WO2024021577A1 - 防篡改的数据保护方法及系统 - Google Patents

防篡改的数据保护方法及系统 Download PDF

Info

Publication number
WO2024021577A1
WO2024021577A1 PCT/CN2023/077079 CN2023077079W WO2024021577A1 WO 2024021577 A1 WO2024021577 A1 WO 2024021577A1 CN 2023077079 W CN2023077079 W CN 2023077079W WO 2024021577 A1 WO2024021577 A1 WO 2024021577A1
Authority
WO
WIPO (PCT)
Prior art keywords
path
whitelist
verification
protection
module
Prior art date
Application number
PCT/CN2023/077079
Other languages
English (en)
French (fr)
Inventor
鲍苏宁
王瀚
Original Assignee
上海爱数信息技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海爱数信息技术股份有限公司 filed Critical 上海爱数信息技术股份有限公司
Publication of WO2024021577A1 publication Critical patent/WO2024021577A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • This application relates to data protection technology in the field of computer storage, such as tamper-proof data protection methods and systems.
  • Ransomware viruses emerge in endlessly and are difficult to prevent. Once infected with a ransomware virus, there is basically no solution. Either you must pay a ransom to get your data back, or the data cannot be retrieved or it may be made public.
  • the current ransomware virus scanning and killing function detects and kills ransomware by identifying ransomware virus characteristic values and behaviors. It has limitations such as slow virus signature database update speed, low recognition rate, and accidental killing.
  • anti-virus vendors’ solutions lie in protecting the process security of production systems and cannot be responsible for data security.
  • a data encryption method and encryption device are proposed.
  • the method includes the following steps: inputting a password through the client host to open the encrypted disk, and the application program accesses the data in the disk; before accessing, the encryption server The application implements access control permission; the saved data is encrypted and written to the storage device; the client host sends a request to close the encrypted disk, and the encrypted disk is closed.
  • This method enhances the reliability and compatibility of data protection to a certain extent, but its verification program to protect data is not comprehensive enough. In the case of human malice or misoperation (rm rf, etc.) causing the data on the backup system to be destroyed, , cannot be protected through data protection solutions.
  • This application provides tamper-proof data protection methods and systems, which can effectively protect against human destruction and malicious programs such as ransomware viruses.
  • This application provides a tamper-proof data protection method, which runs in the computer system kernel and includes:
  • the access instruction includes the access object path and access process information
  • a call allow signal is generated; in response to the access object path existing in the maintained protected path whitelist Under the protection path whitelist or a subpath of a path in the protection path whitelist, determine whether the current access process exists in the maintained process whitelist based on the access process information;
  • a call-allowed signal is generated; in response to the current access process not existing in the maintained process whitelist, an access-denied signal is generated;
  • the method for obtaining the protection path whitelist includes:
  • the registration verification code is verified. After the verification is successful, the absolute path of the corresponding protection object is added to the protection path whitelist, and the protection path whitelist is stored in the computer system kernel, Each path in the protection path whitelist has corresponding protection permissions;
  • Methods for obtaining the process whitelist include:
  • the registration verification code is verified. After the verification is successful, the corresponding process information that needs to be registered is added to the process whitelist list, and the process whitelist list is stored in the computer system kernel.
  • the protection objects include files, directories or devices.
  • the method for obtaining the protection path whitelist further includes: obtaining the corresponding partition and disk information when the registration verification code is verified successfully. .
  • the process information includes a process identification number (Process Identification, PID) and a process name.
  • PID Process Identification
  • a Security Socket Layer (SSL) encryption authentication method is used to generate the interface verification code, the registration verification code or to verify the interface verification code.
  • SSL Security Socket Layer
  • This application also provides a tamper-proof data protection system, including a configuration module, a parameter verification module, User mode interaction module and system call verification driver module, among which,
  • the system call verification driver module is configured to obtain an access instruction to the data, where the access instruction includes an access object path and access process information, and determines whether the access object path exists in the maintained protection path whitelist or in the protected path whitelist. Under a sub-path of a path in the protection path whitelist, in response to the access object path existing in the maintained protection path whitelist or under a sub-path of a path in the protection path whitelist, according to the The access process information determines whether the current access process exists in the maintained process white list. In response to the current access process existing in the maintained process white list, a call allow signal is generated. In response to the current access process not existing in the maintained process white list, In the process whitelist list, an access denial signal is generated;
  • the protection path whitelist list and the process whitelist list are obtained by the cooperation of the configuration module, parameter verification module, user mode interaction module and system call verification driver module;
  • the configuration module is configured to obtain the absolute path of the protected object and the corresponding protection authority, call the parameter verification module to generate the corresponding interface verification code, and transmit the absolute path and the interface verification code to the User mode interaction module; the user mode interaction module is configured to call the parameter verification module to verify the interface verification code. After the verification is successful, call the parameter verification module to generate the registration verification code, and The absolute path and the registration verification code are transmitted to the system call verification driver module; the system call verification driver module is also configured to verify the registration verification code. After the verification is successful, Add the absolute path of the corresponding protection object to the protection path whitelist, and each path in the protection path whitelist has corresponding protection permissions;
  • the parameter verification module is configured to be called by the user-mode program that needs to be registered to generate a corresponding interface verification code.
  • the user-mode interaction module is also configured to receive the process information of the user-mode program that needs to be registered and the interface verification code. Verify the code; the user mode interaction module is also configured to call the parameter verification module to verify the interface verification code. After the verification is successful, call the parameter verification module to generate the registration verification code, and The process information and the registration verification code are transmitted to the system call verification driver module; the system call verification driver module is also configured to verify the registration verification code. After the verification is successful, The corresponding process information that needs to be registered is added to the process whitelist list;
  • the system call verification driver module is built into the computer system kernel.
  • the protection objects include files, directories or devices.
  • the protection object is a file or directory.
  • the user mode interaction module is further configured to: after the generated registration verification code is verified successfully, Get the corresponding partition and disk information.
  • the process information includes PID and process name.
  • the configuration module and the user-mode interaction module are configured to encrypt via SSL.
  • the authentication mode calls the parameter verification module.
  • This application also provides an electronic device, including:
  • the memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor, so that the at least one processor can execute the above-mentioned tamper-proof data protection method.
  • This application also provides a computer-readable storage medium that stores computer instructions, and the computer instructions are used to implement the above-mentioned tamper-proof data protection method when executed by a processor.
  • Figure 1 is a system structure diagram provided by an embodiment of the present application.
  • Figure 2 is a protection path whitelist registration flow chart provided by an embodiment of the present application.
