File access method and electronic device

Abstract

Provided in the embodiments of the present application are a file access method and an electronic device, the method comprising: receiving process information of an application process that is sent by a core, wherein the core is used for suspending the application process when the application process has been detected; on the basis of the process information, calculating an actual metric value of a program file corresponding to the application process and an actual metric value of a target file to be accessed by the application process, and on the basis of the actual metric value of the program file and the actual metric value of the target file, obtaining a determination result, wherein the determination result comprises allowing the application process to access the target file or not allowing the application process to access the target file; and sending the determination result to the core, such that the core wakes up the application process, and releases or intercepts the application process. The solution can improve the safety and reliability of file access.

Description

File access method and electronic device

[0001] The present application claims priority to the Chinese Patent Application No. 202411134063.6, filed on August 16, 2024, and entitled "File Access Method and Electronic Device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] Embodiments of the present application relate to the field of computer technology, and in particular to a file access method and an electronic device. BACKGROUND

[0003] In current file access scenarios, identity verification is generally performed on the access end to avoid the impact of illegal access on the file access system. For example, through trusted boot technology, the system can verify the integrity and authenticity of the application process to prevent malicious software from affecting the security of the system. Trusted boot usually involves the cooperation of hardware and software, including the use of secure boot loaders, digital signature verification, secure boot chips, and other technical means.

[0004] In the above scheme, when the file requested to be accessed by the access end is a malicious file, such as a tampered file, the access end cannot effectively be prevented from accessing the malicious file. After the access end accesses the malicious file, the normal operation of the access end may be affected, resulting in low security and reliability of file access. SUMMARY

[0005] Embodiments of the present application provide a file access method and an electronic device, which can improve the security and reliability of file access.

[0006] In a first aspect, embodiments of the present application provide a file access method, the method comprising:

[0007] receiving process information of a suspended application process sent by a kernel, the application process being used to access a target file, the process information comprising a file path of the target file;

[0008] calculating an actual measurement value of the target file according to the process information;

[0009] obtaining an original measurement value of the target file from a trusted module;

[0010] comparing the actual measurement value and the original measurement value, and sending a ruling result to the kernel to wake up the application process and allow or reject the application process to access the target file.

[0011] In the scheme, whether the target file accessed by the application process is trusted is determined based on the actual measurement value of the target file, whether the file access event is trusted is determined, and the kernel is intercepted when the file access event is untrusted, so that the security of file access and the reliability of the system are improved.

[0012] In a possible implementation, the comparison of the actual measurement value of the target file and the original measurement value of the target file specifically includes:

[0013] When the actual measurement value of the target file is the same as the original measurement value of the target file, a first decision result is sent to the kernel, so that the kernel allows the application process to access the target file.

[0014] When the actual measurement value of the target file is different from the original measurement value of the target file, a second decision result is sent to the kernel, so that the kernel rejects the application process to access the target file.

[0015] In the scheme, when the actual measurement value of the target file is the same as the original measurement value of the target file, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file is not tampered, and the target file can be considered as trusted. The first decision result is sent to the kernel, so that the kernel allows the application process to access the target file. When the actual measurement value is different from the original measurement value, it indicates that the target file is tampered, and the target file can be considered as untrusted. The second decision result is sent to the kernel, so that the kernel rejects the application process to access the target file.

[0016] In a possible implementation, before the process information of the application process sent by the kernel is received, the method includes:

[0017] The hook function is set, so that when the kernel detects that the application process calls the file access interface, the application process is suspended, and the process information of the application process is returned.

[0018] The comparison of the actual measurement value of the target file and the original measurement value of the target file, and the sending of the decision result to the kernel, so that the kernel allows or rejects the application process to access the target file, includes:

[0019] The comparison of the actual measurement value of the target file and the original measurement value of the target file, and the sending of the decision result to the kernel, so that the kernel allows or rejects the application process to access the target file, includes:

[0020] In the scheme, by setting the hook function, the kernel detects that an application process accesses the target file, and the application process is suspended until the trusted measurement of the target file is completed. Then, according to the returned decision result, the application process is woken up, and the application process is allowed or refused to access the target file, so that the security of the application process and the system is effectively avoided from being affected by untrusted malicious files.

[0021] In a possible implementation, the process information includes a process identifier of the application process, and the comparison of the actual measurement value of the target file and the original measurement value of the target file and the sending of the decision result to the kernel to allow or refuse the application process to access the target file specifically include:

[0022] The comparison of the actual measurement value of the target file and the original measurement value of the target file and the sending of the decision result to the kernel to allow or refuse the application process to access the target file include that the decision result includes the process identifier.

[0023] In the scheme, process information of different processes can be received, and then according to the process identifier, an access result is respectively fed back, so that multiple processes are allowed to access different target files, and the efficiency of file access is improved.

[0024] In a second aspect, an embodiment of the present application provides a file access method, and the method includes:

[0025] Receiving process information of an application process sent by a kernel, the application process being used for accessing a target file, and the process information including a file path of the target file;

[0026] According to the process information, an actual measurement value of the target file is calculated;

[0027] A configuration file is read, and the configuration file includes a trusted module storage function identifier of the target file;

[0028] According to the trusted module storage function identifier, an original measurement value of the target file is obtained;

[0029] The actual measurement value of the target file and the original measurement value of the target file are compared, and a decision result is sent to the kernel to allow or refuse the application process to access the target file.

[0030] In the scheme, based on the trusted module storage function identifier in the configuration file, the storage position of the original measurement value of the target file can be flexibly configured, and based on the actual measurement value and the original measurement value of the target file, it is determined whether the target file accessed by the application process is trusted, so as to comprehensively determine whether the file access event is trusted, and the file access event can be accurately measured, and the kernel can be intercepted when the file access event is not trusted, thereby effectively improving the security of file access and the reliability of the system.

