Technical method for company equipment to automatically back up and clear sensitive information files according to list

Abstract

The invention belongs to the technical field of enterprise information security, and discloses a technical method for a company device to automatically back up and clear sensitive information files according to a list, which comprises the following specific steps of: 1, dynamically monitoring the list, deploying a lightweight monitoring execution engine by a terminal, and monitoring an interface through a system-level file; the change of a list file of a specified directory of the desktop is detected in real time, the monitoring parameter is set as polling once per second, and the analysis engine is triggered after the size of the file is detected to be unchanged for 2 seconds; an automatic closed loop of millisecond-level response is constructed through an Excel list driving engine, desktop list changes are captured in real time through an operating system-level monitoring interface, thousand-row-level Excel analysis (precisely extracting A-column paths / B-column instructions) is completed within 60 seconds, follow-up operation is automatically triggered, and therefore the file processing time of a single device is shortened to be within 5 minutes, and the file processing efficiency is improved. The misoperation rate is reduced to 0.1% or below, and response lag and errors caused by human factors are thoroughly eliminated.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of enterprise information security, and specifically relates to a technical method for automatically backing up and removing sensitive information files according to a list for company equipment. BACKGROUND

[0002] In a modern enterprise data security system, sensitive information (such as customer data, financial documents, source code, etc.) stored in terminal equipment faces a serious risk of leakage. Although enterprises generally use security agents to automatically scan and generate a list of sensitive files (usually stored in a user desktop directory in CSV or JSON format), the subsequent file disposal process, including backup or removal operations according to the list, still highly depends on manual processing.

[0003] The prior art relies on security agents to automatically generate a list of sensitive files, but fails to automate the subsequent disposal process, resulting in the necessity of manual operation. This gap leads to a chain of problems: first, manual processing of list items one by one is extremely inefficient, and cleaning a single device can take several hours, significantly slowing down the operation rhythm, especially in the context of job transfer or device recycling; at the same time, manual checking is prone to missing hidden files or list update items due to fatigue or negligence, with a false deletion rate exceeding 5%, causing business interruption or data loss; secondly, manual removal often uses simple deletion at the operating system level, which only removes file indexing without overwriting disk tracks, leaving residual data that can be easily restored by recovery tools (such as Recuva) - when the device is resold or scrapped, this defect directly leads to a secondary risk of leakage; thirdly, manual backup lacks standardized control, and employees may use unencrypted USB or public cloud storage to transfer sensitive files, resulting in loss of control over data during transmission or storage, forming a new security blind spot; finally, manual operation cannot automatically generate a trusted log, and the enterprise faces two dilemmas: on the one hand, it cannot prove that sensitive data has been disposed of in compliance (such as missing erasure timestamps, file hash values, etc.); on the other hand, it is difficult to determine the responsibility for operation failure (human error or system failure), hindering fundamental improvement. SUMMARY

[0004] The purpose of the present application is to provide a technical method for automatically backing up and removing sensitive information files according to a list for company equipment to solve the problems raised in the background.

[0005] To achieve the above purpose, the present application provides the following technical solution: a technical method for automatically backing up and removing sensitive information files according to a list for company equipment, the specific steps being as follows: Step 1: Dynamic monitoring of the list The terminal deploys a lightweight monitoring execution engine, detects the list file changes of the specified directory of the desktop in real time through a system-level file listening interface, the monitoring parameter setting is to poll once per second, and the parsing engine is triggered after detecting that the file size does not change for 2 seconds, so as to ensure reading of the complete generated list; Step two: list parsing and instruction extraction After the parsing engine loads the list file, the adapter is called according to the extension to accurately extract the key fields in the Excel workbook and automatically check the path existence and instruction legality, the core extraction fields include: A column file absolute path, B column operation instruction (backup or wipe), C column strategy version number, and the parsing process implements strict fault tolerance: invalid paths are automatically skipped and alarm logs are recorded, and the single file parsing time is controlled within 50 milliseconds; Step three: safe execution of instructions The executor calls different modules according to the instruction type: Backup operation (B column is Backup"): first, the zlib library is used to compress the file, the compression rate of the text file is greater than or equal to 75%, then the AES-256-CBC algorithm is used for encryption, and finally, the file is transmitted to the backup storage area in blocks (each block is 4MB), in addition, breakpoint resume is also supported; Clear operation (B column is Wipe): the underlying security tool is called to execute 3 times of magnetic track overwrite according to the DoD 5220.22-M standard, so as to ensure that the data cannot be recovered, when the file is occupied, the system injects a hook to monitor the process release event (handle release) and automatically retries (up to 3 times of automatic retries, each time interval is 2 seconds); Step four: audit evidence All operations generate structured audit logs (including file path, operation type, operation timestamp, file hash value), which are transmitted to the central audit server through TLS1.3 encryption, the SHA-256 digest of the key clear operation is generated synchronously and written into the enterprise-level blockchain node, so as to realize 5-second on-chain evidence storage.