  • Figure 3 is a process whitelist registration flow chart provided by an embodiment of the present application.
  • Figure 4 is a tamper-proof data access flow chart provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • This application provides a tamper-proof data protection method, which runs in the computer system kernel and includes the following steps: 1) Obtain access instructions for data, which include access object paths and access process information; 2) Determine the access instructions Whether the access object path exists in the maintained protection path whitelist or a subpath of a path in the protection path whitelist, if the access object path exists in the maintained protection path whitelist or the protection path whitelist Under the sub-path of a path in the protected path whitelist, perform step 3). If the access object path does not exist in the maintained protected path whitelist and a sub-path of a path in the protected path whitelist. path, a call-allowed signal is generated; 3) Determine whether the currently accessed process exists in the maintained process whitelist based on the accessed process information.
  • a call-allowed signal is generated; if the access process information determines that the current access process does not exist in the maintained process whitelist, an access-denied signal is generated. That is, in this method, if the file path passed If it is not within the protection scope or the current process is in the process whitelist, it is allowed to call real system functions.
  • the protection path whitelist and process whitelist can be dynamically maintained.
  • the protection path whitelist list and the process whitelist list are both obtained through the check code method.
  • the protection path whitelist list is obtained through the following steps: obtaining the absolute path of the protected object and the corresponding protection permissions, and generating the corresponding interface. Verification code; verify the interface verification code. After the verification is successful, a registration verification code is generated; verify the registration verification code. After the verification is successful, the absolute path of the corresponding protected object is Added to the protection path whitelist list, the protection path whitelist list is stored in the computer system kernel, and each path in the protection path whitelist list has corresponding protection permissions.
  • the process whitelist list is obtained through the following steps: obtain the process information that needs to be registered and generate the corresponding interface verification code; verify the interface verification code. After the verification is successful, generate the registration verification code; Verify the above registration verification code. After the verification is successful, the corresponding process information that needs to be registered is added to the process whitelist list.
  • the process whitelist list is stored in the computer system kernel.
  • the above method can be implemented through a tamper-proof data protection system as shown in Figure 1.
  • the system includes a configuration module 1 belonging to the user mode, a parameter verification module 2 and a user mode interaction module 3 belonging to the kernel mode.
  • the system call verification driver module 4 realizes the protection path whitelist registration process, process whitelist registration process and system call legality detection process through the cooperation of multiple modules.
  • the protection path whitelist registration process includes the following steps:
  • S101 Pass the absolute path of the file, directory or device that needs to be protected to the configuration module.
  • the configuration module calls the parameter verification module to generate the interface verification code. If the interface verification code is generated successfully, the protected absolute path and interface verification code will be generated. The verification code is passed to the user mode interaction module.
  • the user mode interaction module calls the parameter verification module to verify the interface verification code. After the verification is successful, it calls the parameter verification module to generate the registration verification code. If the registration verification code is generated successfully, the protected absolute The path and registration verification code are registered in the system call verification driver module.
  • the process whitelist registration process includes the following steps:
  • the user state program calls the parameter verification module to generate the interface verification code. If the interface verification code is successfully generated, the PID, process name and interface verification code are passed to the user state interaction module.
  • the user mode interaction module calls the parameter verification module to verify the interface verification code. After the verification passes, it calls the parameter verification module to generate the registration verification code. If the registration verification code is successfully generated, the PID, process name and registration The verification code is registered in the system call verification driver module.
  • the system call legality detection process includes the following steps:
  • step S303 The system call verification driver module will detect whether the passed file path is in the protected path list or its subpath. If the passed file path is in the protected path list or its subpath, step S304 will be executed. If the passed file path is in the protected path list or its subpath, step S304 will be executed. If it is not in the protected path list and its sub-paths, it is allowed to call real system functions.
  • the above-mentioned interface check code refers to the access interface provided by the user-mode interaction module to the outside world. When the application calls this interface, it needs to pass in an interface check code.
  • the interface check code can be generated by the parameter check module.
  • the user-mode interaction module receives the interface After the verification code, the parameter verification module will be called for verification to check the legitimacy of the verification code to prevent unauthorized and illegal programs from calling the functions of the interactive module.
  • the above registration verification code means that when the user mode interaction module registers with the driver, it calls the parameter verification module to generate the registration verification code, and passes it to the system call verification driver module together with other parameters.
  • the driver module receives the registration verification code. After the code verification, verification will be carried out. Once the verification is passed, it can be confirmed that this is a legal registration.
  • This registration verification code is to prevent unauthorized and illegal programs from calling the system to verify the driver module registration information.
  • protection permissions refer to the application's access permissions to the protection path, which can be divided into read permissions and write permissions.
  • read permissions When only write permissions are set, only processes in the process whitelist have permission to write to the path, and all processes have permission to read from the path. Read permissions are similar.
  • SSL authentication encryption refers to the widely used client/server encryption authentication technology, which is a public authentication encryption technology.
  • the above-mentioned parameter verification module generates a verification code, which means that the parameter verification module uses an information digest algorithm based on the parameters passed in by the external program (such as PID, process name, etc., and uses SSL authentication encryption when passing parameters to prevent access by illegal programs).
  • 5 Message-Digest Algorithm 5, MD5 generates the corresponding check code.
  • the above-mentioned system call refers to the basic operating functions provided by the operating system kernel to user space. It is a general concept. User-mode programs enter the kernel space through system calls to access corresponding system resources.
  • system call verification driver module When using the above system, install the above system call verification driver module, user mode interaction module, configuration module and parameter verification module on the machine that needs to be tamper-proof, and register the files, directories, and devices that need to be protected through the configuration module.
  • system call verification driver module transform related user-mode processes in the system. When these processes start, register their own PID and process name into the system call verification driver module; when a program needs to access a file, it will Entering the kernel through a system call, the system call verification driver module will determine whether the file accessed by this system call is in the protected path list before calling the real system function. If the file accessed by this system call is in the protected path list, Then check whether the current process is in the process whitelist. If the current process is in the process whitelist, you can access the corresponding file resources. If the current process is not in the process whitelist, access will be directly denied, thereby achieving data tamper resistance. the goal of.
