CN114662090A - File processing method, device, storage medium and system - Google Patents

Abstract

The invention discloses a file processing method, a file processing device, a storage medium and a file processing system. Wherein, the method comprises the following steps: judging the security attribute of the target file to obtain a judgment result; when the safety attribute is determined to not meet the preset condition through the judgment result, isolating the target file into the sandbox environment; in a sandbox environment, a target control strategy matched with a target file is obtained, and authority control is conducted on the target file based on the target control strategy. The invention solves the technical problems of insufficient system support, poor processing effect and low flexibility of a method for processing the risk file by using a process injection sandbox or a system sandbox in the related technology.

Description

File processing method, device, storage medium and system

technical field

The present invention relates to the field of computer technology, and in particular, to a file processing method, device, storage medium and system.

Background technique

In the software used by the user in the computer operating system, there may be unknown software, such as: rogue software, ransomware, backdoor network virus, Trojan horse program, etc. Once these unknown software runs on the computer, uncontrollable situations may occur or even lead to serious adverse consequences. In this regard, before running the unknown software, the security must be judged on the software. For unknown software whose security cannot be judged, the sandbox container isolation operation method is usually used for processing.

In the related art, there are mainly the following two sandbox solutions for processing unknown software.

The first: a sandbox solution based on process injection. The target process is injected into the sandbox, and a hook function (HOOK) is used in the target process to process a specific system application programming interface, thereby realizing the permission control and access redirection of the target process. This scheme is lightweight and easy to redirect to the environment. However, its drawbacks are: the injection operation reduces the system stability; there are risks and the processing effect is poor (the target process may be found through HOOK detection and bypass the sandbox environment) ).

The second: a sandbox solution based on Windows Hyper-V. With Windows 10 Build 18305 and later professional operating systems adding support for sandboxes, users can run unknown programs in the system sandbox. This solution has strong stability, however, its shortcomings are: it cannot meet all system versions, lack of support; cannot realize sandbox strategy customization, and has low flexibility.

For the above problems, no effective solution has been proposed yet.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a file processing method, device, storage medium, and system, so as to at least solve the method for processing risk files using process injection sandbox or system sandbox in the related art, which has insufficient system support, poor processing effect, and flexibility. low-quality technical issues.

According to an aspect of the embodiments of the present invention, a file processing method is provided, which includes: judging the security attribute of a target file, and obtaining a judgment result; when it is determined by the judgment result that the security attribute does not meet a preset condition, isolating the target file Go to the sandbox environment; in the sandbox environment, obtain the target control policy matching the target file, and control the permissions of the target file based on the target control policy.

According to another aspect of the embodiments of the present invention, there is also provided a file processing method, comprising: receiving a target file from a client; judging the security attribute of the target file to obtain a judgment result, when it is determined by the judgment result that the security attribute is not When the preset conditions are met, the target file is isolated to the sandbox environment. In the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. A notification message is returned to the client, Among them, the notification message is used to notify that the target file is isolated to the sandbox environment and the rights are controlled according to the target management and control policy.

According to another aspect of the embodiments of the present invention, a file processing apparatus is also provided, including: a determination module, configured to determine the security attribute of a target file to obtain a determination result; an isolation module, configured to determine the security according to the determination result When the attribute does not meet the preset conditions, the target file is isolated to the sandbox environment; the processing module is used to obtain the target control policy matching the target file in the sandbox environment, and control the permissions of the target file based on the target control policy.

According to another aspect of the embodiments of the present invention, a storage medium is further provided, where the storage medium includes a stored program, wherein when the program runs, the device where the storage medium is located is controlled to execute any one of the above-mentioned file processing methods.

According to another aspect of the embodiments of the present invention, a file processing system is also provided, including: a processor; and a memory, connected to the above-mentioned processor, for providing the above-mentioned processor with instructions for processing the following processing steps: Determine the security attributes of the target file, and obtain the judgment result; when it is determined that the security attribute does not meet the preset conditions through the judgment result, isolate the target file to the sandbox environment; in the sandbox environment, obtain the target control policy matching the target file, and Permissions are controlled for target files based on target management and control policies.

In the embodiment of the present invention, firstly, the security attribute of the target file is judged to obtain the judgment result, and then it is determined whether the security attribute meets the preset condition according to the judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target The file is isolated to the sandbox environment, and then in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. The purpose is to achieve the technical effect of reducing the use risk of target files and improving system security with a flexible and stable solution, and then solve the method of processing risk files using process injection sandbox or system sandbox in related technologies. Its system support Inadequate, poor handling, and low flexibility of technical issues.

