Remote office data anti-leakage system

Abstract

The invention relates to the technical field of office safety, in particular to a remote office data leakage prevention system which comprises a server, a leader end, an employee end, an access module, a monitoring module, an identification module, a safety module and a behavior analysis module. And an internal network system of the company is established, and office service and company management are provided for employees and leaders of the company through the network. According to the remote office data anti-leakage system, the monitoring module and the recognition module are arranged to monitor computer equipment accessed to a company server in real time, when employees browse various files, pictures, videos and audios during work, potential sensitive information is automatically recognized and classified, the recognition processing technology is adopted, and the safety of the employees is improved. And for each operation identification of the employees, real-time company data leakage prevention is realized, and the information security of the company is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of office security, and in particular to a remote office data leakage prevention system. Background Art

[0002] With the rapid development of the Internet, more and more companies will adopt remote working solutions to provide employees with a more diverse office environment. In order to ensure the company's network office security, most companies' security protection solutions now provide data encryption, firewalls, anti-virus and anti-malware protection measures to ensure the company's internal information security and prevent employees from making non-compliant operations, causing company data leaks and threatening the company's security.

[0003] At present, when preventing the leakage of company security data, a safe security encryption scheme is generated through the above method. However, it is usually impossible to intelligently identify specific images or behavioral events, nor to monitor data operations in real time. Most of them remain at the traditional protection method, lacking comprehensive protection based on the direction of image and event recognition in modern workflows, and unable to effectively monitor and block potential data leakage channels, resulting in the leakage of the company's core information and data, causing irreparable losses to the company. Summary of the invention

[0004] The purpose of the present invention is to provide a remote office data leakage prevention system to solve the problems raised in the above background technology.

[0005] To achieve the above-mentioned object, the present invention provides the following technical solutions: a remote office data leakage prevention system, comprising a server, a leader terminal, an employee terminal, an access module, a monitoring module, an identification module, a security module and a behavior analysis module;

[0006] Servers are used for company management and service provision equipment set up by the company's remote office, to build the company's own intranet system, and to provide office services and company management to company employees and leaders through the network;

[0007] The user end used by the company's employees and leaders to access the company's server. Computer equipment is used to access the server here. The leader end and the employee end communicate with the company's server remotely through the network to realize the office work of employees and middle-level leaders, as well as the management of the leader end;

[0008] The access module is used to set up a layer of protection for the company server. When employees and leaders access the company server for work, they must pass the identity authentication through the access module. After the identity authentication is completed, the corresponding permissions of the employees and leaders are confirmed. Then, employees and leaders can only access the company's intranet system according to their own login system permissions;

[0009] The monitoring module is used to monitor the office process of employees and leaders, and monitor the computer devices accessing the company's server system, and monitor the reading, writing, and transmission of all files on the company's server by the employee's computer devices;

[0010] Identification module: The server monitors and inspects the office process of employees and leaders. When abnormal behavior, data and sensitive information are detected, the identification module will judge the operation behavior of the corresponding employee, record the illegal files and content, and send an alarm to the supervision department. When serious illegal operations occur, the identification module will promptly cut off the access connection between the server and the corresponding employee to provide data security blocking;

[0011] The security module is used for the security of files accessed by employees on the company's server. When writing, reading, exporting and transferring files, the security module will generate corresponding anti-counterfeiting and security watermarks for the files to prevent the company's files from being used privately. It will also encrypt the files to create a secure file use environment.

[0012] The behavior analysis module records the various operations performed by employees when accessing the company's server. It also makes judgments and estimates on risky operations. It then conducts a predictive risk assessment on the corresponding employees to identify potential safety hazards in their work.

[0013] In a further embodiment, the monitoring module includes a file module, picture monitoring, text monitoring, voice monitoring and video monitoring;

[0014] The file module is used to monitor all company files written, read, exported and transmitted on the server, and scan the contents of the files to confirm the security of the files;

[0015] The picture monitoring, text monitoring, voice monitoring and video monitoring are used for online monitoring of the corresponding user end and the leadership end, and all pictures, texts, voices and videos accessed by the employee end in the company server are monitored and recorded in real time.