[0006] As a preferred technical solution of the present application, in step one, the system-level file listening interface is called, the ReadDirectoryChangesW API is called in the Windows environment, and the inotify or kqueue mechanism is used in the Linux / macOS environment.

[0007] As a preferred technical solution of the present application, in step two, the adapter is called according to the extension, the CSV file uses the RFC4180 standard parser, and the JSON file complies with the JSON Schema verification.

[0008] As a preferred technical solution of the application, the AES-256-CBC algorithm encryption in step three needs to use a key, which is dynamically managed by the enterprise KMS.

[0009] As a preferred technical solution of the application, the calling of the underlying security tool in step three is the Windows integrated SDelete.exe, and the Linux / macOS uses the shred command.

[0010] As a preferred technical solution of the application, the track overwrite in step three is specifically writing 0x00, 0xFF and random values in sequence, and also needs to meet the NIST SP 800-88 non-recoverable standard.

[0011] As a preferred technical solution of the application, the enterprise-level blockchain node in step four adopts the Hyperledger Fabric architecture.

[0012] As a preferred technical solution of the application, the audit log in step four needs to meet international compliance requirements, and the retention period is 7 years.

[0013] As a preferred technical solution of the application, the instruction security execution in step three is equipped with an exception handling mechanism throughout the whole process: when the network is interrupted, the to-be-executed instruction is temporarily stored in the local encrypted database (SQLite), and after detecting network recovery every 5 minutes, it is automatically retransmitted; when a policy version conflict is detected, the current task is immediately terminated and a new version of the policy is loaded for re-execution; when a parsing error is detected, the problem line is automatically skipped, and when resource overload is detected, intelligent flow limiting and queuing are performed.

[0014] The beneficial effects of the application are as follows: The application uses an Excel list-driven engine to build a millisecond-level response automatic closed loop: real-time capture of desktop list changes through an operating system-level monitoring interface, completion of Excel analysis (precise extraction of column A path and column B instruction) within 60 seconds, and automatic triggering of subsequent operations, thereby compressing single-device file disposal time to within 5 minutes, reducing the error operation rate to below 0.1%, and completely eliminating response lag and errors caused by human factors; at the same time, the SDelete / shred tool is called to perform three track overwrites, strictly meeting the NIST SP 800-88 non-recoverable standard, while the use of unencrypted USB by manual backup is completely eliminated by the mandatory AES-256-GCM memory encryption and block transmission mechanism (4MB / block + TLS channel), thereby achieving the physical level of "transmission zero leakage and cleaning no residue" essential safety. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The figure is a method flowchart of the application. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] like Figure 1 As shown, this embodiment of the invention provides a technical method for automatically backing up and deleting sensitive information files based on a list for company equipment. The specific steps are as follows: Step 1: Dynamic Monitoring of the Inventory The terminal deploys a lightweight monitoring execution engine, which detects changes in the manifest file in a specified directory on the desktop in real time through a system-level file listening interface. The monitoring parameters are set to poll once per second, and the parsing engine is triggered after the file size remains unchanged for 2 seconds to ensure that the complete generated manifest is read. Step 2: List Parsing and Instruction Extraction After loading the manifest file, the parsing engine calls the adapter based on the file extension to accurately extract key fields from the Excel workbook and automatically verifies the existence of paths and the validity of commands. The core extracted fields include: column A: absolute file path, column B: operation command (backup or wipe), and column C: policy version number. The parsing process implements strict fault tolerance: invalid paths are automatically skipped and alarm logs are recorded, and the parsing time for a single file is controlled within 50 milliseconds. Step 3: Safe execution of instructions The executor calls different modules based on the instruction type: Backup operation (Column B is "Backup"): First, the file is compressed using the zlib library, with a compression rate of ≥75% for text files. Then, it is encrypted using the AES-256-CBC algorithm. Finally, it is transferred to the backup storage area in blocks (each block is 4MB). In addition, it also supports resuming interrupted downloads. Wipe operation (column B is Wipe): Invokes the underlying security tools to perform a 3-stage track overwrite according to the DoD 5220.22-M standard to ensure data is unrecoverable. When a file is occupied, the system injects a hook to monitor process release events (handle release) and automatically retry (up to 3 automatic retries, with an interval of 2 seconds between each retry); Step 4: Audit Evidence Preservation All operations generate structured audit logs (including file path, operation type, operation timestamp, and file hash value), which are transmitted to the central audit server via TLS 1.3 encryption. Critical cleanup operations simultaneously generate SHA-256 digests, which are written to enterprise-level blockchain nodes, enabling on-chain evidence storage within 5 seconds.