[0031] In a possible implementation manner, the method comprises:

[0032] At startup, a configuration file is loaded, the configuration file comprising configuration information of at least one file, the configuration information comprising a file path and a trusted module storage function identifier, the trusted module storage function identifier being used to indicate a storage position of an original measurement value of the file, the target file being one of the at least one file;

[0033] When the trusted module storage function identifier indicates that the storage position is a trusted module, the original measurement value of the file is stored in the trusted module;

[0034] When the trusted module storage function identifier does not indicate that the storage position is a trusted module, the original measurement value of the file is stored in the configuration file.

[0035] In the scheme, by setting the configuration file, the original measurement value of the target file can be saved in the trusted module or the configuration file, the flexibility of configuration is improved, and the limited trusted module space cannot store all original measurement values of the target files, so that based on the actual measurement value of the target file, it is determined whether the target file accessed by the application process is trusted, the file access event is accurately measured, and the security of file access and the reliability of the system can be effectively improved.

[0036] In a possible implementation manner, the comparison of the actual measurement value of the target file and the original measurement value of the target file specifically comprises:

[0037] When the actual measurement value of the target file and the original measurement value of the target file are the same, a first decision result is sent to the kernel, so that the kernel allows the application process to access the target file;

[0038] When the actual measurement value of the target file and the original measurement value of the target file are different, a second decision result is sent to the kernel, so that the kernel rejects the application process to access the target file.

[0039] In the above scheme, when the actual metric value of the target file is the same as the original metric value, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file is not tampered, and the target file can be considered as trusted, and the first decision result is sent to the kernel to allow the kernel to allow the application process to access the target file; when the actual metric value is different from the original metric value, it indicates that the target file is tampered, and the target file can be considered as untrusted, and the second decision result is sent to the kernel to reject the application process to access the target file.

[0040] In a possible implementation, before the process information of the application process sent by the kernel is received, the method comprises:

[0041] The hook function is set, so that when the kernel detects that the application process calls the file access interface, the application process is suspended, and the process information of the application process is returned;

[0042] Therefore, the comparison of the actual metric value of the target file and the original metric value of the target file, and the sending of the decision result to the kernel to allow or reject the application process to access the target file, comprises:

[0043] The comparison of the actual metric value of the target file and the original metric value of the target file, and the sending of the decision result to the kernel to allow or reject the application process to access the target file, comprises:

[0044] In the above scheme, the hook function is set, so that when the kernel detects that the application process accesses the target file, the application process is suspended, until the credibility of the target file is measured, the application process is awakened according to the returned decision result, and the application process is allowed or rejected to access the target file, thereby effectively avoiding the influence of untrusted malicious files on the security of the application process and the system.

[0045] In a possible implementation, the method further comprises:

[0046] The configuration information further comprises a file backup path;

[0047] When the actual metric value is different from the original metric value, the backup file under the file backup path is used to cover the file under the file path.

[0048] In the above scheme, the backup file is used to automatically restore the program file and / or the target file when the program file and / or the target file is tampered, which can effectively improve the security of the system and the efficiency of file access.

[0049] In a possible implementation, the method further comprises:

[0050] The configuration information further comprises a file recovery function identifier;

[0051] When the file recovery function identifier indicates to be turned on, when the actual metric value is different from the original metric value, the file under the file backup path is used to cover the file under the file path.

[0052] In the above scheme, based on the file recovery function identifier, the backup file can be flexibly selected to be used for automatic recovery or not automatic recovery when the program file and / or the target file is tampered.

[0053] In a possible implementation, the configuration file further comprises a trusted module storage function identifier of the program file corresponding to the application process, and the method further comprises:

[0054] According to the process information, an actual metric value of the program file is calculated;

[0055] According to the trusted module storage function identifier of the program file, an original metric value of the program file is obtained;

[0056] Then, the actual metric value of the target file and the original metric value of the target file are compared, and a decision result is sent to the kernel, so that the kernel allows or refuses the application process to access the target file, and specifically comprises:

[0057] When the actual metric value of the target file and the original metric value of the target file are the same, and the actual metric value of the program file and the original metric value of the program file are the same, a first decision result is sent to the kernel, so that the kernel allows the application process to access the target file;

[0058] When the actual metric value of the target file and the original metric value of the target file are different, or the actual metric value of the program file and the original metric value of the program file are different, a second decision result is sent to the kernel, so that the kernel refuses the application process to access the target file.

[0059] In the above scheme, based on the actual metric value of the program file and the actual metric value of the target file, it can be judged whether the application program corresponding to the application process is trusted and whether the target file is trusted, so as to comprehensively judge whether the file access event is trusted, and the file access event can be accurately measured in trust, and the kernel can be intercepted when the file access event is not trusted, which can effectively improve the security of file access and the reliability of the system.

[0060] In a possible implementation, the process information includes a process identifier of the application process, and the comparing the actual metric value of the target file with the original metric value of the target file and sending a verdict result to the kernel to enable the kernel to allow or reject the application process to access the target file specifically includes:

[0061] The comparing the actual metric value of the target file with the original metric value of the target file and sending a verdict result to the kernel to enable the kernel to allow or reject the application process to access the target file, the verdict result including the process identifier.

[0062] In the foregoing solution, process information of different processes can be received, and then access results are respectively fed back according to process identifiers, so that multiple processes are allowed to access different target files, and the efficiency of file access is improved.

[0063] In a third aspect, an embodiment of the present application provides a file access method, applied to a kernel, and the method includes:

[0064] When it is monitored that an application process calls a file access interface, the application process is suspended, and process information of the application process is sent, the application process being used to access a target file, and the process information including a file path of the target file; an actual metric value of the target file is calculated according to the process information, and a verdict result is obtained;

[0065] According to the verdict result, the application process is woken up, and the application process is released or intercepted.

