CN120217436A

CN120217436A - Key file protection method and device based on custom directory tree

Info

Publication number: CN120217436A
Application number: CN202510324982.8A
Authority: CN
Inventors: 廖勇义; 孙夏声; 钟志超; 周楝淞; 庞飞; 王远强
Original assignee: CETC 30 Research Institute
Current assignee: CETC 30 Research Institute
Priority date: 2025-03-19
Filing date: 2025-03-19
Publication date: 2025-06-27

Abstract

The present application discloses a key file protection method and device based on a custom directory tree, which relates to the field of network security technology. The method and device initialize the root node of the top-level directory, obtain the path information of the key file to be protected, parse the path information to determine the directory names of each level corresponding to the key file, determine the target key file name in the directory name, traverse all levels of the path corresponding to the target key file name, enter the current directory when the directory name of the current level already exists, and recursively create a complete directory tree to protect the target key file. The method establishes a directory tree according to the key file path in the kernel to prevent the upper directory of the key file from being moved, thereby achieving security enhancement of the existing key file protection method.

Description

Key file protection method and device based on custom directory tree

Technical Field

The application relates to the technical field of network security, in particular to a key file protection method and device based on a custom directory tree.

Background

Critical files generally refer to files critical to the system, applications, and which may contain configuration settings, system code, or other important data.

In the related technology, the key files can be specified by a user, and an attacker can attack the system and the application program by means of tampering, deleting, replacing the key files and the like, so that the credibility of the system is reduced. Therefore, security protection against tampering, deletion, replacement of critical files is very necessary. For the Linux operating system, the existing method mainly realizes tamper resistance, deletion resistance and replacement resistance of the key files based on the Linux security framework LSM (Linux Security Module), but the existing scheme lacks protection of the upper-layer catalogue of the key files, so that the protection mechanism has the risk of being bypassed by an attacker.

Disclosure of Invention

In view of the above problems, the present application provides a method and an apparatus for protecting a key file based on a custom directory tree, which are capable of preventing an upper directory of a key file from being moved by creating a directory tree in a kernel according to a key file path, thereby realizing security enhancement of the existing method for protecting a key file.

In a first aspect, an embodiment of the present application provides a method for protecting a key file based on a custom directory tree, where the method for protecting a key file based on a custom directory tree includes:

Initializing a root node of a top-level directory, and acquiring path information of a key file to be protected;

Analyzing the path information to determine directory names of all levels corresponding to the key files;

Determining a target key file name in the directory names;

Traversing all levels of the path corresponding to the target key file name, entering the current directory under the condition that the directory name of the current level exists, and recursively creating a complete directory tree to protect the target key file.

In some embodiments, the protecting the target key file includes:

under the condition that the file moving event is determined to be carried out, determining the moving type of the file moving event;

And establishing a protection strategy based on the directory tree and the mobile type to protect the target key file.

In some embodiments, the key file protection method based on the custom directory tree further comprises:

Traversing all levels of the path corresponding to the target key file name, and creating corresponding nodes under the condition that the current level does not exist.

acquiring first path information of a key file needing to be canceled from protection;

Analyzing the first path information to determine first directory names of all levels corresponding to the unprotected key files;

determining a first target key file name in the directory names;

traversing from the lowest layer level to the top layer level, and judging the category of the level;

If the hierarchy is a file, deleting the node, and continuing traversing.

In some embodiments, the movement types include moving the target key file to a preset file, moving the target key file to a preset directory, and moving the target key directory to a target directory.

In some embodiments, the establishing a protection policy based on the directory tree and the mobile type to protect target critical files includes:

Determining a target key file according to the directory tree, and executing a first limiting condition under the condition that the moving type is determined to move the target key file to a preset file, wherein the first limiting condition prohibits moving the target key file to the preset file;

determining a target key file according to the directory tree, and executing a second limiting condition under the condition that the moving type is determined to move the target key file to a preset directory, wherein the second limiting condition prohibits the movement of the target key file;

And determining a target key directory according to the directory tree, and executing a third limiting condition in the condition that the target key directory is moved to the target directory by the determined movement type, wherein the third limiting condition prohibits triggering of the movement operation.

In some embodiments, the key file protection method based on the custom directory tree further includes:

if the hierarchy is a directory, ending the traversal process when determining that the directory has subdirectories or other files;

And deleting the nodes and continuing traversing processing under the condition that the directory is determined to have no subdirectories or other files.