  • the protection process is as follows: the ransomware virus or other malicious process searches for, encrypts, deletes, and destroys the computer. files in the system, it will enter the kernel through system calls. First, it will encounter the check of the system call verification driver module. It is found that the PID and process name of the current process are not in the process whitelist list, so the system call verification driver module The access operation is directly denied, so these malicious programs cannot access the protected files, directories, and devices, and cannot destroy, encrypt, or leak the data of the computer system.
  • the protection process is as follows: Human operation is generally to delete operations such as rm rf directly from the backend server. Or destroy the data on the computer system. In the process of performing these operations, you also need to enter the kernel through system calls. After entering the kernel, you will first encounter the check of the system call verification driver module and discover the PID and process name of the current process. It is not in the process whitelist, so the system calls the verification driver module to directly deny the access operation. Therefore, human malice or misoperation cannot access the protected files, directories, and devices, and it is impossible to destroy the data of the computer system. Encryption, leakage.
  • This application can achieve accurate and efficient protection of files through double-layer verification of paths and processes and built-in system call verification drivers. There is no problem of missing malicious programs. It only needs to be installed and configured once, and no subsequent steps are required. update operation.
  • This application uses SSL encryption authentication method to generate verification code, which is highly reliable.
  • ransomware viruses or other malicious, human-made malicious operations or misoperations When a ransomware virus or other malicious process searches, encrypts, deletes, or destroys files in the computer system, it cannot legally register its PID and process name into the system call verification driver module in the kernel mode, so it cannot protect the files. , directories, and devices, you cannot access the computer System data is destroyed, encrypted, and leaked.
  • the operation When operating manually, the operation is mainly performed on the command line.
  • the shell process and the corresponding command process cannot be legally registered into the system call verification driver module in the kernel mode. Therefore, there is no authority to protect the files, Directories and devices are accessed, thereby preventing malicious human operations or misoperations.
  • FIG. 5 shows a schematic structural diagram of an electronic device 10 that can be used to implement embodiments of the present application.
  • Electronic device 10 is intended to represent many forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.
  • Electronic device 10 may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (eg, helmets, glasses, watches, etc.), and other similar computing devices.
  • the components shown herein, their connections and relationships, and their functions are examples only and are not intended to limit the implementation of the present application as described and/or claimed herein.
  • the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a read-only memory (Read-Only Memory, ROM) 12, a random access memory (Random Access Memory, RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor.
  • the processor 11 can execute according to the computer program stored in the ROM 12 or loaded from the storage unit 18 into the RAM 13. A variety of appropriate actions and treatments.
  • various programs and data required for the operation of the electronic device 10 can also be stored.
  • the processor 11, the ROM 12 and the RAM 13 are connected to each other via the bus 14.
  • An input/output (I/O) interface 15 is also connected to the bus 14 .
  • the I/O interface 15 Multiple components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc. etc.; and communication unit 19, such as network card, modem, wireless communication transceiver, etc.
  • the communication unit 19 allows the electronic device 10 to exchange information/data with other devices through a computer network such as the Internet and/or various telecommunications networks.
  • Processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (Central Processing Unit, CPU), a graphics processing unit (GPU), a variety of dedicated artificial intelligence (Artificial Intelligence, AI) computing chips, a variety of running Processors for machine learning model algorithms, digital signal processors (Digital Signal Processing, DSP), and any appropriate processors, controllers, microcontrollers, etc.
  • the processor 11 performs a plurality of methods and processes described above, such as tamper-proof data protection methods.
  • the tamper-proof data protection method may be implemented as a computer program that is tangibly embodied in a computer-readable storage medium, such as the storage unit 18 .
  • part or all of the computer program may be loaded and/or installed into the computer via the ROM 12 and/or the communication unit 19 on subdevice 10.
  • the processor 11 may be configured to perform a tamper-resistant data protection method in any other suitable manner (eg, by means of firmware).
  • FPGAs Field Programmable Gate Arrays
  • ASICs Application Specific Integrated Circuits
  • ASSP Application Specific Standard Parts
  • SOC System on Chip
  • CPLD Complex Programming Logic Device
  • These various embodiments may include implementation in one or more computer programs executable and/or interpreted on a programmable system including at least one programmable processor, the programmable processor
  • the processor which may be a special purpose or general purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
  • An output device may be a special purpose or general purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
  • An output device may be a special purpose or general purpose programmable processor, may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
  • Computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that the computer program, when executed by the processor, causes the functions/operations specified in the flowcharts and/or block diagrams to be implemented.
  • a computer program may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
  • a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device.
  • Computer-readable storage media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any suitable combination of the foregoing.
  • the computer-readable storage medium may be a machine-readable signal medium.
  • machine-readable storage media examples include one or more wire-based electrical connections, laptop disks, hard drives, RAM, ROM, Erasable Programmable Read-Only Memory (EPROM), or flash memory ), optical fiber, portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the systems and techniques described herein may be implemented on an electronic device having a display device (eg, a cathode ray tube (CRT), CRT) or liquid crystal configured to display information to the user.
  • Display Liquid Crystal Display, LCD monitor
  • keyboard and pointing device eg, a mouse or trackball
  • Other kinds of devices may also be configured to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and may be provided in any form, including Acoustic input, voice input or tactile input) to receive input from the user.
  • the systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., A user's computer having a graphical user interface or web browser through which the user can interact with implementations of the systems and technologies described herein), or including such backend components, middleware components, or any combination of front-end components in a computing system.
  • the components of the system may be interconnected by any form or medium of digital data communication (eg, a communications network). Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN), blockchain network, and the Internet.
  • Computing systems may include clients and servers.
  • Clients and servers are generally remote from each other and typically interact over a communications network.
  • the relationship of client and server is created by computer programs running on corresponding computers and having a client-server relationship with each other.
  • the server can be a cloud server, also known as cloud computing server or cloud host. It is a host product in the cloud computing service system to solve the problems existing in traditional physical host and virtual private server (VPS) services. It has the disadvantages of difficult management and weak business scalability.
  • VPN virtual private server
  • Steps can be reordered, added, or removed using various forms of the process shown above.
  • multiple steps described in this application can be executed in parallel, sequentially, or in different orders.
  • the desired results of the technical solution of this application can be achieved, there is no limitation here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供防篡改的数据保护方法及系统，所述防篡改的数据保护方法运行于计算机系统内核中，包括：1)获取对数据的访问指令，访问指令包括访问对象路径和访问进程信息；2)判断访问对象路径是否存在于维护的保护路径白名单列表或保护路径白名单列表中一个路径的子路径下，若是，则执行步骤3)，若否，则产生允许调用信号；3)根据访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中，若是，则产生允许调用信号，若否，则产生拒绝访问信号。