[0066] In the foregoing solution, the kernel suspends a monitored application process, sends process information of the application process, determines whether the application process is trustworthy, wakes up the application process according to a verdict result, and performs releasing or intercepting, so that the security of the application process and the system can be effectively avoided from being affected by malicious files.

[0067] In a fourth aspect, an embodiment of the present application provides an electronic device, including a monitoring process, an application process and a kernel.

[0068] The kernel is configured to suspend the application process when it is detected that the application process calls a file access interface, and send process information of the application process to the monitoring process, the application process being used to access a target file, and the process information including a file path of the target file.

[0069] The monitoring process is configured to calculate an actual metric value of the target file according to the process information, read a configuration file, the configuration file including a trusted module storage function identifier of the target file, acquire an original metric value of the target file according to the trusted module storage function identifier, and compare the actual metric value of the target file with the original metric value of the target file and send a ruling result to the kernel.

[0070] The kernel is further configured to allow or reject the application process to access the target file according to the ruling result. In the above solution, the kernel suspends the monitored application process, sends process information of the application process to the monitoring process, and the monitoring process can determine whether the target file accessed by the application process is trusted based on the actual metric value of the target file, thereby ruling whether the file access event is trusted and accurately measuring the trust of the file access event. The kernel wakes up the application process according to the ruling result and executes release or interception, which can effectively avoid the influence of malicious files on the security of the application process and the system.

[0071] In a fifth aspect, an embodiment of the present application provides an electronic device, including a processor, and a memory and a trusted module in communication connection with the processor; the memory stores computer execution instructions; and the processor executes the computer execution instructions stored in the memory to implement the method as described above.

[0072] In the above solution, the storage location of the original metric value of the target file can be determined according to the trusted module storage function identifier in the configuration file, thereby acquiring the original metric value of the target file, and determining whether the target file accessed by the application process is trusted based on the actual metric value and the original metric value of the target file, thereby comprehensively determining whether the file access event is trusted, accurately measuring the trust of the file access event, and intercepting the file access event when the file access event is not trusted through the kernel, which can effectively improve the security of file access and the reliability of the system.

[0073] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing computer execution instructions, the computer execution instructions being executed by a processor to implement the method as described above.

[0074] In the above scheme, the storage location of the original measurement value of the target file can be determined according to the trusted module storage function identifier in the configuration file, so as to obtain the original measurement value of the target file, and whether the target file accessed by the application process is trusted can be determined based on the actual measurement value and the original measurement value of the target file, so as to comprehensively determine whether the file access event is trusted, the file access event can be accurately measured for trustworthiness, and the kernel can intercept when the file access event is not trusted, so as to effectively improve the security of file access and the reliability of the system.

[0075] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method as described above.

[0076] In the above scheme, the storage location of the original measurement value of the target file can be determined according to the trusted module storage function identifier in the configuration file, so as to obtain the original measurement value of the target file, and whether the target file accessed by the application process is trusted can be determined based on the actual measurement value and the original measurement value of the target file, so as to comprehensively determine whether the file access event is trusted, the file access event can be accurately measured for trustworthiness, and the kernel can intercept when the file access event is not trusted, so as to effectively improve the security of file access and the reliability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0077] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0078] FIG. 1 is a schematic diagram of an architecture of an electronic device according to an embodiment of the present application;

[0079] FIG. 2 is a schematic diagram of a file access method according to an embodiment of the present application;

[0080] FIG. 3 is a schematic diagram of another file access method according to an embodiment of the present application;

[0081] FIG. 4 is a schematic diagram of another file access method according to an embodiment of the present application;

[0082] FIG. 5 is a schematic diagram of another file access method according to an embodiment of the present application;

[0083] FIG. 6 is a schematic diagram of another file access method according to an embodiment of the present application;

[0084] FIG. 7 is a schematic diagram of another electronic device according to an embodiment of the present application.

[0085] The specific embodiments of the application have been shown by way of example in the above figures, and will be described in greater detail below. These figures and this written description are not intended to limit the scope of the inventive concept in any way, but rather to illustrate the inventive concept by reference to specific embodiments. DETAILED DESCRIPTION

[0086] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same numbers are used in different drawings to represent the same or similar elements. The following detailed description is not intended to limit the embodiments of the application as claimed. Instead, it is described in such a way as to enable one of ordinary skill in the art to make and use the application as claimed.

[0087] First, the terms designed by the present application are explained:

[0088] Trusted Computing: A technology solution for ensuring the trustworthiness and security of computer systems. Through the combination of hardware and software, a trusted computing environment is established to protect computers and data from malicious software, attacks and unauthorized access.

[0089] Trusted Measurement: A process for evaluating the trustworthiness of a computer system, by measuring and verifying the system configuration, software and firmware to determine whether the system is in the expected security state. Trusted measurement can help detect changes in system configuration and potential malware intrusion.

[0090] Trusted Recovery: refers to the recovery of system or data integrity and availability through trusted mechanisms and processes when the system or data is accidentally damaged or lost. Trusted recovery is one of the important means to ensure the trustworthiness of the system and data.

[0091] Process: refers to a running activity of a program on a certain data set in a computer, is the basic unit of resource allocation for the system, and is the basis of the operating system structure. In the early process-oriented computer structure, process is the basic execution entity of program; in the current thread-oriented computer structure, process is the container of thread. Program refers to the description of instructions, data and their organization form, and process is the entity of program.

[0092] It should be noted that the brief description of the terms in the present application is only for the convenience of understanding the subsequent description of the embodiments, and is not intended to limit the embodiments of the present application. Unless otherwise stated, these terms should be understood according to their ordinary and general meanings.