In a second aspect, an embodiment of the present application provides a key file protection device based on a custom directory tree, including:

The acquisition module is used for initializing the root node of the top-level directory and acquiring path information of the key file to be protected;

The analyzing module is used for analyzing the path information to determine the directory names of all levels corresponding to the key files;

The determining module is used for determining target key file names in the directory names;

and the protection module is used for traversing all levels of the path corresponding to the target key file name, entering the current directory under the condition that the directory name of the current level exists, and recursively creating a complete directory tree to protect the target key file.

In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, where the memory stores program code that can be executed on the processor, and when the program code is executed by the processor, the method for protecting a key file based on a custom directory tree according to any one of the embodiments of the first aspect is implemented.

In a fourth aspect, an embodiment of the present application provides a computer storage medium, where one or more programs are stored, where the one or more programs may be executed by an electronic device as described in the third aspect, to implement a key file protection method based on a custom directory tree as described in any one of the embodiments of the first aspect.

According to the key file protection method and device based on the custom directory tree, path information of key files to be protected is obtained by initializing root nodes of top-level directories, path information is analyzed to determine directory names of all levels corresponding to the key files, target key file names in the directory names are determined, all levels of paths corresponding to the target key file names are traversed, under the condition that the directory names of the current levels exist, the current directory is entered, a complete directory tree is recursively created to protect the target key files, the purpose that the upper-level directory of the key files is moved by establishing the directory tree in a kernel according to the key file paths is achieved, and therefore safety enhancement of the existing key file protection method is achieved.

It should be understood that the description in this section is not intended to identify key or critical features of the embodiments of the application or to delineate the scope of the application. Other features of the present application will become apparent from the description that follows.

Drawings

The application will be described in more detail hereinafter on the basis of embodiments and with reference to the accompanying drawings.

FIG. 1 is a schematic flow chart of a method for protecting a key file based on a custom directory tree according to an embodiment of the present application;

FIG. 2 illustrates an exemplary directory tree creation flow diagram set forth in an embodiment of the application;

FIG. 3 illustrates an exemplary directory tree deletion flow diagram set forth in one embodiment of the present application;

FIG. 4 illustrates an exemplary directory tree structure presented in an embodiment of the application;

FIG. 5 illustrates a block diagram of an exemplary custom directory tree based key file guard in accordance with an embodiment of the present application;

FIG. 6 is a block diagram of an electronic device for executing a key file protection method based on a custom directory tree according to an embodiment of the present application;

FIG. 7 illustrates a computer-readable storage medium for storing or carrying a key file protection method for implementing a custom directory tree based key file protection method according to an embodiment of the present application.

Detailed Description

For the purpose of making apparent the objects, technical solutions and advantages of the present invention, the present invention will be further described in detail with reference to the following examples and the accompanying drawings, wherein the exemplary embodiments of the present invention and the descriptions thereof are for illustrating the present invention only and are not to be construed as limiting the present invention.

In the Linux operating system, the existing scheme mainly uses a hook function in a Linux security framework LSM (Linux Security Module), can intercept operations such as reading, modifying, deleting and replacing any file, and by comparing the absolute path of the file with the path of a key file, the absolute path of the file is identical to the path of the key file, and if the absolute path of the file is identical to the path of the key file, the operation such as modifying, deleting and replacing the file is not allowed, so that functions such as tamper resistance, deletion resistance and replacement resistance are realized.

By analyzing the technical problems, the applicant researches find that the existing scheme lacks of controlling the upper-level catalogue of the key file, so that an attacker can realize the operations of tampering, deleting and replacing the key file by moving the upper-level catalogue of the key file, thereby bypassing the existing safety protection method.

The invention provides a key file protection enhancement method based on a custom directory tree, which is characterized in that a directory tree is established in a kernel according to a key file path to prevent an upper directory of a key file from being moved, so that the safety enhancement of the existing key file protection method is realized.

By analyzing and combining the technical problems, the inventor provides a key file protection method and device based on a custom directory tree, which can effectively solve the problem of security deficiency caused by lack of upper-level directory management and control of key files in the existing key file protection system by constructing the key file directory tree and an effective matching strategy, and can ensure that the upper-level directory of the key file is not moved by constructing the custom directory tree, thereby avoiding the risk that an attacker bypasses a protection mechanism by moving the directory, and can more accurately control the movement and renaming operation of the file, thereby providing more strict protection. The key file protection method based on the custom directory tree is described in detail in the following embodiments.