Description of drawings

The accompanying drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the attached image:

1 shows a block diagram of the hardware structure of a computer terminal (or mobile device) for implementing a file processing method;

2 is a flowchart of a file processing method according to an embodiment of the present invention;

3 is a schematic diagram of an optional process for processing unknown files according to an embodiment of the present invention;

4 is a flowchart of another file processing method according to an embodiment of the present invention;

5 is a schematic diagram of file processing performed on a cloud server according to an embodiment of the present invention;

6 is a schematic structural diagram of a file processing apparatus according to an embodiment of the present invention;

7 is a schematic structural diagram of another file processing apparatus according to an embodiment of the present invention;

8 is a schematic structural diagram of another file processing apparatus according to an embodiment of the present invention;

FIG. 9 is a structural block diagram of another computer terminal according to an embodiment of the present invention.

Detailed ways

In order to make those skilled in the art better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only Embodiments are part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first", "second" and the like in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used may be interchanged under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having" and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed Rather, those steps or units may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

First of all, some nouns or terms appearing in the process of describing the embodiments of the present invention are suitable for the following explanations:

Malicious program: refers to an unknown program that has no legal signature, or has unknown behaviors, or has known malicious behaviors (for example, file theft, screen capture, user information theft, etc.).

Sandbox: A virtual container on a computer that provides an isolated environment for running programs. Sandbox technology is a security mechanism in the field of computer security.

Example 1

According to an embodiment of the present invention, an embodiment of a file processing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer-executable instructions, and although A logical order is shown in the flowcharts, but in some cases steps shown or described may be performed in an order different from that herein.

The method embodiment provided in Embodiment 1 of the present invention may be executed in a mobile terminal, a computer terminal, or a similar computing device. FIG. 1 shows a block diagram of the hardware structure of a computer terminal (or mobile device) for implementing a file processing method. As shown in FIG. 1, the computer terminal 10 (or the mobile device 10) may include one or more processors 102 (represented by 102a, 102b, . processing means such as a processor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission means 106 for communication functions. In addition, it can also include: a monitor, a keyboard, a cursor control device (such as a mouse), an input/output interface (I/O interface), a universal serial bus (USB) port (which can be used as one of the ports of the BUS bus) included), network interface, power supply and/or camera. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only a schematic diagram, which does not limit the structure of the above electronic device. For example, the computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

It should be noted that the one or more processors 102 and/or other data processing circuits described above may generally be referred to herein as "data processing circuits." The data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination. Furthermore, the data processing circuitry may be a single stand-alone processing module, or incorporated in whole or in part into any of the other elements in the computer terminal 10 (or mobile device). As referred to in the embodiments of the present invention, the data processing circuit acts as a kind of processor control (eg, selection of a variable resistance termination path connected to an interface).

The memory 104 can be used to store software programs and modules of application software, such as a program instruction/data storage device corresponding to the file processing method in the embodiment of the present invention, the processor 102 executes the software programs and modules stored in the memory 104 by running Various functional applications and data processing implement the above-mentioned file processing method. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, memory 104 may further include memory located remotely from processor 102, which may be connected to computer terminal 10 through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

Transmission means 106 are used to receive or transmit data via a network. A specific example of the above-mentioned network may include a wireless network provided by a communication provider of the computer terminal 10 . In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF) module, which is used for wirelessly communicating with the Internet.

The display may be, for example, a touch screen type liquid crystal display (LCD) that enables a user to interact with the user interface of the computer terminal 10 (or mobile device).

It should be noted here that, in some optional embodiments, the computer device (or mobile device) shown in FIG. 1 may include hardware elements (including circuits), software elements (including a computer stored on a computer-readable medium) code), or a combination of both hardware and software elements. It should be noted that FIG. 1 is only one example of a specific embodiment, and is intended to illustrate the types of components that may be present in a computer device (or mobile device) as described above.

Under the above operating environment, the present invention provides a file processing method as shown in FIG. 2 . FIG. 2 is a flowchart of a file processing method according to an embodiment of the present invention. As shown in FIG. 2 , the file processing method includes:

Step S202, judging the security attribute of the target file to obtain a judgment result;

Step S204, when it is determined by the judgment result that the security attribute does not meet the preset condition, isolate the target file into a sandbox environment;

Step S206 , in the sandbox environment, obtain a target management and control policy matching the target file, and perform authority management and control on the target file based on the target management and control policy.

Optionally, in the above-mentioned embodiment, the target file may be an unknown file, program, tool, etc. downloaded by the user from the network, or it may be when the user is attacked by attack methods such as "phishing email" and "water hole attack". Acquired attack tool.

Optionally, in the above embodiment, the target file may be safe, malicious or risky. The security attribute of the target file can be used to characterize whether the target file is secure. The security attribute may be determined by the name, type, size, content, etc. of the target file.

Optionally, in the above embodiment, the determination result of the security attribute may be a result of determining the security attribute of the target file according to a preset security determination rule. For example, in a practical application scenario, the result may include: safe, low risk, medium risk, high risk, undecidable, etc.

