be redirected does the system create a virtual copy of the target file in real time, based on a preset file template, generation strategy, or by reading from backend storage, thereby avoiding unnecessary pre-allocation. For write operations, delayed write-back is used to reduce immediate I / O pressure, and combined with incremental differential management, only the changed parts of the file are recorded, which can effectively improve storage efficiency and response speed.
[0058] Furthermore, a file access prediction model can be trained using historical access data. This model, after identifying the virtual container accessed in step 102, dynamically analyzes the current access pattern and predicts frequently requested files (such as commonly used dependency libraries, shared configuration files, or intermediate data about to be processed). It then generates virtual copies of these files in the background in advance or on demand to reduce initial access latency. Additionally, distributed caching (such as a Redis cluster) can be used to synchronize the file differential status of each node in real time, ensuring that file changes on any node are quickly and predictably synchronized to other nodes, improving collaborative sharing efficiency.
[0059] The aforementioned historical access data can be obtained from device or container log files, system monitoring tools, etc., and may include file access time, access frequency, accessed file type, accessing user or process information, etc., which are not limited in this embodiment of the invention.
[0060] As an optional implementation, the method may further include the following steps:
[0061] Monitor and record the target process's file access operation sequence to the aforementioned virtual container space;
[0062] Based on the analysis of the recorded operation sequence, a list of predicted files that may be accessed in the future and the corresponding access confidence scores are obtained;
[0063] Based on the above list of predicted files and access confidence, a hierarchical pre-generation strategy is implemented, performing different levels of pre-generation operations on the predicted files.
[0064] In this embodiment of the invention, the above-mentioned hierarchical pre-generation strategy performs different levels of pre-generation operations on the predicted file. Specifically, for high-confidence files, the complete content is preloaded in memory or high-speed storage area; for medium-confidence files, the file structure and metadata are pre-created in container space; and for low-confidence files, only the fast index is updated.
[0065] It is evident that implementation Figure 1 The described dynamic virtual container file access control method based on Hook technology can intercept and identify file access pointing to a specific environment through Hook technology, and dynamically redirect it to an independent and isolated virtual container space. This effectively solves the problems of large storage space occupation and low initialization efficiency caused by pre-generating complete directories in traditional solutions, as well as the hidden dangers of weak security isolation caused by direct path exposure. At the same time, by leveraging containerized management and delayed differential write-back mechanism, it further realizes flexible on-demand loading of files in compatible environments, coexistence of multiple versions, and fast rollback.
[0066] Figure 2 This is a block diagram illustrating a dynamic virtual container file access control system based on Hook technology, according to an exemplary embodiment. Figure 2 As shown, the system includes:
[0067] Interception module 201 is used to intercept the target process's operation requests to the host file system using Hook technology.
[0068] The identification module 202 is used to identify the access path of the operation request and determine whether the access path points to the predefined virtual container root directory or prefix.
[0069] The redirection and isolation module 203 is used to redirect and isolate the access from the path in the host file system to the path in the independent virtual container space when the identification module 202 determines that the access path points to the root directory or prefix of the virtual container.
[0070] Execution module 204 is used to perform redirected file operations within the virtual container space, wherein: the target file is dynamically generated on demand only when the target file pointed to by the redirected access does not exist; for write operations, delayed write-back and incremental differential management are implemented.
[0071] It is evident that implementation Figure 2 The described file access control system can intercept and identify file access to a specific environment through Hook technology, and dynamically redirect it to an independent and isolated virtual container space. This effectively solves the problems of large storage space occupation and low initialization efficiency caused by the pre-generation of complete directories in traditional solutions, as well as the hidden dangers of weak security isolation caused by direct path exposure. At the same time, by leveraging containerized management and delayed differential write-back mechanism, it further realizes flexible on-demand loading of files in compatible environments, coexistence of multiple versions, and fast rollback.
[0072] Figure 3 This is a block diagram illustrating another file access control system according to an exemplary embodiment. Figure 3 The file access control system shown is composed of Figure 2 The file access control system shown was further optimized. Figure 2 Compared to the Hook-based dynamic virtual container file access control system shown, in Figure 3 The dynamic virtual container file access control system based on Hook technology shown may also include:
[0073] The monitoring and recording module 205 is used to monitor and record the file access operation sequence of the target process to the virtual container space intercepted by the interception module 201.
[0074] The analysis module 206 is used to analyze the operation sequence recorded by the monitoring and recording module 205 to obtain a list of predicted files that may be accessed in the future and the corresponding access confidence.
[0075] The pre-generation module 207 is used to perform a hierarchical pre-generation strategy based on the above-mentioned list of prediction files and access confidence, and to perform different levels of pre-generation operations on the prediction files.
[0076] As an optional implementation, the redirection and isolation module 203 described above may include:
[0077] The acquisition submodule 2031 is used to acquire the process identifier of the target process or the context information of the thread that initiated the operation request when the identification module 202 determines that the access path points to the root directory or prefix of the virtual container.