The following describes an application scenario of a key file protection method based on a custom directory tree according to an embodiment of the present application:

Referring to fig. 1, fig. 1 is a schematic flow chart of a method for protecting a key file based on a custom directory tree according to an embodiment of the present application, in this embodiment, the method for protecting a key file based on a custom directory tree may be applied to a device 300 shown in fig. 4 and an electronic device 200 shown in fig. 5, where the electronic device may include one or more electronic devices, and information may be transmitted between the electronic devices in a wireless and/or wired manner, and the electronic devices may cooperate to complete the method for protecting a key file based on a custom directory tree, and an exemplary electronic device may include a computer, a mobile terminal, a tablet, etc., which is not limited by the present application. As will be described in detail below with respect to the flow shown in FIG. 1, the method for protecting key files based on the custom directory tree may include S110 to S140.

S110, initializing a root node of the top-level directory, and acquiring path information of the key files to be protected.

S120, analyzing the path information to determine the directory names of all levels corresponding to the key files.

S130, determining the target key file name in the directory names.

And S140, traversing all levels of the path corresponding to the target key file name, entering the current directory under the condition that the directory name of the current level exists, and recursively creating a complete directory tree to protect the target key file.

In the embodiment of the application, referring to fig. 2, an exemplary directory tree creation flow chart is provided in the embodiment of the application, firstly, a kernel initializes a top directory "/" root node, then, a user configures a key file path to be protected, secondly, the kernel analyzes the directory name of each level, such as "/root/dir1/1.Txt", into four levels including "/", "root", "dir1", "1.Txt", wherein leaf nodes "1.Txt" of the directory tree are final key file names, finally, all levels of the key file path are traversed, if the current level does not exist, corresponding nodes are created, if the directory name of the current level exists, the user enters the directory, a complete directory tree is recursively created, and an exemplary directory tree structure can refer to an exemplary directory tree structure chart shown in fig. 4.

In some embodiments, the key file protection method based on the custom directory tree further includes S141 to S142.

S141, in the case of determining to carry out the file moving event, determining the moving type of the file moving event.

And S142, establishing a protection strategy based on the directory tree and the mobile type to protect the target key file.

In the embodiment of the application, in order to realize that the key files and the common files are further distinguished, the key directory and the common directory, wherein the key files are files configured or designated by a user, and the key directory refers to an upper directory containing the key files. Therefore, for the three mobile types, different directory tree matching strategies are adopted in the scheme, so that the key files and the upper-level directories can be effectively prevented from being illegally moved.

The file renaming hook function implementation is realized by matching directory trees and depends on the Linux file system, and the hook function can intercept all mobile events of the Linux file system. In practice, the movement event of Linux mainly includes the following three types.

One type, moving from File A to File B, renaming/overwriting operation of a file renames File A to File B, and overwriting File B if present.

Another type, moving from file a to directory a, a file move operation, moves file a under directory a.

Yet another type, a rename/move operation to move from directory A to directory B, rename directory A to directory B, and if directory B exists, then directory A is considered a lower subdirectory of directory B.

In some embodiments, S142 includes S1421 to S1423, wherein:

s1421, determining a target key file according to a directory tree, and executing a first limiting condition under the condition that the target key file is moved to a preset file by the determined movement type, wherein the first limiting condition prohibits the movement of the target key file to the preset file;

S1422, determining a target key file according to the directory tree, and executing a second limiting condition under the condition that the moving type is determined to move the target key file to a preset directory, wherein the second limiting condition prohibits the moving of the target key file;

s1423, determining a target key directory according to the directory tree, and executing a third limiting condition when the target key directory is moved to the target directory by the determined movement type, wherein the third limiting condition prohibits triggering of the movement operation.