[0093] The technical solutions of the present application and the technical solutions of the present application will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described again in some examples. In the description of the present application, unless otherwise explicitly specified and limited, each term should be understood broadly in the art. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0094] FIG. 1 is an architecture diagram of an electronic device according to an embodiment of the present application. As shown in FIG. 1, the architecture of the electronic device 100 can include a user space, a kernel space, and hardware, the user space of the electronic device 100 runs an application process 10 and a monitoring process 11, the kernel space of the electronic device 100 includes a kernel (Central Processing Unit Core) 12, and the hardware of the electronic device 100 includes a memory. Among them, the application process 10 can be a process for an application program to access a target file 13 in the memory of the electronic device 100.

[0095] Optionally, the memory can also store a binary program file 14 of the application program 10. In a possible implementation, the program file 14 can include a static file linked by the application program.

[0096] The kernel 12 can provide a service interface, and the application process 10 can call a file access system call function through the service interface to access the target file 13.

[0097] The monitoring process 11 can be used to measure the credibility of the application process 10 and the target file 13.

[0098] The kernel 12 can monitor whether the application process 10 accesses the target file 13 by monitoring whether the file access system call function is called, and suspend the application process 10 when it is monitored that the application process 10 exists, and send process information of the application process 10 to the monitoring process 11, wherein accessing the target file 13 can include reading, writing and / or changing the application file 13; the monitoring process 11 calculates the actual measurement value of the target file 13 according to the process information, so as to judge whether the file access event is credible based on the actual measurement value of the target file 13, obtain a judgment result, and send the judgment result to the kernel 12; the kernel 12 wakes up the application process 10 according to the judgment result, and releases or intercepts the application process 10.

[0099] Optionally, the monitoring process 11 can also calculate the actual metric value of the target file 13 and the actual metric value of the program file 14 according to the process information, so as to determine whether the file access event is credible based on the actual metric value of the target file 13 and the actual metric value of the program file 14, and obtain a determination result.

[0100] In a possible implementation, the monitoring process 11 determining whether the file access event is credible based on the actual metric value of the target file 13 and the actual metric value of the program file 14 can include: obtaining the reference metric value of the target file 13 and the reference metric value of the program file 14 from the trusted module 15, determining whether the actual metric value of the target file 13 matches the reference metric value of the target file 13 and whether the actual metric value of the program file 14 matches the reference metric value of the program file 14, and if both are matched, determining that the application process 10 is allowed to access the target file 13; otherwise, determining that the application process 10 is not allowed to access the target file 13.

[0101] The reference metric value of the file is calculated based on the original file content corresponding to the file, and the actual metric value of the file is calculated based on the current content of the file. It can be understood that, by determining whether the reference metric value of the file matches the actual metric value of the current file, it can be determined whether the current file is tampered compared with the original file, and when the current file is tampered, it can be considered that the file is not credible. The trusted module 15 can be used to store the reference metric values of some files.

[0102] For example, the hardware of the electronic device 100 can further include the trusted module 15, which can be installed on the mainboard of the electronic device 100 in the form of a chip. The trusted module 15 includes but is not limited to a trusted platform module (TPM), a trusted cryptography module (TCM), a trusted platform control module (TPCM), and the like. The monitoring process 11 can obtain the reference metric value of the target file 13 and the reference metric value of the program file 14 through an interface provided by the trusted module 15.

[0103] The file access method provided by the embodiment of the present application will be described below in combination with FIG. 2.

[0104] FIG. 2 is a flowchart of a file access method provided by an embodiment of the present application. The execution subject of the method is the monitoring process shown in FIG. 1. As shown in FIG. 2, the method can include:

[0105] S201, receiving process information of a suspended application process sent by a kernel, wherein the application process is used to access a target file.

[0106] When an application process accesses a target file, a file access interface of the kernel is called. In a possible implementation, the monitoring process can set a hook function, so that when the kernel detects that an application process calls the file access interface, the application process can be suspended, and process information of the application process is sent to the monitoring process.

[0107] Correspondingly, the monitoring process receives the process information of the application process.

[0108] It should be noted that suspending the application process means temporarily stopping the execution of the application process, but retaining the current state and process information of the application process for subsequent execution recovery.

[0109] The application program can start the application process in response to a user access request.

[0110] The process information can include a file path of the target file to be accessed by the application process.

[0111] Optionally, the process information can also include an identifier of the application process. In a possible implementation, when multiple processes access different target files, the monitoring process can receive process information of different processes, and then feed back access results according to process identifiers.

[0112] S202, calculating an actual measurement value of the target file according to the process information.

[0113] Exemplarily, the measurement value of the file is calculated based on the content of the file, and different file contents correspond to different measurement values. The actual measurement value of the file can be a measurement value corresponding to the current content of the file. The monitoring process can obtain the file content of the target file according to the process information, and thus calculate the actual measurement value of the target file.

[0114] In a possible implementation, the process information includes a file path of the target file; and the calculation of the actual measurement value of the target file to be accessed by the application process can include:

[0115] reading the target file according to the file path of the target file, calculating a hash value corresponding to the current content of the target file as the actual measurement value of the target file.

[0116] It can be understood that the access path of the target file is a storage path of the target file in the memory, and therefore, the target file is obtained according to the file path of the target file, including: obtaining a file under the file path of the target file in the memory to obtain the target file.

[0117] In the foregoing solution, the monitoring process can obtain the file content of the current target file according to the file path of the target file, calculate the hash value corresponding to the file content of the current target file, and thus obtain the actual measurement value of the target file.

[0118] S203, obtain the original measurement value of the target file from the trusted module.

[0119] It can be understood that the original measurement value of the target file can be stored in the trusted module after the system is started.

[0120] In a possible implementation, after the system is started, the monitoring process can obtain the original file content of a file that can be used, calculate the hash value corresponding to the original content, and store the hash value as the original measurement value of the target file in the trusted module. The file obtained by the monitoring process should include the target file.

[0121] S204, compare the actual measurement value and the original measurement value, and send a ruling result to the kernel to make the kernel allow or reject the application process to access the target file.