Description

防篡改的数据保护方法及系统
本申请要求在2022年07月28日提交中国专利局、申请号为202210898693.5的中国专利申请的优先权，该申请的全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机存储领域的数据保护技术，例如涉及防篡改的数据保护方法及系统。
背景技术
随着计算机与网络技术的迅猛发展，如今绝大部分企业都在使用计算机和网络来运作自己的核心业务，由此产生的数据成为了企业的核心资产。任何核心数据的丢失、破坏、泄露，都会给企业带来严重的负面影响。
勒索病毒层出不穷、防不胜防，一旦感染勒索病毒，基本无解，要么给赎金换回数据，要么数据找不回或者被公开。当前的勒索病毒查杀功能通过识别勒索病毒特征值以及行为来进行查杀，存在病毒特征库更新速度乏力、识别率不高、误杀等局限性。此外，反病毒厂商的解决方案在于保护生产系统的过程安全，无法对数据安全负责。
经检索中国发明专利CN110457920A提出了一种数据加密方法及加密装置，所述方法包括以下步骤：通过客户端主机输入密码打开加密盘，应用程序对盘内数据进行访问；访问前，加密服务器对访问的应用程序实施访问控制许可；对存盘数据进行加密，并写入存储设备；客户端主机发送关闭加密盘请求，加密盘关闭。该方法在一定程度上增强了数据保护的可靠性和兼容性，但是其保护数据的校验程序不够全面，在人为恶意或者误操作(rm rf等)导致备份系统上的数据被破坏的情况下，无法通过数据保护方案进行防护。
发明内容
本申请提供防篡改的数据保护方法及系统，可以有效防护人为破坏和勒索病毒等恶意程序的侵害。
本申请提供一种防篡改的数据保护方法，该方法运行于计算机系统内核中，包括：
获取对数据的访问指令，其中，所述访问指令包括访问对象路径和访问进程信息；
判断所述访问对象路径是否存在于维护的保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下；
响应于所述访问对象路径不存在于维护的所述保护路径白名单列表以及所述保护路径白名单列表中一个路径的子路径下，产生允许调用信号；响应于所述访问对象路径存在于维护的所述保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，根据所述访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中；
响应于当前访问进程存在于维护的所述进程白名单列表中，产生允许调用信号；响应于当前访问进程不存在于维护的所述进程白名单列表中，产生拒绝访问信号；
其中，所述保护路径白名单列表的获取方法包括：
获取保护对象的绝对路径以及对应的保护权限，生成相应的接口校验码；
对所述接口校验码进行校验，校验成功后，生成注册校验码；
对所述注册校验码进行校验，校验成功后，将对应的保护对象的绝对路径加入所述保护路径白名单列表中，所述保护路径白名单列表存储于所述计算机系统内核中，所述保护路径白名单列表中的每条路径具有对应的保护权限；
所述进程白名单列表的获取方法包括：
获取需要注册的进程信息，生成相应的接口校验码；
对所述接口校验码进行校验，校验成功后，生成注册校验码；
对所述注册校验码进行校验，校验成功后，将对应的需要注册的进程信息加入所述进程白名单列表中，所述进程白名单列表存储于所述计算机系统内核中。
一实现方式中，所述保护对象包括文件、目录或者设备。
一实现方式中，若所述保护对象为文件或目录，则所述保护路径白名单列表的获取方法还包括：在所述注册校验码校验成功的情况下，获取对应的分区和磁盘信息。
一实现方式中，所述进程信息包括进程识别号(Process Identification，PID)和进程名称。
一实现方式中，采用安全套接层(Security Socket Layer，SSL)加密认证方式生成所述接口校验码、所述注册校验码或对所述接口校验码进行校验。
本申请还提供一种防篡改的数据保护系统，包括配置模块、参数校验模块、 用户态交互模块和系统调用校验驱动模块，其中，
所述系统调用校验驱动模块设置为获取对数据的访问指令，其中，所述访问指令包括访问对象路径和访问进程信息，判断所述访问对象路径是否存在于维护的保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，响应于所述访问对象路径存在于维护的所述保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，根据所述访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中，响应于当前访问进程存在于维护的所述进程白名单列表中，产生允许调用信号，响应于当前访问进程不存在于维护的所述进程白名单列表中，产生拒绝访问信号；
所述保护路径白名单列表和所述进程白名单列表由所述配置模块、参数校验模块、用户态交互模块和系统调用校验驱动模块的协作获取；
所述配置模块设置为获取保护对象的绝对路径以及对应的保护权限，调用所述参数校验模块生成相应的接口校验码，并将所述绝对路径和所述接口校验码传输给所述用户态交互模块；所述用户态交互模块设置为调用所述参数校验模块对所述接口校验码进行校验，校验成功后，调用所述参数校验模块生成注册校验码，并将所述绝对路径和所述注册校验码传输给所述系统调用校验驱动模块；所述系统调用校验驱动模块还设置为对所述注册校验码进行校验，校验成功后，将对应的保护对象的绝对路径加入所述保护路径白名单列表中，所述保护路径白名单列表中的每条路径具有对应的保护权限；
所述参数校验模块设置为被需要注册的用户态程序调用以生成相应的接口校验码，所述用户态交互模块还设置接收所述需要注册的用户态程序的进程信息和所述接口校验码；所述用户态交互模块还设置为调用所述参数校验模块对所述接口校验码进行校验，校验成功后，调用所述参数校验模块生成注册校验码，并将所述进程信息和所述注册校验码传输给所述系统调用校验驱动模块；所述系统调用校验驱动模块还设置为对所述注册校验码进行校验，校验成功后，将对应的需要注册的进程信息加入所述进程白名单列表中；
所述系统调用校验驱动模块内置于计算机系统内核中。
一实现方式中，所述保护对象包括文件、目录或者设备。
一实现方式中，所述保护对象为文件或目录，在所述保护路径白名单列表的获取过程中，所述用户态交互模块还设置为在生成的所述注册校验码校验成功后，获取对应的分区和磁盘信息。
一实现方式中，所述进程信息包括PID和进程名称。
一实现方式中，所述配置模块和所述用户态交互模块设置为通过SSL加密 认证方式调用所述参数校验模块。
本申请还提供一种电子设备，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的计算机程序，所述计算机程序被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述的防篡改的数据保护方法。
本申请还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机指令，所述计算机指令用于使处理器执行时实现上述的防篡改的数据保护方法。
附图说明
图1为本申请实施例提供的一种系统结构图；
图2为本申请实施例提供的一种保护路径白名单注册流程图；
图3为本申请实施例提供的一种进程白名单注册流程图；
图4为本申请实施例提供的一种防篡改的数据访问流程图；
图5为本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
下面结合附图和具体实施例对本申请进行说明。本实施例以本申请技术方案为前提进行实施，给出了实施方式和操作过程。