[0016] In a further embodiment, the monitoring module further includes a keyboard and mouse operation monitoring module and a keyboard and mouse operation analysis module;

[0017] The keyboard and mouse operation monitoring module is used to identify the mouse movement and stop position of the employee's terminal, as well as the content input and deleted by the keyboard, monitor the keyboard and mouse operations, and monitor the office operation content of the corresponding employee terminal;

[0018] The keyboard and mouse operation analysis module monitors the keyboard and mouse operation content of the employee side, predicts the operation intention of the corresponding employee side based on the monitored data analysis, and analyzes and identifies potential data leakage behaviors based on the results of the analysis and prediction.

[0019] In a further embodiment, the identification module includes a scanning module, a determination module, a sensitive content recording module, an alarm module, and a disconnection module;

[0020] The scanning module is used for scanning and reading the contents of corresponding files when the employee writes, reads, exports and transmits company files in the intranet system of the company server;

[0021] The judgment module is used to judge the content of the scanned file, separate and judge the sensitive content of the judged file, and confirm whether the file contains sensitive company information;

[0022] The sensitive content recording module is used to record the sensitive information that has been identified and confirmed, and send the recorded information to the supervision department to keep records of illegal operations.

[0023] In a further embodiment, the alarm module, when sensitive content or company confidential content appears in the file, will send an alarm message of illegal operation to the company's supervisory department and the company's leadership end, and send the corresponding employee's end information to the supervisory department and the company's leadership end;

[0024] When the disconnection module detects that the corresponding employee has violated the regulations and has the risk of leaking the company's core content, the disconnection module will actively cut off the authorization authority of the corresponding employee, stop the corresponding employee from continuing to access the company's intranet system, and promptly cut off the employee's access rights to ensure the data security of the company's server.

[0025] In a further embodiment, the security module includes a watermark generation module and a watermark synthesis module;

[0026] The watermark generation module generates a corresponding type of security watermark according to the file type written, read, exported and transmitted by the employee end in the server. A watermark layer is covered on the surface of text documents and pictures, a dynamic active watermark is generated on the screen of video files, and a pre-recorded company watermark audio is inserted at the front and back of the audio file. The corresponding file watermark is generated in real time according to the corresponding file type used;

[0027] The watermark synthesis module synthesizes the generated watermark into the file according to the file type. During the subsequent use of all company files, the corresponding watermark synthesized in the file ensures the safety of the file.

[0028] In a further embodiment, the security module further includes a password generation module, a password embedding module and a password sharing module;

[0029] The password generation module generates a corresponding encryption password when the employee writes, reads, exports and transfers files in the server, encrypts the company's files, and the password is a dynamic password;

[0030] The password embedding module generates a password that will automatically encrypt the corresponding file when the file is transmitted. The encrypted file will have an upper limit of five incorrect password inputs. When the file encryption password is entered incorrectly five times, the content in the file will be automatically erased. The original file will be re-encrypted when it is transmitted again on the server.

[0031] In the password sharing module, the company leader obtains the basic encryption password of the transmitted file, and shares the password of the corresponding file to the corresponding employee through the server. The password is a dynamic password. One file will generate one hundred sets of passwords for dynamic replacement at the same time. The password is dynamically replaced after the file is transferred. If the employee who does not participate in the project downloads and transmits the file, the encryption password cannot be shared. The security of company files is guaranteed by encrypting and adding watermarks to company files.

[0032] In a further embodiment, the behavior analysis module includes a behavior marking module, a behavior recording module, a behavior judgment module, a risk estimation module, and a result generation module;

[0033] The behavior marking module is used to mark various operations performed by the employee on the server. In particular, when the employee performs illegal operations and sensitive information operations, the behavior marking module focuses on marking the content that affects the company's security.