[0122] When the actual measurement value is the same as the original measurement value, it indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file is not tampered with, and the target file can be considered as trusted. The monitoring process can send a first ruling result to the kernel to make the kernel wake up the application process and allow the application process to access the target file.

[0123] When the actual measurement value is different from the original measurement value, it indicates that the file content of the target file is inconsistent with the file content of the original file corresponding to the target file, the target file is tampered with, and the target file can be considered as untrusted. The monitoring process can send a second ruling result to the kernel to make the kernel wake up the application process and reject the application process to access the target file.

[0124] In this embodiment, based on the actual measurement value of the target file, it can be determined whether the target file requested to be accessed by the application process is trusted, and thus it can be comprehensively determined whether the file access event is trusted, the file access event can be accurately measured in terms of trust, and the kernel can be used to intercept the file access event when the file access event is untrusted, thereby effectively improving the security of file access and the reliability of the system.

[0125] FIG. 3 is a flow diagram of another file access method provided by the embodiments of the present application. The execution subject of the method is the monitoring process shown in FIG. 1. As shown in FIG. 3, the method can include the following steps.

[0126] S301, loading a configuration file, the configuration file including configuration information of at least one file, the configuration information including a file path and a trusted module storage function identifier. The target file can be one of the at least one file.

[0127] When the monitoring process is started, the monitoring process can load the configuration file, and obtain the file path and the trusted module storage function identifier in the configuration file. At this time, the file includes original file content, and the trusted module storage function identifier is used to indicate the storage location of the original measurement value of the file.

[0128] In a possible implementation, when the trusted module storage function identifier indicates that the storage location is a trusted module, the monitoring process can obtain the original file content of the file through the file path, store the original measurement value in the trusted module after the original measurement value is calculated; when the trusted module storage function identifier does not indicate that the storage location is a trusted module, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then the original measurement value is saved in the configuration file.

[0129] For example, when the trusted module storage function identifier is 1, the monitoring process can obtain the original file content of the file through the file path, store the original measurement value in the trusted module after the original measurement value is calculated; when the trusted module storage function identifier is 0, the monitoring process can obtain the original file content of the file through the file path, calculate the original measurement value, and then the original measurement value is saved in the configuration file.

[0130] S302, receiving process information of a suspended application process sent by the kernel, wherein the application process is used to access the target file.

[0131] S303, calculating an actual measurement value of the target file according to the process information.

[0132] It should be noted that the specific implementation of steps S302 and S303 can refer to steps S201 and S202, which will not be described here.

[0133] S304, reading the configuration file to obtain the trusted module storage function identifier in the configuration file.

[0134] S305, obtaining the original measurement value of the target file according to the trusted module storage function identifier.

[0135] The monitoring process can determine the storage location of the original measurement value of the target file according to the trusted module storage function identifier, and then obtain the original measurement value.

[0136] In a possible implementation, when the trusted module storage function identifier indicates that the storage location is the trusted module, the monitoring process can obtain the original measurement value of the target file from the trusted module; when the trusted module storage function identifier does not indicate that the storage location is the trusted module, the monitoring process can read the original measurement value of the target file from the configuration file.

[0137] For example, when the trusted module storage function identifier is 1, the monitoring process can obtain the original measurement value of the target file from the trusted module; when the trusted module storage function identifier is 0, the monitoring process can read the original measurement value of the target file from the configuration file.

[0138] S306, comparing the actual measurement value and the original measurement value, sending a ruling result to the kernel to make the kernel allow or reject the application process to access the target file.

[0139] It should be noted that the specific implementation of step S306 can refer to step S204, which will not be repeated here.

[0140] Optionally, the configuration information can further include a file backup path, and the monitoring process can copy the file and store it under the file backup path when starting. When the actual measurement value is different from the original measurement value in S305, the monitoring process can overwrite the file under the file path with the backup file under the file backup path to restore the tampered file.

[0141] Optionally, the configuration information can further include a file recovery function identifier for determining whether to start the file recovery function. In a possible implementation, when the file recovery function identifier indicates to start, the monitoring process can perform the above-mentioned restoration process when the actual measurement value is different from the original measurement value; when the file recovery function identifier indicates not to start, the monitoring process can not perform the above-mentioned restoration process. For example, when the file recovery function identifier is 1, the monitoring process can perform the above-mentioned restoration process when the actual measurement value is different from the original measurement value; when the file recovery function identifier is 0, the monitoring process can not perform the above-mentioned restoration process.

[0142] For example, the backup file can also be stored in the memory.

[0143] It can be understood that step S301 can be performed only once, for example, when the monitoring process starts; the monitoring process can repeatedly perform steps S302-S306 when performing trusted measurement on the application process, so as to efficiently implement multiple trusted measurements on the application process and / or multiple trusted measurements on multiple application processes, thereby improving the file access efficiency.

[0144] In the embodiment, due to the limited space of the trusted module, the original measurement value of the target file cannot be stored. By setting the configuration file, the original measurement value of the target file can be saved in the trusted module or the configuration file, the flexibility of the configuration is improved, and whether the target file accessed by the application process is trusted can be determined based on the actual measurement value of the target file, the file access event is accurately measured, and the security of the file access and the reliability of the system are improved.

[0145] FIG. 4 is a flowchart of another file access method provided by the embodiment of the application. The execution subject of the method is the monitoring process shown in FIG. 1. As shown in FIG. 4, the method can include the following steps.

[0146] S401, receiving process information of a suspended application process sent by a kernel, wherein the application process is used to access a target file.

[0147] S402, calculating an actual measurement value of the target file according to the process information.

[0148] S403, obtaining an original measurement value of the target file from a trusted module.

[0149] It should be noted that the specific implementation of steps S402-S403 can refer to steps S202-S203, and will not be described here.