Optionally, in the above embodiment, the preset condition may be used to determine whether to isolate the target file into the sandbox environment. For example: in a practical application scenario, the preset condition may be "files judged to be safe do not need to be quarantined", or "files judged to be safe and low-risk do not need to be quarantined", or "files judged to be safe do not need to be quarantined" The files do not need to be quarantined, and the files that are judged to be at risk (including low risk, medium risk, and high risk) are directly deleted” and so on.

Optionally, in the above embodiment, the target management and control policy may be used to manage and control the authority of the target file in the sandbox environment. The target management and control policy matches the target file, and may be a management and control policy preset by the user for the target file, or may be a management and control policy automatically generated by the system for the target file according to the preset management and control policy rules. In the sandbox environment, the target control policy matching the target file can be obtained, and the permissions of the target file can be controlled based on the target control policy.

It should be noted that the sandbox environment may be a sandbox in a computer that provides a restricted security environment for program execution. For example, the sandbox can provide disk and memory space that is reclaimed after use for the program to run, and restrict the code access, network access and other permissions granted to the program in the sandbox environment. All changes made by programs running in the sandbox do no harm to the operating system.

In the embodiment of the present invention, firstly, the security attribute of the target file is judged to obtain the judgment result, and then it is determined whether the security attribute meets the preset condition according to the judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target The file is isolated to the sandbox environment, and then in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. The purpose is to achieve the technical effect of reducing the use risk of target files and improving system security with a flexible and stable solution, and then solve the method of processing risk files using process injection sandbox or system sandbox in related technologies. Its system support Inadequate, poor handling, and low flexibility of technical issues.

Optionally, the above-mentioned file processing method provided by the present invention can be applied, but not limited to, any application scenario involving computer security in the fields of health, language, society, science, art, etc. using office networks, internal networks, and production networks.

In particular, usually in application scenarios involving computer security, a security environment, such as an internal network, an isolated network, and an isolated device, will be set up. However, unknown programs or unknown files may also be encountered in the security environment, for which the processing methods provided by the prior art are delayed (for example, the security attributes of the unknown programs or unknown files cannot be determined in time), that is, the unknown Programs or unknown files can still perform malicious activities within the secure environment set by the user. One of the beneficial effects of the methods provided by the embodiments of the present invention may be to solve the above problems.

In an optional embodiment, in step S202, the security attribute is determined to obtain a determination result, including the following method steps:

Step S221, determining whether the target file belongs to a preset whitelist or a preset blacklist based on the security attribute;

Step S222, when the target file belongs to the preset whitelist or the preset blacklist, determine that the result of the determination is that the security attribute satisfies the preset condition;

Step S223, when the target file does not belong to the preset whitelist and the preset blacklist, it is determined that the determination result is that the security attribute does not meet the preset condition.

Optionally, in the above embodiment, the preset whitelist may be a preset list of files considered as safe files; the preset blacklist may be a preset list of files considered as risky files. Both the preset whitelist and the preset blacklist may be file lists specified based on various attributes of the files.

For example: in a practical application scenario, the conditions for determining that a file belongs to the preset whitelist may include at least one of the following: the file name is one or more specified file names; the file type is one or more specified file types; the file size belongs to One or more specified thresholds; the file contents do not contain any of the specified contents.

For example: in a practical application scenario, the conditions for determining that a file belongs to the preset blacklist may include at least one of the following: the file name is one or more specified file names; the file type is one or more specified file types; the file size belongs to One or more specified thresholds; any of several specified contents are included in the file content.

Optionally, in the above embodiment, the preset condition may be "based on the security attribute of the target file, it can be determined that the target file belongs to the preset whitelist or the preset blacklist". Therefore, when the target file is determined to belong to the preset whitelist or the preset blacklist, the corresponding determination result is that the security attributes of the target file meet the preset conditions; When it does not belong to the preset blacklist, the corresponding determination result is that the security attribute of the target file does not meet the preset condition.

It should be noted that, if the determination result is that the security attribute of the target file satisfies the preset condition, it means that the security of the target file is known (may include: safe and risky). The determination result is that the security attribute of the target file does not meet the preset conditions, indicating that the security of the target file is unknown, and the target file with unknown security must be isolated and run in a sandbox environment to avoid risks.

FIG. 3 is a schematic diagram of an optional process for processing unknown files according to an embodiment of the present invention. As shown in FIG. 3 , the file determination system may include a whitelist determination system and a blacklist determination system. The file determination system is used to perform black and white determination on the to-be-executed file (determine whether the to-be-executed file belongs to a whitelist or a blacklist, and the whitelist and blacklist may be preset by the user).

Still as shown in Figure 3, in the case that the file determination system cannot perform black and white determination on the file to be executed (for example: the file to be executed does not belong to the whitelist and blacklist, or it is difficult to determine whether the file to be executed belongs to the whitelist and blacklist, etc. ), the file determination system will input the to-be-executed file into the sandbox system. The sandbox system will control the permissions of the file to be executed in the sandbox environment.