本申请提供一种防篡改的数据保护方法，该方法运行于计算机系统内核中，包括以下步骤：1)获取对数据的访问指令，该访问指令包括访问对象路径和访问进程信息；2)判断所述访问对象路径是否存在于维护的保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，若所述访问对象路径存在于维护的所述保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，则执行步骤3)，若所述访问对象路径不存在于维护的所述保护路径白名单列表以及所述保护路径白名单列表中一个路径的子路径下，则产生允许调用信号；3)根据所述访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中，若所述访问进程信息判断当前访问进程存在于维护的进程白名单列表中，则产生允许调用信号，若所述访问进程信息判断当前访问进程不存在于维护的进程白名单列表中，则产生拒绝访问信号。即该方法中，如果传递的文件路径 不在保护范围内或者当前进程在进程白名单列表中，则允许其调用真正的系统功能，保护路径白名单列表和进程白名单列表可动态维护。
上述方法中，保护路径白名单列表和进程白名单列表均通过校验码方式获取，所述保护路径白名单列表通过以下步骤获取：获取保护对象的绝对路径以及对应的保护权限，生成相应的接口校验码；对所述接口校验码进行校验，校验成功后，生成注册校验码；对所述注册校验码进行校验，校验成功后，将对应的保护对象的绝对路径加入保护路径白名单列表中，该保护路径白名单列表存储于计算机系统内核中，所述保护路径白名单列表中的每条路径具有对应的保护权限。所述进程白名单列表通过以下步骤获取：获取需要注册的进程信息，生成相应的接口校验码；对所述接口校验码进行校验，校验成功后，生成注册校验码；对所述注册校验码进行校验，校验成功后，将对应的需要注册的进程信息加入进程白名单列表中，该进程白名单列表存储于计算机系统内核中。
在一个实施方式中，上述方法可通过如图1所示的防篡改的数据保护系统实现，该系统包括属于用户态的配置模块1、参数校验模块2和用户态交互模块3以及属于内核态的系统调用校验驱动模块4，通过多个模块的协作实现保护路径白名单注册流程、进程白名单注册流程以及系统调用合法性检测流程。
如图2所示，保护路径白名单注册流程包括以下步骤：
S101、将需要保护的文件、目录或者设备的绝对路径传递给配置模块，配置模块调用参数校验模块生成接口校验码，如果接口校验码生成成功，则将受保护的绝对路径和接口校验码传递给用户态交互模块。
S102、用户态交互模块调用参数校验模块对接口校验码进行校验，校验成功后，调用参数校验模块生成注册校验码，如果注册校验码生成成功，则将受保护的绝对路径和注册校验码注册到系统调用校验驱动模块中。
S103、进入内核态，系统调用校验驱动模块接收注册信息后，先进行注册校验码的校验，校验成功后，再将相关的保护路径加入到保护路径白名单中。
如图3所示，进程白名单注册流程包括以下步骤：
S201、用户态程序调用参数校验模块生成接口校验码，如果接口校验码生成成功，则将PID、进程名称以及接口校验码传递给用户态交互模块。
S202、用户态交互模块调用参数校验模块对接口校验码进行验证，验证通过后，调用参数校验模块生成注册校验码，如果注册校验码生成成功，则将PID、进程名称以及注册校验码注册到系统调用校验驱动模块中。
S203、进入内核态，系统调用校验驱动模块接收注册信息后，先进行注册校验码的校验，校验成功后，再将相关的PID、进程名称加入到进程白名单中。
如图4所示，系统调用合法性检测流程包括以下步骤：
S301、用户态程序在访问一个文件的时候，会调用操作系统提供的系统调用。
S302、进入内核态，将文件的路径、PID等信息传入到系统内核中，这些信息会首先传递给系统调用校验驱动模块。
S303、系统调用校验驱动模块会检测传递的文件路径是否在保护路径列表或其子路径下，如果传递的文件路径在保护路径列表或其子路径下，则执行步骤S304，如果传递的文件路径不在保护路径列表及其子路径下，则允许其调用真正的系统功能。
S304、检测当前访问进程的PID和进程名称是否在进程白名单列表中，如果当前访问进程的PID和进程名称不在进程白名单列表中，则拒绝该系统调用，直接返回错误码给用户态程序，如果当前访问进程在进程白名单列表中，则允许其调用真正的系统功能。
上述接口校验码是指用户态交互模块对外提供访问接口，应用程序在调用该接口时需要传入一个接口校验码，接口校验码可由参数校验模块生成，用户态交互模块接收到接口校验码后会调用参数校验模块进行校验，检查该校验码的合法性，以避免未授权的非法程序调用交互模块的功能。
上述注册校验码是指用户态交互模块在向驱动进行注册时，调用参数校验模块生成注册校验码，并连同其他参数一起传递给系统调用校验驱动模块，驱动模块收到该注册校验码之后，会进行验证，验证通过后即可确认本次是合法注册。此注册验证码是防止未授权的非法程序向系统调用校验驱动模块注册信息。
上述保护权限是指应用程序对保护路径的访问权限，可分为读权限、写权限。当只设置写权限时，只有进程白名单列表中的进程才有权限对该路径执行写入操作，并且所有进程都有权限对该路径执行读操作。读权限类似。
上述过程中，配置模块和用户态交互模块通过SSL加密认证方式调用参数校验模块，以便阻止非法程序调用。SSL认证加密是指广泛使用的客户端/服务端加密认证技术，属于公开的认证加密技术。
上述参数校验模块生成校验码是指，参数校验模块根据外部程序传入的参数(比如PID、进程名称等，参数传递时采用SSL认证加密，防止非法程序的访问)，使用信息摘要算法5(Message-Digest Algorithm 5，MD5)生成相应的校验码。
上述系统调用是指操作系统内核对用户空间提供的基本操作功能，是一种通用概念，用户态程序通过系统调用进入内核空间来访问相应的系统资源。
使用上述系统时，在需要防篡改的机器上安装上述系统调用校验驱动模块、用户态交互模块、配置模块和参数校验模块，对需要进行保护的文件、目录、设备，通过配置模块注册到系统调用校验驱动模块中；改造系统中相关的用户态进程，在这些进程启动的时候，将自身PID和进程名称注册到系统调用校验驱动模块中；在有程序需要访问一个文件时，会通过系统调用进入到内核，在调用真正的系统功能之前系统调用校验驱动模块会判断本次系统调用访问的文件是否在保护路径列表中，如果本次系统调用访问的文件在保护路径列表中，则再检查当前进程是否在进程白名单列表中，如果当前进程在进程白名单列表中，方可访问对应的文件资源，如果当前进程不在进程白名单列表中则直接拒绝访问，从而达到数据防篡改的目的。
在一个实施方式中，安装有上述防篡改的数据保护系统的设备中，若遇到勒索病毒或其他恶意程序，则其防护流程为：勒索病毒或其他恶意进程在查找、加密、删除、破坏计算机系统中的文件时，会通过系统调用进入到内核中，首先会碰到系统调用校验驱动模块的检查，发现当前进程的PID和进程名称不在进程白名单列表中，所以系统调用校验驱动模块直接拒绝该访问操作，因此这些恶意程序无法对保护的文件、目录、设备进行访问，也就无法对计算机系统的数据进行破坏、加密、泄露。
在一个实施方式中，安装有上述防篡改的数据保护系统的设备中，若遇到人为恶意或者误操作，则其防护流程为：人为操作一般是直接从后台服务器上执行rm rf等操作来删除或者破坏计算机系统上的数据，在执行这些操作的过程中，也需要通过系统调用进入到内核中，进入内核后首先会碰到系统调用校验驱动模块的检查，发现当前进程的PID和进程名称不在进程白名单列表中，所以系统调用校验驱动模块直接拒绝该访问操作，因此人为恶意或者误操作也无法对保护的文件、目录、设备进行访问，也就无法对计算机系统的数据进行破坏、加密、泄露。
与相关技术相比，本申请的效果为：
1、本申请通过路径和进程的双层验证及内置系统调用校验驱动，可以实现对文件的精准高效保护，不存在恶意程序漏杀的问题，并且只需安装配置一次，后续不需要进行任何的更新操作。
2、本申请采用SSL加密认证方式生成验证校验码，可靠性高。