[0150] S404, comparing the actual measurement value of the target file with the original measurement value to obtain a first matching result; the first matching result includes matching or not matching.

[0151] When the first matching result is matching, the actual measurement value of the target file is the same as the original measurement value, which indicates that the file content of the target file is consistent with the file content of the original file corresponding to the target file, the target file is not tampered, and the target file can be considered as trusted.

[0152] When the first matching result is not matching, the actual measurement value of the target file is different from the original measurement value, which indicates that the file content of the target file is inconsistent with the file content of the original file corresponding to the target file, the target file is tampered, and the target file can be considered as untrusted.

[0153] In the above scheme, the monitoring process can determine whether the file content of the target file is consistent with the file content of the original file corresponding to the target file by judging whether the actual measurement value of the target file matches the reference measurement value of the target file, so as to determine whether the target file is tampered.

[0154] S405, calculating an actual measurement value of a program file corresponding to the application process according to the process information.

[0155] For example, the process information of the application process can include a file path of a program file corresponding to the application process and a file path of the target file.

[0156] In a possible implementation, the process information includes a file path of the program file; and the calculating of the actual metric value of the program file accessed by the application process can include:

[0157] reading the program file according to the file path of the program file, calculating a hash value corresponding to current content of the program file as the actual metric value of the program file.

[0158] It can be understood that the access path of the program file is a storage path of the program file in the memory, and therefore, obtaining the program file according to the file path of the target file includes: obtaining a file in the file path of the program file in the memory to obtain the program file.

[0159] In the above solution, the monitoring process can obtain file content of the current program file according to the file path of the program file, calculate a hash value corresponding to the file content of the current program file, and thereby obtain the actual metric value of the program file.

[0160] S406, obtaining an original metric value of the program file from the trusted module.

[0161] It can be understood that the original metric value of the program file can be stored in the trusted module after the system is started.

[0162] In a possible implementation, after the system is started, the monitoring process can obtain original file content of the program file, calculate a hash value corresponding to the original content, and store the hash value as the original metric value of the program file in the trusted module.

[0163] S407, comparing the actual metric value of the program file with the original metric value to obtain a second matching result; the second matching result includes matching or not matching.

[0164] When the second matching result is matching, the actual metric value of the program file is the same as the original metric value, indicating that the file content of the program file is consistent with the file content of the original file corresponding to the program file, the program file is not tampered with, and the program file can be considered as trusted.

[0165] When the second matching result is not matching, the actual metric value of the program file is not the same as the original metric value, indicating that the file content of the program file is not consistent with the file content of the original file corresponding to the program file, the program file is tampered with, and the program file can be considered as untrusted.

[0166] In the above scheme, the monitoring process can determine whether the file content of the program file is consistent with the file content of the original file corresponding to the program file by judging whether the actual measurement value of the program file matches the reference measurement value of the program file, thereby determining whether the program file has been tampered with.

[0167] In the above scheme, the monitoring process can determine whether the file content of the target file is consistent with the file content of the original file corresponding to the target file by judging whether the actual measurement value of the target file matches the reference measurement value of the target file, thereby determining whether the target file has been tampered with.

[0168] S408. Based on the first matching result and the second matching result, send a decision result to the kernel so that if both the first matching result and the second matching result are a match, the kernel allows the application process to access the target file; otherwise, it does not allow the application process to access the target file.

[0169] Specifically, when both the first and second matching results are a match—that is, when the actual measurement value of the program file matches the reference measurement value of the program file and the actual measurement value of the target file matches the reference measurement value of the target file—the monitoring process determines that neither the program file nor the target file has been tampered with, thus considering the file access event credible, and obtains a first ruling that allows the application process to access the target file, and sends the first ruling result to the kernel. When either the first or second matching result is a mismatch—that is, when the actual measurement value of the program file does not match the reference measurement value of the program file or the actual measurement value of the target file does not match the reference measurement value of the target file—the monitoring process determines that either the program file or the target file may have been tampered with, thus considering the file access event unreliable, and obtains a second ruling that disallows the application process to access the target file, and sends the second ruling result to the kernel.

[0170] Understandably, the monitoring process can first execute steps S402-S404 to perform a trust measurement on the target file, and then execute steps S405-S407 to perform a trust measurement on the program file.

[0171] Optionally, when the monitoring process starts, it can first calculate the original metric value of its own program file and save it in the trusted module. Then, the monitoring process will periodically calculate the actual metric value of its own program file and compare it with the original metric value in the trusted module. When the actual metric value is the same as the file metric value, S401-S408 will be executed.

[0172] In the above scheme, by comprehensively judging whether the actual measurement value and the reference measurement value of the program file and the target file match, it can be determined whether the program file and the target file are tampered according to the matching result, so as to determine whether the application process is allowed to access the target file, and the credibility of the measurement can be accurately performed, and the kernel can be intercepted when the target file and / or the program file is not trusted, thereby effectively improving the security of file access and the reliability of the system.

[0173] Fig. 5 is a flowchart of another file access method provided by the embodiment of the application. The execution subject of the method is the monitoring process shown in Fig. 1. As shown in Fig. 5, the method can include:

[0174] S501, load the configuration file, the configuration file including configuration information of at least two files, the configuration information including file path and trusted module storage function identifier. The target file can be one of the at least two files, and the program file can be one of the at least two files.

[0175] It should be noted that the specific implementation of step S501 can refer to step S301, which will not be repeated here.

[0176] S502, receive the process information of the suspended application process sent by the kernel, wherein the application process is used to access the target file.

[0177] S503, calculate the actual measurement value of the target file according to the process information.

[0178] It should be noted that the specific implementation of steps S502-S503 can refer to steps SS201-202, which will not be repeated here.

[0179] S504, read the configuration file to obtain the trusted module storage function identifier of the target file in the configuration file.