[0078] The mapping submodule 2032 is used to map the corresponding virtual container identifier based on the process identifier or thread context information.
[0079] Replacement submodule 2033 is used to replace the host root path portion in the access path with the path of the virtual container space corresponding to the virtual container identifier, based on the virtual container identifier.
[0080] As another optional implementation, the system may further include:
[0081] The tagging module 208 is used to pre-tag the independent virtual container space involved in the redirection and isolation module 203 by means of a unique container identifier.
[0082] Maintenance module 209 is used to maintain multiple independent virtual container spaces based on different container identifiers, so as to support the coexistence, rapid switching and rollback of compatible environments of different versions or instances.
[0083] It is evident that implementation Figure 3 The described file access control system can intercept and identify file access to a specific environment through Hook technology, and dynamically redirect it to an independent and isolated virtual container space. This effectively solves the problems of large storage space occupation and low initialization efficiency caused by the pre-generation of complete directories in traditional solutions, as well as the hidden dangers of weak security isolation caused by direct path exposure. At the same time, by leveraging containerized management and delayed differential write-back mechanism, it further realizes flexible on-demand loading of files in compatible environments, coexistence of multiple versions, and fast rollback.
[0084] In one exemplary embodiment, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the dynamic virtual container file access control method based on Hook technology as described above.
[0085] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.< / pkg>
Claims
1. A dynamic virtual container file access control method based on Hook technology, characterized in that, include: Intercepting the target process's requests to operate on the host file system using Hook technology; Identify the access path of the operation request and determine whether the access path points to a predefined virtual container root directory or prefix; When the access path points to the root directory or prefix of the virtual container, the access is redirected from the path in the host file system and isolated to a path in an independent virtual container space; The redirected file operation is performed within the virtual container space, wherein: the target file is dynamically generated on demand only if the target file pointed to by the redirected access does not exist; For write operations, delayed write-back and incremental differential management are implemented.
2. The method according to claim 1, characterized in that, The method further includes: Monitor and record the sequence of file access operations performed by the target process on the virtual container space; Based on the analysis of the recorded operation sequence, a list of predicted files that may be accessed in the future and the corresponding access confidence scores are obtained; Based on the list of predicted files and the access confidence level, a hierarchical pre-generation strategy is executed, which performs different levels of pre-generation operations on the predicted files.
3. The method according to claim 1, characterized in that, The process of redirecting and isolating the access from the path in the host file system to a separate virtual container space includes: Obtain the process identifier of the target process, or the context information of the thread that initiated the operation request; Based on the process identifier or thread context information, the corresponding virtual container identifier is mapped to; Based on the virtual container identifier, the host root path portion of the access path is replaced with the path of the virtual container space corresponding to the identifier.
4. The method according to claim 3, characterized in that, The method further includes: The independent virtual container space is marked with a unique container identifier; Based on different container identifiers, multiple independent virtual container spaces are maintained to support the coexistence of compatible environments with different versions or instances, as well as rapid switching and rollback.
5. A dynamic virtual container file access control system based on Hook technology, characterized in that, include: The interception module is used to intercept the target process's operation requests to the host file system using Hook technology; The identification module is used to identify the access path of the operation request and determine whether the access path points to a predefined virtual container root directory or prefix. The redirection and isolation module is used to redirect and isolate the access from the path in the host file system to a path in an independent virtual container space when the access path points to the root directory or prefix of the virtual container. An execution module is used to perform redirected file operations within the virtual container space, wherein: the target file is dynamically generated on demand only when the target file pointed to by the redirected access does not exist; For write operations, delayed write-back and incremental differential management are implemented.
6. The system according to claim 5, characterized in that, The system also includes: The monitoring and recording module is used to monitor and record the file access operation sequence of the target process to the virtual container space; The analysis module is used to analyze the recorded operation sequence to obtain a list of predicted files that may be accessed in the future and their corresponding access confidence levels; The pre-generation module is used to execute a hierarchical pre-generation strategy based on the list of predicted files and access confidence, performing different levels of pre-generation operations on the predicted files.
7. The system according to claim 5, characterized in that, The redirection and isolation module includes: The acquisition submodule is used to acquire the process identifier of the target process or the context information of the thread that initiated the operation request when the identification module determines that the access path points to the root directory or prefix of the virtual container. The mapping submodule is used to map the corresponding virtual container identifier based on the process identifier or thread context information; The replacement submodule is used to replace the host root path portion of the access path with the path of the virtual container space corresponding to the virtual container identifier, based on the virtual container identifier.
8. The system according to claim 7, characterized in that, The system also includes: A tagging module is used to tag the independent virtual container space using a unique container identifier; The maintenance module is used to maintain multiple independent virtual container spaces based on different container identifiers, so as to support the coexistence of compatible environments of different versions or instances, and to enable fast switching and rollback.