In an optional embodiment, the file processing method further includes the following method steps:

Step S208, pulling multiple candidate management and control strategies from the cloud server;

Step S210, analysing a plurality of candidate management and control strategies to obtain an analysis result;

Step S212, the analysis result is stored in a storage area associated with the sandbox environment.

Optionally, in the above-mentioned embodiment, the multiple candidate management and control policies may be stored in multiple management and control policies of the cloud server for managing and controlling file permissions. The multiple candidate management and control strategies may be pre-generated by the system and stored in the cloud server, or may be pre-specified by a technician and uploaded to the cloud server.

Optionally, in the above-mentioned embodiment, the above-mentioned multiple candidate management and control policies are pulled from the cloud server to the local device. The local device can analyze the multiple candidate management and control policies, and then obtain the analysis result. The parsing result is stored in the storage area associated with the sandbox environment, so that the parsing result can be retrieved in the sandbox environment.

Still as shown in Figure 3, in the sandbox system, cloud policy pull can be performed. The cloud policy pull may include policy pull and policy integration. The policy pull can be to obtain the latest version of each of the multiple rights management policies from the cloud server. Policy integration may be to integrate multiple rights management and control policies pulled from the cloud server according to preset integration rules. The preset integration rule can be used to integrate multiple policies into a specified order or a specified format.

Still as shown in Figure 3, in the sandbox system, policy parsing is possible. The policy parsing may include parsing each of the multiple permission management and control policies. The parsing of a permission management and control policy may be to parse the permission management and control policy into a plurality of corresponding management and control commands.

Still as shown in Figure 3, in a sandboxed system, policy storage is possible. The policy storage may be to store multiple management and control commands (equivalent to the above analysis results) corresponding to each of the multiple rights management and control policies in a storage area in the sandbox system. The policy storage may also be to store multiple rights management and control policies and multiple management and control commands corresponding to each of the rights management and control policies (equivalent to the above analysis results) in a storage area in the sandbox system.

In addition, still as shown in Figure 3, in the sandbox system, policy validity verification can also be performed. Specifically, after the policy is stored, the legality of multiple rights management and control policies stored in the storage area in the sandbox system is verified according to preset legality verification rules. The preset legality verification rule may be pre-specified by a technician according to an actual application scenario.

In particular, when verifying the legality of the policy, the legal authority management and control policies stored in the storage area may be retained, and the illegal authority management and control policies stored in the storage area may be deleted.

In an optional embodiment, in step S206, acquiring the target management and control policy matched by the target file includes the following method steps:

Step S261, obtaining the index information of the target file;

Step S262, based on the index information of the target file, obtain a target management and control policy matching the index information from the analysis result stored in the storage area.

Optionally, in the above embodiment, the index information of the target file may be information used to match a management and control policy for the target file. Obtaining the index information of the target file may be selecting at least one field from a plurality of fields corresponding to the target file. For example, the index information of the target file may be the file name, file type, etc. of the target file. For another example, when the target file is an unknown program, the index information may be a process name corresponding to the unknown program.

Optionally, in the above embodiment, based on the index information of the target file, the target management and control policy matching the index information may be obtained from the analysis result stored in the storage area. The storage area is associated with the sandbox environment, and the analysis result corresponds to the analysis corresponding to the above-mentioned multiple candidate management and control policies. The target management and control policy may be a management and control policy to be executed on the target file in the sandbox environment.

Still as shown in Figure 3, in a sandboxed system, policy matching is possible. When the target file is an unknown program, the process name (equivalent to the above-mentioned index information) corresponding to the unknown program can be obtained as an index, and the unknown program is matched with the to-be-used authority control policy (equivalent to the above-mentioned target control policy).

Specifically, the above-mentioned matching process may include: accessing a storage area in the sandbox system, obtaining multiple rights management and control policies stored in the storage area and multiple management and control commands corresponding to each of the rights management and control policies (equivalent to the above-mentioned analysis results) ; According to the process name corresponding to the unknown program, determine the authority control policy corresponding to the unknown program.

In an optional embodiment, the file processing method further includes the following method steps:

Step S214, when it is determined that no target management and control strategy matching the index information is found in the analysis result, the default management and control strategy is determined as the target management and control strategy.

Optionally, in the foregoing embodiment, the foregoing default management and control strategy may be a management and control strategy pre-specified by a technician according to an actual application scenario.

Optionally, in the above-mentioned embodiment, when the target management and control strategy that matches the index information of the target file cannot be found from the above analysis result, it indicates that the strategy matching for the target file fails, and at this time, the above-mentioned default management and control can be The policy is determined as the target control policy for the target file. The target management and control policy may be a management and control policy to be executed on the target file in the sandbox environment.

Optionally, when the index information of the target file is empty, the policy matching cannot be performed for the target file. In this case, the default management and control policy may also be determined as the target management and control policy of the target file.