[0034] The behavior recording module records the marked operation content of the corresponding employee end when an unsafe operation on the employee end is marked;

[0035] The behavior judgment module analyzes and judges the marked and recorded employee-side operation information. When it is determined that there is leakage of company data, sensitive information and core technical operations, the server authority of the corresponding employee side is restricted, and the corresponding employee side is denied server access. The employee's work behavior is analyzed to achieve risk assessment for the corresponding employees, realize early prevention, and prevent data leakage.

[0036] In a further embodiment, the risk estimation module is used to estimate the loss risk caused to the company by the employee terminal that has security risk operations, estimate the risk level of the corresponding employee terminal's current operation, and the potential security risks in the future, and make a risk assessment on the security of the corresponding employee terminal;

[0037] The result generation module generates a report on the risk assessment of the employee side, and then transmits it to the company's leadership side through the server, so that the company can analyze the employees' risk.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The present invention monitors computer devices connected to the company's server in real time by setting up a monitoring module and an identification module. When employees browse various files, pictures, videos and audios during work, the present invention automatically identifies and classifies potential sensitive information. It uses identification processing technology to identify various operations of employees, so as to prevent data leakage and ensure the company's information security.

[0040] 2. The present invention, by setting a security module, encrypts and adds identification watermarks to the files written, read, exported and transmitted by the company, preventing the company's files from being copied and stolen in the external network. At the same time, the encrypted files can effectively ensure the security of the files, prevent the files from being transmitted to the network outside the company, and ensure the security of the company's files;

[0041] 3. The present invention, by setting up a behavior analysis module, can record and analyze various operation behaviors of employees and leaders in the server. When employees or leaders violate regulations or leak data, the company server access rights of the corresponding employees or leaders can be closed in time, thus cutting off risks in time and ensuring the company's information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the system framework of the anti-leakage system of the present invention;

[0043] Figure 2 A schematic diagram of the system framework of the monitoring module of the present invention;

[0044] Figure 3 It is a schematic diagram of the system framework of the identification module of the present invention;

[0045] Figure 4 It is a schematic diagram of the system framework of the security module of the present invention;

[0046] Figure 5 This is a schematic diagram of the system framework of the behavior analysis module of the present invention;

[0047] Figure 6 It is a schematic diagram of the overall system framework of the present invention;

[0048] Figure 7 It is a schematic diagram of the flow of the anti-leakage system of the present invention. DETAILED DESCRIPTION

[0049] The following will be described clearly and completely in conjunction with the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] Example 1

[0051] See also Figure 1 - Figure 7 ,This embodiment provides a remote office data leakage prevention system, including a server, a leader terminal, an employee terminal, an access module, a monitoring module, an identification module, a security module and a behavior analysis module;

[0052] Servers are used for company management and service provision equipment set up by the company's remote office, to build the company's own intranet system, and to provide office services and company management to company employees and leaders through the network;

[0053] The leadership end and the employee end are user ends for the company's employees and leaders to access the company's server. Computer devices are used to access the server. The leadership end and the employee end communicate with the company's server remotely through the network to realize the office work of employees and middle-level leaders, as well as the management of the leadership end;

[0054] The access module is used to set up a layer of protection for the company server. When employees and leaders access the company server for work, they must pass the identity authentication through the access module. After the identity authentication is completed, the corresponding permissions of the employees and leaders are confirmed. Then, employees and leaders can only access the company's intranet system according to their own login system permissions;

[0055] The monitoring module is used to monitor the office process of employees and leaders, and monitor the computer devices accessing the company's server system, and monitor the reading, writing, and transmission of all files on the company's server by the employee's computer devices;

[0056] Identification module: The server monitors and inspects the office process of employees and leaders. When abnormal behavior, data and sensitive information are detected, the identification module judges the operation behavior of the corresponding employee end, records the illegal files and content, and sends an alarm to the supervision department. When serious illegal operations occur, the identification module will promptly cut off the access connection between the server and the corresponding employee end, provide data security blocking, and can monitor and identify the operations of employees and middle-level leaders in real time. When possible risk problems arise, the employee end can be blocked and cut off from access rights in a timely manner to ensure the company's data security;

[0057] The security module is used for the security of files accessed by employees on the company's server. When writing, reading, exporting and transferring files, the security module will generate corresponding anti-counterfeiting and security watermarks for the files to prevent the company's files from being used privately. It will also encrypt the files to create a secure file use environment, ensuring the company's file data security and the secure transmission of files during use.