In this embodiment, for one type of processing method described above, the moving event of this type is prohibited, regardless of whether the file a or the file B is a key file. The strategy can directly and effectively prevent the key file from being renamed or covered, and forbid the movement if the file A is the key file for the other type of processing mode. The strategy can effectively prevent the key file from being moved to other catalogs and is separated from the protection of the original key file protection system, in addition, the strategy allows the common file to be moved to the key file catalogs, the influence on the system can be effectively reduced, and for the processing mode of the other type, if the catalogue A is the key catalogue, the moving operation is forbidden. The strategy can effectively prevent the key directory from moving or renaming, and prevent the key files in the lower-level directory from being separated from the protection of the existing key file protection system.

Consider that to cancel the guard for the target key file for which the guard is set.

In some embodiments, the key file protection method based on the custom directory tree further includes S210 to S250, wherein:

s210, acquiring first path information of a key file needing to be canceled for protection;

S220, analyzing the first path information to determine first directory names of all levels corresponding to the key files which are not protected;

s230, determining a first target key file name in the directory names;

S240, traversing from the lowest layer level to the top layer level, and judging the category of the layer level;

and S250, deleting the nodes if the hierarchy is a file, and continuing traversing processing.

In some embodiments, the key file protection method based on the custom directory tree further includes S260 to S270, wherein:

If the hierarchy is a directory, if it is determined that the directory has a subdirectory or another file, the traversal process is terminated.

And S270, deleting the nodes and continuing traversing processing when determining that the directory does not have subdirectories or other files.

In the embodiment of the application, the key file directory tree is deleted based on the key file path defined by the user, the specific flow of directory tree deletion is shown in fig. 3, and fig. 3 is a schematic diagram of an exemplary directory tree deletion flow provided in the embodiment of the application. Firstly, configuring a key file path needing to cancel protection by a user, then analyzing the key path by a kernel to analyze the directory name of each level, for example "/root/dir1/1.Txt", analyzing into four levels: "/", "root", "dir1", "1.Txt", wherein leaf nodes "1.Txt" of a directory tree are final key file names, and finally traversing from the lowest level, directly deleting the node if the current level is a file, judging whether other subdirectories or files exist under the directory if the current level is a directory, directly returning if the current level is a directory, deleting the directory if the current level is not a directory, and continuing traversing.

According to the application, the problem of security deficiency caused by lack of upper-level directory management and control of the key files in the existing key file protection system can be effectively solved by constructing the key file directory tree and the effective matching strategy in the kernel.

Firstly, by constructing a custom directory tree, it can be ensured that the upper directory of the key file is not moved, thereby avoiding the risk that an attacker bypasses the protection mechanism by moving the directory.

Secondly, by distinguishing the key file from the common file, the key directory from the common directory and adopting different matching strategies, the invention can more accurately control the movement and renaming operation of the file, thereby providing more strict protection.

The invention provides a key file protection method, a device, electronic equipment and a storage medium based on a custom directory tree, which can effectively control the mobile operation of a superior directory of a key file and has important practical application value for improving the safety and the credibility of a system.

Referring to fig. 4, fig. 4 is a block diagram of a key file protection device based on a custom directory tree, where the key file protection device 300 based on a custom directory tree includes an obtaining module 310, an analyzing module 320, a confirming module 330, and a protection module 340, where:

and the obtaining module 310 is configured to initialize a root node of the top-level directory, and obtain path information of the key file to be protected.

The parsing module 320 is configured to parse the path information to determine directory names of each hierarchy corresponding to the key file.

A confirmation module 330, configured to determine a target key file name in the directory name.

The protection module 340 is configured to traverse all levels of the target key file name corresponding path, enter the current directory if the directory name of the current level already exists, and recursively create a complete directory tree to protect the target key file.

Embodiments of the present application may also include other modules, corresponding specifically to portions of the methods described above.

It should be noted that, in the present application, the device embodiment corresponds to the foregoing method embodiment, and specific principles in the device embodiment may refer to the content in the foregoing method embodiment, which is not described herein again.

In several embodiments provided in this embodiment, the modules may be electrically, mechanically, or otherwise coupled to each other.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module. The integrated modules may be implemented in hardware or in software functional modules.

Referring to fig. 5, fig. 5 is a block diagram of an electronic device 200 capable of executing the above-mentioned key file protection method based on a custom directory tree according to an embodiment of the present application, where the electronic device 200 may be a smart phone, a tablet computer, a computer or a portable computer.

The electronic device 200 also includes a processor 202 and a memory 204. The memory 204 stores therein a program capable of executing the contents of the foregoing embodiments, and the processor 202 can execute the program stored in the memory 204.