[0180] S505, obtain the original measurement value of the target file according to the trusted module storage function identifier of the target file.

[0181] It should be noted that the specific implementation of step S505 can refer to step S305, which will not be repeated here.

[0182] S506, compare the actual measurement value and the original measurement value of the target file to obtain a first matching result; the first matching result includes matching or not matching.

[0183] S507, calculate the actual measurement value of the program file corresponding to the application process according to the process information.

[0184] It should be noted that the specific implementation of steps S506-S507 can refer to steps S404-S405, and will not be described here.

[0185] S508, reading the configuration file to obtain the trusted module storage function identifier of the program file in the configuration file.

[0186] S509, obtaining the original measurement value of the program file according to the trusted module storage function identifier of the program file.

[0187] The monitoring process can determine the storage location of the original measurement value of the program file according to the trusted module storage function identifier, and then obtain the original measurement value of the program file.

[0188] In a possible implementation, when the trusted module storage function identifier indicates that the storage location is the trusted module, the monitoring process can obtain the original measurement value of the program file from the trusted module; when the trusted module storage function identifier does not indicate that the storage location is the trusted module, the monitoring process can read the original measurement value of the program file from the configuration file.

[0189] For example, when the trusted module storage function identifier is 1, the monitoring process can obtain the original measurement value of the program file from the trusted module; when the trusted module storage function identifier is 0, the monitoring process can read the original measurement value of the program file from the configuration file.

[0190] S510, comparing the actual measurement value of the program file with the original measurement value to obtain a second matching result; the second matching result includes matching or not matching.

[0191] S511, according to the first matching result and the second matching result, sending a ruling result to the kernel, so that the kernel allows the application process to access the target file when the first matching result and the second matching result are both matching; otherwise, the application process is not allowed to access the target file.

[0192] It should be noted that the specific implementation of steps S510-S511 can refer to steps S407-S408, and will not be described here.

[0193] It can be understood that the monitoring process can first perform steps S503-S506 to perform trusted measurement on the target file, and then perform steps S507-S510 to perform trusted measurement on the program file.

[0194] Optionally, when the monitoring process starts, the original measurement value of its own program file can be calculated and saved in the trusted module. Then, the monitoring process periodically calculates the actual measurement value of its own program file, and compares it with the original measurement value in the trusted module. When the actual measurement value is the same as the file measurement value, steps S501-S511 are performed again.

[0195] In the above scheme, due to the limited space of the trusted module, all original measurement values of the target files can not be stored. By setting the configuration file, the original measurement values of the files can be selected to be stored in the trusted module or the configuration file, the flexibility of the configuration is improved, and based on the actual measurement values of the program files and the target files, it is determined whether the application process and the target file accessed by the application process are trusted, the file access event is accurately measured, and the security of the file access and the reliability of the system are effectively improved.

[0196] FIG. 6 is another file access method provided by an embodiment of the present application. The execution subject of the method is the kernel shown in FIG. 1. As shown in FIG. 6, the method can include:

[0197] S601, when it is monitored that an application process calls a file access interface, the application process is suspended, and process information of the application process is sent to a monitoring process, the application process is used to access a target file, and the process information includes a file path of the target file; so that the monitoring process calculates an actual measurement value of the target file according to the process information, and obtains a decision result.

[0198] For example, the monitoring process can set a hook function, so that the kernel suspends the application process when it is monitored that the application process accesses the target file, and sends process information of the application process to the monitoring process.

[0199] The kernel monitoring whether the application process accesses the target file can include monitoring whether a system call function for file access is called.

[0200] The monitoring process can determine whether the application process is trusted according to the process information, and return the decision result to the kernel.

[0201] S602, according to the decision result, the application process is awakened, and the application process is released or intercepted.

[0202] Specifically, the decision result can include allowing the application process to access the target file or not allowing the application process to access the target file. After the kernel receives the decision result, the application process is awakened, and when the decision result is to allow the application process to access the target file, the application process is released; when the decision result is not to allow the application process to access the target file, the application process is intercepted.

[0203] In the embodiment, the kernel suspends the monitored application process, sends process information of the application process to the monitoring process, judges whether the application process is trusted through the monitoring process, wakes up the application process according to the judgment result, and performs release or interception, which can effectively avoid the influence of malicious files on the safety of the application process and the system.

[0204] The application further provides an electronic device. The electronic device comprises a monitoring process, an application process and a kernel.

[0205] The kernel is configured to suspend the application process when detecting that the application process calls a file access interface, and send process information of the application process to the monitoring process; the application process is configured to access a target file, and the process information comprises a file path of the target file.

[0206] The monitoring process is configured to calculate an actual measurement value of the target file according to the process information, acquire an original measurement value of the target file from a trusted module, compare the actual measurement value with the original measurement value, and send a judgment result to the kernel.

[0207] The kernel is further configured to allow or reject the application process to access the target file according to the judgment result.

[0208] The electronic device is configured to execute the file access method provided in the above embodiment, and the specific implementation and beneficial effects are as described above, which will not be repeated here.

[0209] The application further provides an electronic device. The electronic device comprises a monitoring process, an application process and a kernel.

[0210] The kernel is configured to suspend the application process when detecting that the application process calls a file access interface, and send process information of the application process to the monitoring process; the application process is configured to access a target file, and the process information comprises a file path of the target file.

[0211] The monitoring process is configured to calculate an actual measurement value of the target file according to the process information, read a configuration file, the configuration file comprising a trusted module storage function identifier of the target file, acquire an original measurement value of the target file according to the trusted module storage function identifier, compare the actual measurement value of the target file with the original measurement value of the target file, and send a judgment result to the kernel.

[0212] The kernel is further configured to allow or reject the application process to access the target file according to the judgment result.

[0213] The electronic device is configured to execute the file access method provided in the above-mentioned embodiments, and the specific implementation manners and beneficial effects are as described above, which will not be repeated here.