[0058] The behavior analysis module records the illegal operations performed by employees when they access the company's server, and makes judgments and estimates on risky illegal operations. It then conducts a predictive risk assessment on the corresponding employees to identify potential safety hazards in their work. By analyzing work behaviors, the company can warn each employee in advance and prevent data leakage in advance.

[0059] The monitoring modules include file module, picture monitoring, text monitoring, voice monitoring and video monitoring;

[0060] The file module is used to monitor all company files written, read, exported and transmitted on the server, and scan the contents of the files to confirm the security of the files;

[0061] Image monitoring, text monitoring, voice monitoring and video monitoring are used for online monitoring of the corresponding user end and leadership end. All images, texts, voices and videos accessed by employees in the company server are monitored and recorded in real time. The files accessed by employees or middle-level leaders while working in the company server are monitored in real time. When there is improper operation, it can be monitored in time to ensure the company's data security.

[0062] The monitoring module also includes a keyboard and mouse operation monitoring module and a keyboard and mouse operation analysis module;

[0063] The keyboard and mouse operation monitoring module is used to identify the mouse movement and rest position of the employee's end, as well as the content entered and deleted by the keyboard, monitor the keyboard and mouse operations, and monitor the office operation content of the corresponding employee end;

[0064] The keyboard and mouse operation analysis module monitors the keyboard and mouse operation content of the employee side, predicts the operation intention of the corresponding employee side based on the monitored data analysis, and analyzes and identifies potential data leakage behaviors based on the results of the analysis and prediction. When employees operate computer devices through keyboard and mouse, including copying, reprinting and screenshots, the system will analyze the operation content of the employee side or the leader side. When the company's core information is touched, the operation behavior will be analyzed. If there is a risk of leakage, the employee's authority will be restricted and cut off in time to ensure the company's security.

[0065] Example 2

[0066] See also Figure 3 , further improvements were made on the basis of Example 1:

[0067] The identification module includes a scanning module, a judgment module, a sensitive content recording module, an alarm module and a disconnection module;

[0068] The scanning module is used for scanning and reading the contents of corresponding files when the employee writes, reads, exports and transmits company files in the intranet system of the company server;

[0069] The judgment module is used to judge the content of the scanned file, separate and judge the sensitive content of the file after the judgment, and confirm whether the file contains sensitive information of the company;

[0070] The sensitive content recording module is used to record the sensitive information that has been identified and judged, and send the recorded information to the supervisory department to keep records of illegal operations.

[0071] Alarm module: When sensitive content or company confidential content appears in the file, the alarm module will send an alarm message of illegal operation to the company's supervision department and the company's leadership, and send the corresponding employee's information to the supervision department and the company's leadership, so as to issue an alarm in time and ensure that the company can make corresponding processing operations in time;

[0072] The disconnect module, when it detects that the corresponding employee has violated the regulations and has the risk of leaking the company's core content, will actively cut off the authorization rights of the corresponding employee and stop the corresponding employee from continuing to access the company's intranet system. By timely cutting off the employee's access rights, the company's data security is ensured.