3、本申请可以应用于勒索病毒或其他恶意、人为恶意操作或者误操作等多种情况。勒索病毒或其他恶意进程在查找、加密、删除、破坏计算机系统中的文件时，由于无法将自身PID和进程名称合法地注册到内核态的系统调用校验驱动模块中，所以无法对保护的文件、目录、设备进行访问，也就无法对计算机 系统的数据进行破坏、加密、泄露。人为操作时，主要是在命令行进行操作，在命令行进行操作时也无法将shell进程和对应命令进程合法注册到内核态的系统调用校验驱动模块中，因此也没有权限对保护的文件、目录、设备进行访问，从而防止了人为恶意操作或者误操作。
图5示出了可以用来实施本申请的实施例的电子设备10的结构示意图。电子设备10旨在表示多种形式的数字计算机，诸如，膝上型计算机、台式计算机、工作台、个人数字助理、服务器、刀片式服务器、大型计算机、和其它适合的计算机。电子设备10还可以表示多种形式的移动装置，诸如，个人数字处理、蜂窝电话、智能电话、可穿戴设备(如头盔、眼镜、手表等)和其它类似的计算装置。本文所示的部件、它们的连接和关系、以及它们的功能仅仅作为示例，并且不意在限制本文中描述的和/或者要求的本申请的实现。
如图5所示，电子设备10包括至少一个处理器11，以及与至少一个处理器11通信连接的存储器，如只读存储器(Read-Only Memory，ROM)12、随机访问存储器(Random Access Memory，RAM)13等，其中，存储器存储有可被至少一个处理器执行的计算机程序，处理器11可以根据存储在ROM 12中的计算机程序或者从存储单元18加载到RAM 13中的计算机程序，来执行多种适当的动作和处理。在RAM 13中，还可存储电子设备10操作所需的多种程序和数据。处理器11、ROM 12以及RAM 13通过总线14彼此相连。输入/输出(Input/Output，I/O)接口15也连接至总线14。
电子设备10中的多个部件连接至I/O接口15，包括：输入单元16，例如键盘、鼠标等；输出单元17，例如多种类型的显示器、扬声器等；存储单元18，例如磁盘、光盘等；以及通信单元19，例如网卡、调制解调器、无线通信收发机等。通信单元19允许电子设备10通过诸如因特网的计算机网络和/或多种电信网络与其他设备交换信息/数据。
处理器11可以是多种具有处理和计算能力的通用和/或专用处理组件。处理器11的一些示例包括但不限于中央处理单元(Central Processing Unit，CPU)、图形处理单元(Graphics Processing Unit，GPU)、多种专用的人工智能(Artificial Intelligence，AI)计算芯片、多种运行机器学习模型算法的处理器、数字信号处理器(Digital Signal Processing，DSP)、以及任何适当的处理器、控制器、微控制器等。处理器11执行上文所描述的多个方法和处理，例如防篡改的数据保护方法。
在一些实施例中，防篡改的数据保护方法可被实现为计算机程序，其被有形地包含于计算机可读存储介质，例如存储单元18。在一些实施例中，计算机程序的部分或者全部可以经由ROM 12和/或通信单元19而被载入和/或安装到电 子设备10上。当计算机程序加载到RAM 13并由处理器11执行时，可以执行上文描述的防篡改的数据保护方法中的一个或多个步骤。备选地，在其他实施例中，处理器11可以通过其他任何适当的方式(例如，借助于固件)而被配置为执行防篡改的数据保护方法。
本文中以上描述的系统和技术的多种实施方式可以在数字电子电路系统、集成电路系统、场可编程门阵列(Field Programmable Gate Array，FPGA)、专用集成电路(Application Specific Integrated Circuit，ASIC)、专用标准产品(Application Specific Standard Parts，ASSP)、芯片上系统的系统(System on Chip，SOC)、负载可编程逻辑设备(Complex Programming logic device，CPLD)、计算机硬件、固件、软件、和/或它们的组合中实现。这些多种实施方式可以包括：实施在一个或者多个计算机程序中，该一个或者多个计算机程序可在包括至少一个可编程处理器的可编程系统上执行和/或解释，该可编程处理器可以是专用或者通用可编程处理器，可以从存储系统、至少一个输入装置、和至少一个输出装置接收数据和指令，并且将数据和指令传输至该存储系统、该至少一个输入装置、和该至少一个输出装置。
用于实施本申请的方法的计算机程序可以采用一个或多个编程语言的任何组合来编写。这些计算机程序可以提供给通用计算机、专用计算机或其他可编程数据处理装置的处理器，使得计算机程序当由处理器执行时使流程图和/或框图中所规定的功能/操作被实施。计算机程序可以完全在机器上执行、部分地在机器上执行，作为独立软件包部分地在机器上执行且部分地在远程机器上执行或完全在远程机器或服务器上执行。
在本申请的上下文中，计算机可读存储介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的计算机程序。计算机可读存储介质可以包括但不限于电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。备选地，计算机可读存储介质可以是机器可读信号介质。机器可读存储介质的示例会包括基于一个或多个线的电气连接、便携式计算机盘、硬盘、RAM、ROM、可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM或快闪存储器)、光纤、便捷式紧凑盘只读存储器(Compact Disc Read-Only Memory，CD-ROM)、光学储存设备、磁储存设备、或上述内容的任何合适组合。
为了提供与用户的交互，可以在电子设备上实施此处描述的系统和技术，该电子设备具有：设置为向用户显示信息的显示装置(例如，阴极射线管(Cathode Ray Tube，CRT)或者液晶显示器(Liquid Crystal Display，LCD)监视器)；以 及键盘和指向装置(例如，鼠标或者轨迹球)，用户可以通过该键盘和该指向装置来将输入提供给电子设备。其它种类的装置还可以设置为提供与用户的交互；例如，提供给用户的反馈可以是任何形式的传感反馈(例如，视觉反馈、听觉反馈、或者触觉反馈)；并且可以用任何形式(包括声输入、语音输入或者、触觉输入)来接收来自用户的输入。
可以将此处描述的系统和技术实施在包括后台部件的计算系统(例如，作为数据服务器)、或者包括中间件部件的计算系统(例如，应用服务器)、或者包括前端部件的计算系统(例如，具有图形用户界面或者网络浏览器的用户计算机，用户可以通过该图形用户界面或者该网络浏览器来与此处描述的系统和技术的实施方式交互)、或者包括这种后台部件、中间件部件、或者前端部件的任何组合的计算系统中。可以通过任何形式或者介质的数字数据通信(例如，通信网络)来将系统的部件相互连接。通信网络的示例包括：局域网(Local Area Network，LAN)、广域网(Wide Area Network，WAN)、区块链网络和互联网。
计算系统可以包括客户端和服务器。客户端和服务器一般远离彼此并且通常通过通信网络进行交互。通过在相应的计算机上运行并且彼此具有客户端-服务器关系的计算机程序来产生客户端和服务器的关系。服务器可以是云服务器，又称为云计算服务器或云主机，是云计算服务体系中的一项主机产品，以解决了传统物理主机与虚拟专用服务器(Virtual Private Server，VPS)服务中，存在的管理难度大，业务扩展性弱的缺陷。
可以使用上面所示的多种形式的流程，重新排序、增加或删除步骤。例如，本申请中记载的多个步骤可以并行地执行也可以顺序地执行也可以不同的次序执行，只要能够实现本申请的技术方案所期望的结果，本文在此不进行限制。