Processor 202 may include one or more cores for processing data and a message matrix unit, among other things. The processor 202 utilizes various interfaces and lines to connect various portions of the overall electronic device 200, perform various functions of the electronic device 200, and process data by executing or executing instructions, programs, code sets, or instruction sets stored in the memory 204, and invoking data stored in the memory 204. Alternatively, the processor 202 may be implemented in at least one hardware form of digital signal Processing (DIGITAL SIGNAL Processing, DSP), field-Programmable gate array (Field-Programmable GATE ARRAY, FPGA), editable logic array (Programmable Logic Array, PLA). The processor 202 may integrate one or a combination of several of a central processing unit (Central Processing Unit, CPU), an image processor (Graphics Processing Unit, GPU), and a modulation decoder, etc. The CPU mainly processes an operating system, a user interface, an application program and the like, the GPU is used for rendering and drawing display contents, and the modem is used for processing wireless communication. It will be appreciated that the above described modulation decoder may not be integrated into the processor and may be implemented solely by a single communication chip.

Memory 204 may include random access Memory (Random Access Memory, RAM) or Read-Only Memory (ROM). Memory 204 may be used to store instructions, programs, code sets, or instruction sets. The memory 204 may include a stored program area and a stored data area, wherein the stored program area may store instructions for implementing an operating system, instructions for implementing at least one function (e.g., instructions for a user to obtain a random number), instructions for implementing various method embodiments described below, and the like. The stored data area may also store data (e.g., random numbers) created by the terminal in use, and so on.

The electronic device 200 may further include a network module and a screen, where the network module is configured to receive and transmit electromagnetic waves, and implement mutual conversion between the electromagnetic waves and the electrical signals, so as to communicate with a communication network or other devices, such as an audio playing device. The network module may include various existing circuit elements for performing these functions, such as an antenna, a radio frequency transceiver, a digital signal processor, an encryption/decryption chip, a Subscriber Identity Module (SIM) card, memory, and the like. The network module may communicate with various networks such as the internet, intranets, wireless networks, or with other devices via wireless networks. The wireless network may include a cellular telephone network, a wireless local area network, or a metropolitan area network. The screen may display interface content and perform data interaction.

Referring to fig. 6, fig. 6 is a block diagram illustrating a computer readable storage medium according to an embodiment of the application. The computer readable storage medium 400 has stored therein program code 410, the program code 410 being executable by a processor to perform the method described in the above method embodiments.

The computer readable storage medium 400 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium comprises a non-volatile computer readable medium (non-transitory computer-readable storage medium). The computer readable storage medium 400 has storage space for program code 410 that performs any of the method steps described above. These program code 410 can be read from or written to one or more computer program products. Program code 410 may be compressed, for example, in a suitable form.

Embodiments of the present application also provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the custom directory tree based key file protection method described in the various alternative implementations above.

Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that modifications may be made to the technical solutions described in the foregoing embodiments or equivalents may be substituted for some of the technical features thereof, and these modifications or substitutions do not drive the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. The key file protection method based on the custom directory tree is characterized by comprising the following steps:

Determining a target key file name in the directory names;

2. The method for protecting a key file based on a custom directory tree according to claim 1, wherein the protecting the target key file comprises:

3. The custom directory tree based key file protection method in accordance with claim 1, further comprising:

4. The custom directory tree based key file protection method in accordance with claim 1, further comprising:

determining a first target key file name in the directory names;

If the hierarchy is a file, deleting the node, and continuing traversing.

5. The method of claim 2, wherein the moving type includes moving the target key file to a preset file, moving the target key file to a preset directory, and moving the target key directory to a target directory.

6. The custom directory tree based key file protection method as claimed in claim 5, wherein said establishing a protection policy based on said directory tree and said mobile type to protect a target key file comprises:

7. The custom directory tree based key file protection method as claimed in claim 4, further comprising:

8. A custom directory tree based key file guard, the apparatus comprising:

9. An electronic device comprising a memory and a processor, wherein the memory has stored thereon program code executable on the processor, which when executed by the processor, implements the custom directory tree based key file protection method of any of claims 1-7.

10. A computer readable storage medium storing program code that is callable by one or more processors to perform the custom directory tree based key file protection method according to any one of claims 1-7.