In addition, the cloud server can also issue specific control policies for specific files or programs in the sandbox environment. For example, for the unknown program a.exe in the sandbox environment, the control policy issued by the cloud server is "can't read desktop files, and can't write files to the desktop". The policy system will parse and store the control policy on the local device.

In an optional embodiment, in step S206, performing authority control on the target file based on the target management and control policy includes at least one of the following method steps:

Step S263, performing file authority control on the target file based on the target management and control policy;

Step S264, performing process authority control on the target file based on the target management and control policy;

Step S265, performing registry authority control on the target file based on the target management and control policy;

Step S266, performing network access authority control on the target file based on the target management and control policy.

Optionally, in the above embodiment, the target management and control policy may be a management and control policy to be executed on the target file in the sandbox environment. In the sandbox environment, the right item management and control on the above target file based on the target management and control policy may include at least one of the following: file permission management and control, process permission management and control, registry permission management and control, and network access permission management and control.

Specifically, the file permission control may be to manage and control the operable permissions of the target file to some or all of the files in the local file system (including reading or changing file content). Process authority control may be to control the process corresponding to the target file and the authority that it occupies system resources. Registry permission control can be to control the permission of the target file to access and modify the registry. The network access authority control may be to control the authority of the target file to access the network (which may include office network, internal network, production network, etc.) (which may include permitted access, partially restricted access, all restricted access, etc.).

Still as shown in Figure 3, the sandbox system may also include a process creation agent module. After the policy system determines the to-be-used authority control policy for the target file, the process creation agent module can create a process for the target file and run the target file.

Still as shown in Figure 3, in the sandbox system, permissions can also be controlled. The permission management and control may include file permission management and control, process permission management and control, registry permission management and control, and network permission management and control.

Still taking the unknown program a.exe as an example, the sandbox system creates a corresponding process for the unknown program a.exe, and then the authority control module controls the authority of the unknown program a.exe according to the control policy of the unknown program a.exe. The control policy is "can't read desktop files, and can't write files to the desktop", then when the sandbox system finds that the process corresponding to the unknown program a.exe has read and write behaviors to the desktop files, the permission control module will perform corresponding actions. Permission controls restrict this behavior.

It is easy to notice that, according to the method provided by the embodiment of the present invention, when the security determination result of an unknown file or unknown program is unknown, a sandbox system can be used to isolate the unknown file or unknown program to protect the system. security. The isolation status includes file isolation, process isolation, session isolation, restricted network access, etc.

It is easy to notice that, according to the method provided by the embodiment of the present invention, the management and control policies used by the sandbox system are pulled from the cloud server, and then the management and control policies can be customized for complex usage environments and uploaded to the cloud server for use by the sandbox system. This implements permission control for a specific program, and the granularity of the permission control is relatively fine (for example, it can be for file paths, specific IP addresses, etc.). Therefore, one of the beneficial effects of the embodiments of the present invention is that the sandbox management and control strategy customization can be realized, and the flexibility is high.

It is easy to notice that, compared with the method provided by the related art, there is no injection behavior in the method provided by the embodiment of the present invention. Therefore, one of the beneficial effects of the embodiment of the present invention is that the running stability of the program in the sandbox is better , and it is difficult for the program to detect the sandbox environment.

An embodiment of the present invention further provides a file processing method, and the file processing method runs on a cloud server. FIG. 4 is a flowchart of another file processing method according to an embodiment of the present invention, as shown in FIG. 4 , The file processing methods include:

Step S402, receiving the target file from the client;

In step S404, the security attribute of the target file is judged to obtain a judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target file is isolated in a sandbox environment, and in the sandbox environment, the matching target file is obtained The target management and control strategy, and the permission management of the target file based on the target management and control strategy;

Step S406, a notification message is returned to the client, where the notification message is used to notify that the target file is isolated to the sandbox environment and the rights are controlled according to the target management and control policy.

Optionally, FIG. 5 is a schematic diagram of file processing performed on a cloud server according to an embodiment of the present invention. As shown in FIG. 5 , the client uploads the target file to the cloud server; the cloud server determines the security attribute of the target file. In order to obtain the judgment result, when it is determined that the security attribute does not meet the preset conditions through the judgment result, the target file is isolated into the sandbox environment, and in the sandbox environment, the target control policy matching the target file is obtained, and the target control policy is based on the target control policy. Permission control for target files. Then, the cloud server will feed back a notification message to the above-mentioned client, wherein the notification message is used to notify that the target file is isolated in the sandbox environment and the rights are controlled according to the target management and control policy. The final notification message is provided to the user through the client's GUI.

It should be noted that the above-mentioned file processing method provided by the embodiment of the present invention can be, but is not limited to, applicable to any computer security related to the use of office networks, internal networks, and production networks in the fields of health, language, society, science, art, etc. In the actual application scenario, through the interaction between the SaaS server and the client, it is determined whether to isolate the sandbox environment according to the security attribute judgment result of the target file uploaded by the client. File permissions are controlled, and a notification message is generated and returned to the client for the user.