[0073] Example 3

[0074] See also Figure 4 , further improvements were made on the basis of Example 1:

[0075] The security module includes a watermark generation module and a watermark synthesis module;

[0076] The watermark generation module generates corresponding types of security watermarks according to the file types written, read, exported and transmitted by the employee in the server. A watermark layer is covered on the surface of text documents and pictures, a dynamic active watermark is generated on the screen for video files, and a pre-recorded company watermark audio is inserted at the front and back of the audio file. The corresponding file watermark is generated in real time according to the corresponding file type used;

[0077] The watermark synthesis module synthesizes the generated watermark into the file according to the file type. During the subsequent use of all the company's files, the corresponding watermark synthesized in the file can ensure the safety of the file. By adding watermarks with corresponding functions to the files transmitted by the company, the watermark identification can be covered on the file to ensure the safety of the file and prevent theft.

[0078] The security module also includes a password generation module, a password embedding module and a password sharing module;

[0079] Password generation module: When employees write, read, export and transfer files in the server, the password generation module generates a corresponding encryption password to encrypt the company's files. The password is a dynamic password, which can better improve the security of file encryption and prevent employees who obtain the password from leaking files.

[0080] Password embedding module: When the generated password is transmitted, the corresponding file will be automatically encrypted. The encrypted file will have an upper limit of five incorrect password inputs. When the file encryption password is entered incorrectly five times, the content in the file will be automatically erased. The original file will be re-encrypted when it is transmitted again on the server.

[0081] In the password sharing module, the company leader obtains the basic encryption password for the transmitted file and shares the password of the corresponding file to the corresponding employee through the server. The password is a dynamic password. One file will generate one hundred sets of passwords for dynamic replacement at the same time. The password is replaced by the dynamic password after the file is transferred. If the employee who is not involved in the project downloads and transfers the file, the encryption password cannot be shared. Through the setting of dynamic passwords, employees and leaders of the docking project can only obtain the basic first set of file passwords. When the file is transferred by the employee to other devices, the file will be automatically replaced with another set of passwords from the pre-set one hundred sets of passwords. At this time, the file cannot be opened, ensuring the security of the file and preventing the file from being transferred to other devices, causing data leakage, thereby ensuring the company's data security.

[0082] Example 4

[0083] See also Figure 5 , further improvements were made on the basis of Example 1:

[0084] The behavior analysis module includes a behavior marking module, a behavior recording module, a behavior judgment module, a risk estimation module, and a result generation module;

[0085] The behavior marking module is used to mark various operations performed by employees on the server. In particular, when illegal operations and sensitive information operations occur on the employee side, the behavior marking module focuses on marking the content that affects the company's security and marks improper operations performed by employees during work, which facilitates the judgment of the corresponding employees and prevents the occurrence of data leakage by employees.

[0086] Behavior recording module: when an unsafe operation is marked on the employee side, the behavior recording module records the marked operation content on the corresponding employee side;

[0087] The behavior judgment module analyzes and judges the marked and recorded employee-side operation information. When it is determined that there is leakage of company data, sensitive information and core technical operations, the server permission of the corresponding employee side is restricted and the corresponding employee side is denied server access.

[0088] The risk estimation module is used to estimate the loss risk caused to the company by the employee side who performs security risk operations, estimate the risk level of the corresponding employee side's operation, and the potential safety hazards in the future, make a risk assessment on the security of the corresponding employee side, and generate employee behavior profiles for the company's employees, so that risk estimates can be made for each employee in advance, ensuring that the company can respond to improper operations of employees in a timely manner;

[0089] The result generation module generates a report on the risk assessment on the employee side, and then transmits it to the company's leadership side through the server, which is convenient for generating employee portraits. It is used for the company to make judgments on the corresponding employees or leaders, realize employee analysis and focus on employees. When the corresponding employees violate the regulations, the employee's access rights can be blocked in time to ensure the company's safety.