[0214] FIG. 7 is a structural schematic diagram of another electronic device provided in an embodiment of the present application. As shown in FIG. 7, the electronic device includes a processor 291. The processor 291 is a unit of the electronic device, and the processor 291 can run an application process and a monitoring process. The electronic device also includes a memory 292, and can also include a communication interface 293, a bus 294, and a trusted module 15. The processor 291, the memory 292, the communication interface 293, and the trusted module 15 can communicate with each other through the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke a logical instruction in the memory 292 to execute the file access method provided in each of the above-mentioned method embodiments.

[0215] In addition, the logical instruction in the memory 292 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer readable storage medium.

[0216] The memory 292 is a computer readable storage medium, which can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present application. The processor 291 executes functions, applications, and data processing by running the software programs, instructions, and modules stored in the memory 292, that is, implements the methods in the above-mentioned method embodiments.

[0217] The memory 292 can include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required by a function; the data storage area can store data created by the terminal device in use, etc. In addition, the memory 292 can include a high-speed random access memory, and can also include a non-volatile memory.

[0218] The embodiments of the present application also provide a computer readable storage medium, which stores computer execution instructions. The computer execution instructions are executed by a processor to implement the method described in the above-mentioned embodiments.

[0219] The embodiments of the present application also provide a computer program product, which includes a computer program. The computer program is executed by a processor to implement the method provided in any of the above-mentioned embodiments of the present application.

[0220] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0221] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A file access method characterized by, The method comprises: receiving process information of an application process sent by a kernel, the application process being used to access a target file, the process information comprising a file path of the target file; calculating an actual metric value of the target file according to the process information; obtaining an original metric value of the target file from a trusted module; comparing the actual metric value and the original metric value, and sending a ruling result to the kernel to make the kernel wake up the application process and allow or reject the application process to access the target file.

2. A file access method characterized by, The method comprises: receiving process information of an application process sent by a kernel, the application process being used to access a target file, the process information comprising a file path of the target file; calculating an actual metric value of the target file according to the process information; obtaining a configuration file, the configuration file comprising a trusted module storage function identifier of the target file; obtaining an original metric value of the target file according to the trusted module storage function identifier; comparing the actual metric value of the target file and the original metric value of the target file, and sending a ruling result to the kernel to make the kernel allow or reject the application process to access the target file.

3. The file access method according to claim 2, characterized by, The method comprises: loading a configuration file, the configuration file comprising configuration information of at least one file, the configuration information comprising a file path and a trusted module storage function identifier, the trusted module storage function identifier being used to indicate a storage position of an original metric value of the file, the target file being one of the at least one file; when the trusted module storage function identifier indicates that the storage position is a trusted module, storing the original metric value of the file in the trusted module; when the trusted module storage function identifier does not indicate that the storage position is a trusted module, storing the original metric value of the file in the configuration file.

4. The file access method according to any one of claims 1 to 3, characterized by, The comparison of the actual metric value of the target file and the original metric value of the target file specifically comprises: when the actual metric value of the target file and the original metric value of the target file are the same, sending a first ruling result to the kernel to make the kernel allow the application process to access the target file; when the actual metric value of the target file and the original metric value of the target file are different, sending a second ruling result to the kernel to make the kernel reject the application process to access the target file.

5. The file access method according to any one of claims 1 to 4, characterized by, Before the receiving of the process information of the application process sent by the kernel, the method comprises: setting a hook function to make the kernel suspend an application process and return the process information of the application process when the kernel detects that the application process calls a file access interface; The comparison of the actual metric value of the target file and the original metric value of the target file, and the sending of a ruling result to the kernel to make the kernel allow or reject the application process to access the target file, comprises: the comparison of the actual metric value of the target file and the original metric value of the target file, and the sending of a ruling result to the kernel to wake up the application process to make the kernel allow or reject the application process to access the target file.

6. The file access method of claim 3, wherein, The method further comprises: The configuration information further comprises a file backup path; When the actual metric value is different from the original metric value, using the backup file under the file backup path to overwrite the file under the file path.

7. The file access method according to claim 6, characterized by, The method further comprises: The configuration information further comprises a file recovery function identifier; When the file recovery function identifier indicates to be turned on, when the actual metric value is different from the original metric value, using the backup file under the file backup path to overwrite the file under the file path.

8. The file access method according to any one of claims 6-7, characterized by, The configuration file further comprises a trusted module storage function identifier of a program file corresponding to the application process, and the method further comprises: According to the process information, calculating an actual metric value of the program file; According to the trusted module storage function identifier of the program file, obtaining an original metric value of the program file; Then the comparison of the actual metric value of the target file and the original metric value of the target file and the sending of a ruling result to the kernel to make the kernel allow or reject the application process to access the target file specifically comprises: When the actual metric value of the target file and the original metric value of the target file are the same, and the actual metric value of the program file and the original metric value of the program file are the same, a first ruling result is sent to the kernel to make the kernel allow the application process to access the target file; When the actual metric value of the target file and the original metric value of the target file are different, or the actual metric value of the program file and the original metric value of the program file are different, a second ruling result is sent to the kernel to make the kernel reject the application process to access the target file.

9. The file access method according to any one of claims 1 to 8, characterized by, The process information comprises a process identifier of the application process, and then the comparison of the actual metric value of the target file and the original metric value of the target file and the sending of a ruling result to the kernel to make the kernel allow or reject the application process to access the target file specifically comprises: Comparing the actual metric value of the target file and the original metric value of the target file and sending a ruling result to the kernel to make the kernel allow or reject the application process corresponding to the process identifier to access the target file, the ruling result comprising the process identifier.

10. An electronic device, comprising: Comprise: A processor, and a memory and a trusted module in communication connection with the processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to realize the method in any one of claims 1-9.

Images