It should be noted that, for the sake of simple description, the foregoing method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence. As in accordance with the present invention, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

From the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on this understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as ROM/RAM, magnetic disk, CD-ROM), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention.

Example 2

According to an embodiment of the present invention, an apparatus for implementing the above-mentioned file processing method is also provided. FIG. 6 is a schematic structural diagram of a file processing apparatus according to an embodiment of the present invention. As shown in FIG. 6 , the apparatus includes: determining module 601, isolation module 602, processing module 603, wherein,

The determination module 601 is used to determine the security attribute of the target file and obtain the determination result; the isolation module 602 is used to isolate the target file in the sandbox environment when it is determined by the determination result that the security attribute does not meet the preset condition; processing The module 603 is configured to obtain a target management and control policy matched by the target file in the sandbox environment, and perform authority management and control on the target file based on the target management and control policy.

Optionally, the above-mentioned determination module 601 is further configured to: determine whether the target file belongs to the preset whitelist or the preset blacklist based on the security attribute; when the target file belongs to the preset whitelist or the preset blacklist, determine that the judgment result is safe. The attribute satisfies the preset condition; when the target file does not belong to the preset whitelist and the preset blacklist, the determination result is that the security attribute does not meet the preset condition.

Optionally, FIG. 7 is a schematic structural diagram of another file processing apparatus according to an embodiment of the present invention. As shown in FIG. 7 , in addition to all the modules shown in FIG. 6 , the apparatus further includes: a parsing module 604 for using It pulls multiple candidate management and control strategies from the cloud server; parses multiple candidate management and control strategies to obtain the parsing results; and stores the parsing results in the storage area associated with the sandbox environment.

Optionally, the above-mentioned processing module 603 is further configured to: obtain index information of the target file; and obtain, based on the index information of the target file, a target management and control policy matching the index information from the analysis result stored in the storage area.

Optionally, FIG. 8 is a schematic structural diagram of another file processing apparatus according to an embodiment of the present invention. As shown in FIG. 8 , in addition to all the modules shown in FIG. 7 , the apparatus further includes: a determination module 605 for using When it is determined that no target management and control strategy matching the index information is found in the parsing result, the default management and control strategy is determined as the target management and control strategy.

Optionally, the above processing module 603 is further configured to: perform file authority management and control on the target file based on the target management and control strategy; perform process authority management and control on the target file based on the target management and control strategy; perform registry authority management and control on the target file based on the target management and control strategy; The target control policy controls the network access rights of target files.

It should be noted here that the above-mentioned determination module 601, isolation module 602, and processing module 603 correspond to steps S202 to S206 in Embodiment 1, and the three modules have the same instances and application scenarios as the corresponding steps, but are not identical. It is limited to the content disclosed in the first embodiment above. It should be noted that, as a part of the apparatus, the above-mentioned modules may run in the computer terminal 10 provided in the first embodiment.

In the embodiment of the present invention, firstly, the security attribute of the target file is judged to obtain the judgment result, and then it is determined whether the security attribute meets the preset condition according to the judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target The file is isolated to the sandbox environment, and then in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. The purpose is to achieve the technical effect of reducing the use risk of target files and improving system security with a flexible and stable solution, and then solve the method of processing risk files using process injection sandbox or system sandbox in related technologies. Its system support Inadequate, poor handling, and low flexibility of technical issues.

It should be noted that, for the preferred implementation of this embodiment, reference may be made to the relevant description in Embodiment 1, and details are not repeated here.

Example 3

According to an embodiment of the present invention, an embodiment of an electronic device is also provided, and the electronic device may be any computing device in a computing device group. The electronic device includes: a processor and a memory, wherein:

The memory is connected to the above-mentioned processor, and is used for providing the above-mentioned processor with instructions for processing the following processing steps: judging the security attribute of the target file, and obtaining a judgment result; when it is determined by the judgment result that the security attribute does not meet the preset condition, The target file is isolated in the sandbox environment; in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy.

In the embodiment of the present invention, firstly, the security attribute of the target file is judged to obtain the judgment result, and then it is determined whether the security attribute meets the preset condition according to the judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target The file is isolated to the sandbox environment, and then in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. The purpose is to achieve the technical effect of reducing the use risk of target files and improving system security with a flexible and stable solution, and then solve the method of processing risk files using process injection sandbox or system sandbox in related technologies. System support Inadequate, poor handling, and low flexibility of technical issues.

It should be noted that, for the preferred implementation of this embodiment, reference may be made to the relevant description in Embodiment 1, and details are not repeated here.

Example 4

Embodiments of the present invention may provide a computer terminal, and the computer terminal may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the above-mentioned computer terminal may also be replaced by a terminal device such as a mobile terminal.

Optionally, in this embodiment, the above-mentioned computer terminal may be located in at least one network device among multiple network devices of a computer network.