Claims (12)

  1. 一种防篡改的数据保护方法，运行于计算机系统内核中，包括：
    获取对数据的访问指令，其中，所述访问指令包括访问对象路径和访问进程信息；
    判断所述访问对象路径是否存在于维护的保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下；
    响应于所述访问对象路径不存在于维护的所述保护路径白名单列表以及所述保护路径白名单列表中一个路径的子路径下，产生允许调用信号；响应于所述访问对象路径存在于维护的所述保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，根据所述访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中；
    响应于当前访问进程存在于维护的所述进程白名单列表中，产生允许调用信号；响应于当前访问进程不存在于维护的所述进程白名单列表中，产生拒绝访问信号；
    其中，所述保护路径白名单列表的获取方法包括：
    获取保护对象的绝对路径以及对应的保护权限，生成相应的接口校验码；
    对所述接口校验码进行校验，校验成功后，生成注册校验码；
    对所述注册校验码进行校验，校验成功后，将对应的保护对象的绝对路径加入所述保护路径白名单列表中，所述保护路径白名单列表存储于所述计算机系统内核中，所述保护路径白名单列表中的每条路径具有对应的保护权限；
    所述进程白名单列表的获取方法包括：
    获取需要注册的进程信息，生成相应的接口校验码；
    对所述接口校验码进行校验，校验成功后，生成注册校验码；
    对所述注册校验码进行校验，校验成功后，将对应的需要注册的进程信息加入所述进程白名单列表中，所述进程白名单列表存储于所述计算机系统内核中。
  2. 根据权利要求1所述的防篡改的数据保护方法，其中，所述保护对象包括文件、目录或者设备。
  3. 根据权利要求2所述的防篡改的数据保护方法，其中，在所述保护对象为文件或目录的情况下，所述保护路径白名单列表的获取方法还包括：
    在所述注册校验码校验成功的情况下，获取对应的分区和磁盘信息。
  4. 根据权利要求1所述的防篡改的数据保护方法，其中，所述进程信息包括进程识别号PID和进程名称。
  5. 根据权利要求1所述的防篡改的数据保护方法，其中，采用安全套接层SSL加密认证方式生成所述接口校验码、所述注册校验码或对所述接口校验码进行校验。
  6. 一种防篡改的数据保护系统，包括配置模块、参数校验模块、用户态交互模块和系统调用校验驱动模块，其中，
    所述系统调用校验驱动模块设置为获取对数据的访问指令，其中，所述访问指令包括访问对象路径和访问进程信息，判断所述访问对象路径是否存在于维护的保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，响应于所述访问对象路径存在于维护的所述保护路径白名单列表或所述保护路径白名单列表中一个路径的子路径下，根据所述访问进程信息判断当前访问进程是否存在于维护的进程白名单列表中，响应于当前访问进程存在于维护的所述进程白名单列表中，产生允许调用信号，响应于当前访问进程不存在于维护的所述进程白名单列表中，产生拒绝访问信号；
    所述保护路径白名单列表和所述进程白名单列表由所述配置模块、所述参数校验模块、所述用户态交互模块和所述系统调用校验驱动模块的协作获取；
    所述配置模块设置为获取保护对象的绝对路径以及对应的保护权限，调用所述参数校验模块生成相应的接口校验码，并将所述绝对路径和所述接口校验码传输给所述用户态交互模块；所述用户态交互模块设置为调用所述参数校验模块对所述接口校验码进行校验，校验成功后，调用所述参数校验模块生成注册校验码，并将所述绝对路径和所述注册校验码传输给所述系统调用校验驱动模块；所述系统调用校验驱动模块还设置为对所述注册校验码进行校验，校验成功后，将对应的保护对象的绝对路径加入所述保护路径白名单列表中，所述保护路径白名单列表中的每条路径具有对应的保护权限；
    所述参数校验模块设置为被需要注册的用户态程序调用以生成相应的接口校验码，所述用户态交互模块还设置接收所述需要注册的用户态程序的进程信息和所述接口校验码；所述用户态交互模块还设置为调用所述参数校验模块对所述接口校验码进行校验，校验成功后，调用所述参数校验模块生成注册校验码，并将所述进程信息和所述注册校验码传输给所述系统调用校验驱动模块；所述系统调用校验驱动模块还设置为对所述注册校验码进行校验，校验成功后，将对应的需要注册的进程信息加入所述进程白名单列表中；
    所述系统调用校验驱动模块内置于计算机系统内核中。
  7. 根据权利要求6所述的防篡改的数据保护系统，其中，所述保护对象包括文件、目录或者设备。
  8. 根据权利要求6所述的防篡改的数据保护系统，其中，所述保护对象为文件或目录，在所述保护路径白名单列表的获取过程中，所述用户态交互模块还设置为在生成的所述注册校验码校验成功后，获取对应的分区和磁盘信息。
  9. 根据权利要求6所述的防篡改的数据保护系统，其中，所述进程信息包括进程识别号PID和进程名称。
  10. 根据权利要求6所述的防篡改的数据保护系统，其中，所述配置模块和所述用户态交互模块设置为通过安全套接层SSL加密认证方式调用所述参数校验模块。
  11. 一种电子设备，包括：
    至少一个处理器；以及
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的计算机程序，所述计算机程序被所述至少一个处理器执行，以使所述至少一个处理器能够执行权利要求1-5中任一项所述的防篡改的数据保护方法。
  12. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机指令，所述计算机指令用于使处理器执行时实现权利要求1-5中任一项所述的防篡改的数据保护方法。
PCT/CN2023/077079 2022-07-28 2023-02-20 防篡改的数据保护方法及系统 WO2024021577A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210898693.5A CN115310084A (zh) 2022-07-28 2022-07-28 一种防篡改的数据保护方法及系统
CN202210898693.5 2022-07-28