[0090] When using the data leakage prevention system, the employee verifies the identity information through the access module to log in to the company's server. At this time, the working computer equipment is connected to the intranet system of the company's server and can perform daily work. At this time, the monitoring module will monitor the employee. The monitored content includes but is not limited to files, text content, pictures, videos, audio and screenshots, etc., and the keyboard input and mouse movement trajectory and click content will be monitored. When sensitive information exists, the system will identify whether the operation of the employee or middle-level leader is risky, and use the operation analysis method to analyze whether there is an information leakage problem. When an information leakage risk warning appears, the system will actively cut off the connection between the employee or leader and the server, and limit the access rights of the corresponding employee to prevent information leakage. After the review is completed, it is confirmed whether the corresponding employee or leader is safe before continuing to open access rights or further processing;

[0091] The remote office system is specifically an offshore remote office platform. The remote office system has mutual trust between employees and leaders. Remote office data leakage prevention is a subsystem of the offshore remote office platform, which is used to monitor all work operations of employees in the offshore remote office platform to ensure the security of the entire remote office process. The offshore remote office platform is divided into two parts: "remote" and "office". It means to realize non-local office through modern Internet technology, and to realize remote office modes such as working at home, working in other places and mobile office through network communication.

[0092] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A remote office data leakage prevention system, characterized by: It includes server, leader terminal, employee terminal, access module, monitoring module, identification module, security module and behavior analysis module; Servers are used for company management and service provision equipment set up by the company's remote office, to build the company's own intranet system, and to provide office services and company management to company employees and leaders through the network; The leadership end and the employee end are user ends for the company's employees and leaders to access the company's server. Computer devices are used to access the server. The leadership end and the employee end communicate with the company's server remotely through the network to realize the office work of employees and middle-level leaders, as well as the management of the leadership end; The access module is used to set up a layer of protection for the company server. When employees and leaders access the company server for work, they must pass the identity authentication through the access module. After the identity authentication is completed, the corresponding permissions of the employees and leaders are confirmed. Then, employees and leaders can only access the company's intranet system according to their own login system permissions; The monitoring module is used to monitor the office process of employees and leaders, and monitor the computer devices accessing the company's server system, and monitor the reading, writing, and transmission of all files on the company's server by the employee's computer devices; Identification module: The server monitors and inspects the office process of employees and leaders. When abnormal behavior, data and sensitive information are detected, the identification module will judge the operation behavior of the corresponding employee, record the illegal files and content, and send an alarm to the supervision department. When serious illegal operations occur, the identification module will promptly cut off the access connection between the server and the corresponding employee to provide data security blocking; The security module is used for the security of files accessed by employees on the company's server. When writing, reading, exporting and transferring files, the security module will generate corresponding anti-counterfeiting and security watermarks for the files to prevent the company's files from being used privately. It will also encrypt the files to create a secure file use environment. The behavior analysis module records the various operations performed by employees when accessing the company's server. It also makes judgments and estimates on risky operations. It then conducts a predictive risk assessment on the corresponding employees to identify potential safety hazards in their work.

2. A remote office data leakage prevention system according to claim 1, characterized in that: The monitoring module includes file module, picture monitoring, text monitoring, voice monitoring and video monitoring; The file module is used to monitor all company files written, read, exported and transmitted on the server, and scan the contents of the files to confirm the security of the files; The picture monitoring, text monitoring, voice monitoring and video monitoring are used for online monitoring of the corresponding user end and the leadership end, and all pictures, texts, voices and videos accessed by the employee end in the company server are monitored and recorded in real time.

3. A remote office data leakage prevention system according to claim 1, characterized in that: The monitoring module also includes a keyboard and mouse operation monitoring module and a keyboard and mouse operation analysis module; The keyboard and mouse operation monitoring module is used to identify the mouse movement and stop position of the employee's terminal, as well as the content input and deleted by the keyboard, monitor the keyboard and mouse operations, and monitor the office operation content of the corresponding employee terminal; The keyboard and mouse operation analysis module monitors the keyboard and mouse operation content of the employee side, predicts the operation intention of the corresponding employee side based on the monitored data analysis, and analyzes and identifies potential data leakage behaviors based on the results of the analysis and prediction.