In this embodiment, the above-mentioned computer terminal may execute the program code of the following steps in the file processing method: judging the security attribute of the target file, and obtaining a judgment result; The file is isolated in the sandbox environment; in the sandbox environment, the target control policy matching the target file is obtained, and the permission control of the target file is performed based on the target control policy.

Optionally, FIG. 9 is a structural block diagram of another computer terminal according to an embodiment of the present invention. As shown in FIG. 9 , the computer terminal may include: one or more (only one is shown in the figure) processor 122 , Memory 124, and peripheral interface 126.

The memory can be used to store software programs and modules, such as program instructions/modules corresponding to the file processing method and device in the embodiments of the present invention, and the processor executes various functional applications by running the software programs and modules stored in the memory. And data processing, that is, to implement the above-mentioned file processing method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory located remotely from the processor, the remote memory being connectable to the computer terminal through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

The processor can call the information and the application program stored in the memory through the transmission device to perform the following steps: determine the security attribute of the target file, and obtain a judgment result; The file is isolated in the sandbox environment; in the sandbox environment, the target control policy matching the target file is obtained, and the permission control of the target file is performed based on the target control policy.

Optionally, the above-mentioned processor can also execute the program code of the following steps: determine whether the target file belongs to the preset whitelist or the preset blacklist based on the security attribute; when the target file belongs to the preset whitelist or the preset blacklist, determine The determination result is that the security attribute satisfies the preset condition; when the target file does not belong to the preset whitelist and the preset blacklist, the determination result is that the security attribute does not meet the preset condition.

Optionally, the above-mentioned processor may also execute the program code of the following steps: pulling multiple candidate management and control strategies from the cloud server; parsing the multiple candidate management and control strategies to obtain parsing results; storing the parsing results in a folder associated with the sandbox environment. storage area.

Optionally, the above-mentioned processor may further execute the program code of the following steps: obtaining index information of the target file; and obtaining, based on the index information of the target file, a target management and control policy matching the index information from the analysis result stored in the storage area.

Optionally, the above-mentioned processor may further execute the program code of the following steps: when it is determined that no target management and control strategy matching the index information is found in the parsing result, the default management and control strategy is determined as the target management and control strategy.

Optionally, the above-mentioned processor may also execute the program code of the following steps: perform file authority management and control on the target file based on the target management and control strategy; perform process authority management and control on the target file based on the target management and control strategy; register the target file based on the target management and control strategy. Permission management and control; network access permissions control for target files based on target management and control policies.

The processor can call the information and the application program stored in the memory through the transmission device to perform the following steps: receiving the target file from the client; judging the security attribute of the target file to obtain a judgment result, when it is determined by the judgment result that the security attribute is not When the preset conditions are met, the target file is isolated to the sandbox environment. In the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. A notification message is returned to the client, Among them, the notification message is used to notify that the target file is isolated to the sandbox environment and the rights are controlled according to the target management and control policy.

In the embodiment of the present invention, firstly, the security attribute of the target file is judged to obtain the judgment result, and then it is determined whether the security attribute meets the preset condition according to the judgment result, and when it is determined by the judgment result that the security attribute does not meet the preset condition, the target The file is isolated to the sandbox environment, and then in the sandbox environment, the target control policy matching the target file is obtained, and the target file is controlled based on the target control policy. The purpose is to achieve the technical effect of reducing the use risk of target files and improving system security with a flexible and stable solution, and then solve the method of processing risk files using process injection sandbox or system sandbox in related technologies. Its system support Inadequate, poor handling, and low flexibility of technical issues.

Those of ordinary skill in the art can understand that the structure shown in FIG. 9 is for illustration only, and the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, and a Mobile Internet Devices (MID) , PAD and other terminal equipment. FIG. 9 does not limit the structure of the above electronic device. For example, the computer terminal may also include more or less components than those shown in FIG. 9 (eg, network interface, display device, etc.), or have a different configuration than that shown in FIG. 9 .

Those of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can Including: flash disk, read-only memory (Read-Only Memory, ROM), random access device (RandomAccess Memory, RAM), magnetic disk or optical disk, etc.

According to an embodiment of the present invention, an embodiment of a storage medium is also provided. Optionally, in this embodiment, the above-mentioned storage medium may be used to store the program code executed by the file processing method provided in the above-mentioned Embodiment 1.

Optionally, in this embodiment, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

Optionally, in this embodiment, the storage medium is set to store program codes for performing the following steps: judging the security attribute of the target file, and obtaining a judgment result; when it is determined through the judgment result that the security attribute does not meet the preset condition When , isolate the target file to the sandbox environment; in the sandbox environment, obtain the target control policy matching the target file, and control the permissions of the target file based on the target control policy.

Optionally, in this embodiment, the storage medium is set to store program codes for executing the following steps: determining whether the target file belongs to the preset whitelist or the preset blacklist based on the security attribute; When the target file is not included in the preset whitelist or preset blacklist, the determination result is that the security attribute meets the preset condition; when the target file does not belong to the preset whitelist and preset blacklist, the determination result is that the security attribute does not meet the preset condition.

Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: pulling multiple candidate management and control strategies from the cloud server; parsing the multiple candidate management and control strategies to obtain a parsing result; The parsing results are stored in the storage area associated with the sandbox environment.

Optionally, in this embodiment, the storage medium is set to store program codes for performing the following steps: obtaining index information of the target file; Target control strategy for index information matching.

Optionally, in this embodiment, the storage medium is set to store program codes for executing the following steps: when it is determined that no target management and control strategy matching the index information is found in the parsing result, the default management and control strategy is determined as the target. control strategy.

Optionally, in this embodiment, the storage medium is configured to store program codes for performing the following steps: performing file authority control on the target file based on the target management and control policy; performing process authority control on the target file based on the target management and control policy; The target management and control strategy controls the registry rights of the target file; based on the target management and control strategy, the network access rights of the target file are controlled.

Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: receiving a target file from a client; judging the security attributes of the target file to obtain a judgment result, when the judgment result is passed When it is determined that the security attribute does not meet the preset conditions, the target file is isolated in the sandbox environment, and in the sandbox environment, the target file matching target control policy is obtained, and the target file is controlled based on the target control policy. A notification message is returned, where the notification message is used to notify that the target file is isolated to the sandbox environment and permissions are controlled according to the target management and control policy.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided by the present invention, it should be understood that the disclosed technical content may be implemented in other ways. The apparatus embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components may be combined or Integration into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes .

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1. a file processing method, is characterized in that, comprises: Judging the security attributes of the target file to obtain the judgment result; When it is determined by the determination result that the security attribute does not meet the preset condition, isolating the target file into a sandbox environment; In the sandbox environment, a target management and control policy matching the target file is obtained, and the target file is subject to authority management and control based on the target management and control policy. 2. The file processing method according to claim 1, characterized in that, judging the security attribute, and obtaining the judgment result comprises: Determine whether the target file belongs to a preset whitelist or a preset blacklist based on the security attribute; When the target file belongs to the preset whitelist or the preset blacklist, determine that the determination result is that the security attribute satisfies the preset condition; When the target file does not belong to the preset whitelist and the preset blacklist, it is determined that the determination result is that the security attribute does not meet the preset condition. 3. The file processing method according to claim 1, wherein the file processing method further comprises: Pull multiple candidate control strategies from the cloud server; Parsing the multiple candidate management and control strategies to obtain parsing results; The parsing result is stored in a storage area associated with the sandbox environment. 4. The file processing method according to claim 3, wherein acquiring the target management and control policy matched by the target file comprises: Obtain the index information of the target file; Based on the index information of the target file, the target management and control policy that matches the index information is acquired from the parsing result stored in the storage area. 5. The file processing method according to claim 4, wherein the file processing method further comprises: When it is determined that the target management and control strategy matching the index information is not found in the analysis result, a default management and control strategy is determined as the target management and control strategy. 6 . The file processing method according to claim 1 , wherein performing authority control on the target file based on the target management and control policy comprises at least one of the following: 6 . Perform file permission management and control on the target file based on the target management and control policy; Perform process authority control on the target file based on the target management and control policy; Perform registry authority control on the target file based on the target management and control policy; Perform network access authority control on the target file based on the target management and control policy. 7. A file processing method, characterized in that, comprising: Receive the target file from the client; Judging the security attribute of the target file to obtain a judgment result, when it is determined that the security attribute does not meet a preset condition through the judgment result, isolating the target file in a sandbox environment, and in the sandbox In the environment, obtain a target management and control policy matched by the target file, and perform authority management and control on the target file based on the target management and control policy; A notification message is returned to the client, where the notification message is used to notify that the target file is isolated to the sandbox environment and rights management is performed according to the target management and control policy. 8. A file processing device, comprising: The judgment module is used to judge the security attribute of the target file and obtain the judgment result; an isolation module, configured to isolate the target file into a sandbox environment when it is determined by the judgment result that the security attribute does not meet a preset condition; A processing module, configured to obtain a target management and control policy matched by the target file in the sandbox environment, and perform authority management and control on the target file based on the target management and control policy. 9 . A storage medium, characterized in that the storage medium comprises a stored program, wherein when the program is run, a device where the storage medium is located is controlled to perform the file processing according to any one of claims 1 to 7 method. 10. A file processing system, comprising: processor; and a memory, connected to the processor, for providing the processor with instructions for processing the following processing steps: Step 1, determine the security attribute of the target file, and obtain the determination result; Step 2, when it is determined by the judgment result that the security attribute does not meet the preset condition, isolate the target file into a sandbox environment; Step 3, in the sandbox environment, obtain a target management and control policy matched by the target file, and perform authority management and control on the target file based on the target management and control policy.

Images