Publications (1)

Publication Number Publication Date
WO2024021577A1 true WO2024021577A1 (zh) 2024-02-01

Family

ID=83858732

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/077079 WO2024021577A1 (zh) 2022-07-28 2023-02-20 防篡改的数据保护方法及系统

Country Status (2)

Country Link
CN (1) CN115310084A (zh)
WO (1) WO2024021577A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115310084A (zh) * 2022-07-28 2022-11-08 上海爱数信息技术股份有限公司 一种防篡改的数据保护方法及系统
CN116628693B (zh) * 2023-07-25 2023-09-29 积至网络(北京)有限公司 一种基于预配置信物的勒索软件防御方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7644271B1 (en) * 2005-11-07 2010-01-05 Cisco Technology, Inc. Enforcement of security policies for kernel module loading
CN106778243A (zh) * 2016-11-28 2017-05-31 北京奇虎科技有限公司 基于虚拟机的内核漏洞检测文件保护方法及装置
CN112269644A (zh) * 2020-10-16 2021-01-26 苏州浪潮智能科技有限公司 一种子进程调用的验证方法、系统、设备及可读存储介质
CN114692134A (zh) * 2022-04-22 2022-07-01 博智安全科技股份有限公司 一种基于linux内核进程监控来保护代码及数据的系统和方法
CN115310084A (zh) * 2022-07-28 2022-11-08 上海爱数信息技术股份有限公司 一种防篡改的数据保护方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7644271B1 (en) * 2005-11-07 2010-01-05 Cisco Technology, Inc. Enforcement of security policies for kernel module loading
CN106778243A (zh) * 2016-11-28 2017-05-31 北京奇虎科技有限公司 基于虚拟机的内核漏洞检测文件保护方法及装置
CN112269644A (zh) * 2020-10-16 2021-01-26 苏州浪潮智能科技有限公司 一种子进程调用的验证方法、系统、设备及可读存储介质
CN114692134A (zh) * 2022-04-22 2022-07-01 博智安全科技股份有限公司 一种基于linux内核进程监控来保护代码及数据的系统和方法
CN115310084A (zh) * 2022-07-28 2022-11-08 上海爱数信息技术股份有限公司 一种防篡改的数据保护方法及系统

Also Published As

Publication number Publication date
CN115310084A (zh) 2022-11-08

Similar Documents

Publication Publication Date Title
JP7545419B2 (ja) 統合された隔離されたアプリケーションにおけるランサムウェアの被害の軽減
US10361998B2 (en) Secure gateway communication systems and methods
WO2024021577A1 (zh) 防篡改的数据保护方法及系统
KR101067399B1 (ko) 대칭 키 암호화에 기초한 데이터의 저장 및 검색을 위한, 컴퓨팅 장치에서 구현되는 방법, 시스템 및 복수의 명령어를 저장하는 하나 이상의 컴퓨터 판독가능 매체
EP1946238B1 (en) Operating system independent data management
US10079835B1 (en) Systems and methods for data loss prevention of unidentifiable and unsupported object types
US20110314279A1 (en) Single-Use Authentication Methods for Accessing Encrypted Data
CN112805708B (zh) 保护计算机系统上的选定磁盘
US12111893B2 (en) System and method for protecting software licensing information via a trusted platform module
EP3079057B1 (en) Method and device for realizing virtual machine introspection
US9219728B1 (en) Systems and methods for protecting services
CN108023732B (zh) 一种数据保护方法、装置、设备和存储介质
EP4006758B1 (en) Data storage apparatus with variable computer file system
CN114730338A (zh) 用于发现应用程序篡改的系统和方法
Siby et al. GuaranTEE: Towards Attestable and Private ML with CCA
WO2024035509A1 (en) Identification of a resource attack path by connecting code, configuration, and telemetry
US11671422B1 (en) Systems and methods for securing authentication procedures
TWI780655B (zh) 能分隔應用程式程序之資料處理系統及資料處理方法
KR102618922B1 (ko) 무기체계 임베디드 시스템의 sw 역공학 방지장치 및 그 방법
RU2817533C1 (ru) Способ и система однонаправленной передачи данных между вычислительными устройствами
KR102551891B1 (ko) 클라우드 접근권한 및 계정을 관리하기 위한 방법 및 시스템
EP4081917B1 (en) System and method for protecting software licensing information via a trusted platform module
RU2807463C2 (ru) Ослабление программы-вымогателя в интегрированных изолированных приложениях
US20240323226A1 (en) Snapshot phishing detection and threat analysis
Jia Research on Data Security Based on Cloud Computing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23844796

Country of ref document: EP

Kind code of ref document: A1