4. A remote office data leakage prevention system according to claim 1, characterized in that: The identification module includes a scanning module, a judgment module, a sensitive content recording module, an alarm module and a disconnection module; The scanning module is used for scanning and reading the contents of corresponding files when the employee writes, reads, exports and transmits company files in the intranet system of the company server; The judgment module is used to judge the content of the scanned file, separate and judge the sensitive content of the judged file, and confirm whether the file contains sensitive company information; The sensitive content recording module is used to record the sensitive information that has been identified and confirmed, and send the recorded information to the supervision department to keep records of illegal operations.

5. A remote office data leakage prevention system according to claim 4, characterized in that: The alarm module, when sensitive content or company confidential content appears in the file, will send an alarm message of illegal operation to the company's supervisory department and the company's leadership end, and send the corresponding employee's information to the supervisory department and the company's leadership end; When the disconnection module detects that the corresponding employee has violated the regulations and has the risk of leaking the company's core content, the disconnection module will actively cut off the authorization authority of the corresponding employee and stop the corresponding employee from continuing to access the company's intranet system.

6. A remote office data leakage prevention system according to claim 1, characterized in that: The security module includes a watermark generation module and a watermark synthesis module; The watermark generation module generates a corresponding type of security watermark according to the file type written, read, exported and transmitted by the employee end in the server. A watermark layer is covered on the surface of text documents and pictures, a dynamic active watermark is generated on the screen of video files, and a pre-recorded company watermark audio is inserted at the front and back of the audio file. The corresponding file watermark is generated in real time according to the corresponding file type used; The watermark synthesis module synthesizes the generated watermark into the file according to the file type. During the subsequent use of all company files, the corresponding watermark synthesized in the file ensures the safety of the file.

7. A remote office data leakage prevention system according to claim 1, characterized in that: The security module also includes a password generation module, a password embedding module and a password sharing module; The password generation module generates a corresponding encryption password when the employee writes, reads, exports and transfers files in the server, encrypts the company's files, and the password is a dynamic password; The password embedding module generates a password that will automatically encrypt the corresponding file when the file is transmitted. The encrypted file will have an upper limit of five incorrect password inputs. When the file encryption password is entered incorrectly five times, the content in the file will be automatically erased. The original file will be re-encrypted when it is transmitted again on the server. In the password sharing module, the company leader obtains the basic encryption password of the transmitted file, and shares the password of the corresponding file to the corresponding employee through the server. The password is a dynamic password. One file will generate one hundred sets of passwords for dynamic replacement at the same time. The password is dynamically replaced after the file is transferred. If the employee who does not participate in the project downloads and transfers the file, the encryption password cannot be shared.

8. A remote office data leakage prevention system according to claim 7, characterized in that: The password sharing module includes an authority detection module, which is used to confirm the corresponding employee end of the shared password. If it is confirmed that the employee end is a participant of the corresponding project but not a participant of the corresponding file project, the corresponding non-participating employee end does not have the authority to share the password.

9. A remote office data leakage prevention system according to claim 1, characterized in that: The behavior analysis module includes a behavior marking module, a behavior recording module, a behavior judgment module, a risk estimation module and a result generation module; The behavior marking module is used to mark various operations performed by the employee on the server. In particular, when the employee performs illegal operations and sensitive information operations, the behavior marking module focuses on marking the content that affects the company's security. The behavior recording module records the marked operation content of the corresponding employee end when an unsafe operation on the employee end is marked; The behavior judgment module analyzes and judges the marked and recorded employee-side operation information. When it is determined that there is leakage of company data, sensitive information and core technical operations, the server authority of the corresponding employee side is restricted, and the corresponding employee side is denied server access.

10. A remote office data leakage prevention system according to claim 9, characterized in that: The risk estimation module is used to estimate the loss risk caused to the company by the employee terminal that has security risk operations, estimate the risk level of the corresponding employee terminal's current operation, and the potential security risks in the future, and make a risk assessment on the security of the corresponding employee terminal; The result generation module generates a report on the risk assessment at the employee end, and then transmits it to the company's leadership end through the server.

Images