[0018] The present application aims to build a seamless full-automation disposal closed loop for existing security agents, achieving four breakthrough goals: first, through real-time monitoring and analysis of the agent-generated desktop inventory files (such as CSV / JSON), automatically triggering the execution engine, completely replacing manual operation - reducing single-device file disposal time from several hours to 5 minutes, reducing the error rate to less than 0.1%, ensuring 100% accurate execution of inventory items, and solving the efficiency and reliability problems; second, integrating military-grade erasure algorithm (DoD 5220.22-M standard 3 times overwrite) and mandatory encryption backup mechanism to eradicate data residue risk: the cleaning operation makes the file unrecoverable, and the backup file is encrypted by AES-256 and transmitted in blocks to the controlled storage area, eliminating transmission leakage and unauthorized storage; third, building a blockchain-enhanced audit chain, automatically recording all elements of the operation (file absolute path, timestamp, device ID, operation instruction, etc.) and generating SHA-256 digest on-chain for evidence, completing verifiable archive within 5 seconds, directly outputting GDPR / CCPA compliance report, solving the problem of evidence and accountability; fourth, designed as a lightweight agent extension module, directly parsing the existing agent output format, without modifying the existing security architecture of the enterprise, achieving end-to-end automation control with minimal deployment cost, upgrading sensitive data governance to a complete closed loop of "detection - execution - audit".

[0019] Among them, in step one, in the Windows environment, the ReadDirectoryChangesW API is called, and in the Linux / macOS environment, the inotify or kqueue mechanism is used.

[0020] The ReadDirectoryChangesW API called in the Windows environment is part of the Windows API. ReadDirectoryChangesW can monitor file system changes in a specified directory or directory tree in real time, including but not limited to file creation, deletion, modification, renaming, and attribute changes, etc. It notifies the application of these changes by returning a structure containing change information (FILE_NOTIFY_INFORMATION). inotify and kqueue are two mechanisms for monitoring file system changes, providing efficient event notification services in Linux and Unix-like systems (such as FreeBSD, macOS) respectively.

[0021] Among them, in step two, according to the extension, the adapter is called, the CSV file uses the RFC4180 standard parser, and the JSON file follows the JSON Schema verification.

[0022] RFC4180 standard parser and JSON Schema validation are two important mechanisms in data processing, respectively used for CSV file parsing and JSON data validation: RFC4180 standard parser is a CSV parser designed in accordance with RFC4180 specification, used to read CSV format data and convert it into a data structure that can be understood and processed by computer programs; JSON Schema is a JSON format-based specification for defining and validating JSON data structures, allowing developers to define a set of rules to validate the structure and content of JSON data, ensuring data correctness and consistency.

[0023] Among them, the AES-256-CBC algorithm encryption in step three needs to use the key, which is dynamically managed by the enterprise KMS.

[0024] The enterprise KMS can periodically rotate the key (such as generating a new key every day or after each encryption operation), so even if a single key is compromised, attackers cannot decrypt data from other time periods. Dynamic key management avoids long-term use of the same key, reducing the risk of key cracking or internal misuse. AES-256-CBC algorithm combined with enterprise KMS (key management service) dynamic management of keys can significantly improve data security and management efficiency.

[0025] Among them, in step three, when calling the underlying security tool, Windows integrates SDelete.exe, Linux / macOS uses the shred command.

[0026] SDelete.exe is a command-line tool in the Microsoft Sysinternals toolset, designed for secure deletion of files and cleaning of disk unallocated space. It ensures data cannot be recovered by multiple overwriting of file data (supports custom number of overwrites); shred is a command-line tool included in Linux / macOS systems, which implements secure deletion by overwriting file contents multiple times. It belongs to the coreutils software package and defaults to 3 overwrites, supports custom number of overwrites and modes.

[0027] Among them, the track overwrite in step three is: writing 0x00, 0xFF and random values in turn, and also needs to meet the NIST SP 800-88 non-recoverable standard.

[0028] Track overwrite is a technology that completely removes residual information on storage media by writing specific data patterns multiple times, its core purpose is to prevent data recovery, writing 0x00, 0xFF and random values in turn is the recommended overwrite method in international standards, by destroying the physical magnetization traces of original data, ensuring that data cannot be recovered by professional tools, the technical principle of three times of overwrite: First overwrite: All zeros (0x00) Purpose: Cover the original data's underlying magnetization direction; Effect: Reset all bits on the storage medium to logical "0", eliminating the binary representation of the original data, but the disk surface may still have residual magnetization differences of the original data (such as some areas with stronger magnetization corresponding to "1" in the original data); Second overwrite: All ones (0xFF) Purpose: Reverse the magnetization direction to further destroy residual traces; Effect: The binary representation of 0xFF is all "1", which will force all areas on the disk surface to have opposite magnetization directions compared to the first overwrite. At this time, the magnetization intensity difference of the original data is partially offset, but there may still be weak pattern residues (such as subtle differences in magnetization transition areas); Third overwrite: Random values Purpose: Completely eliminate any predictable magnetization patterns; Effect: Writing random values (such as 0xA3, 0x7F, etc.) will break the regularity of the previous two overwrites, making the magnetization state of the disk surface appear randomly distributed. At this time, even using professional equipment (such as a magnetic force microscope) to analyze, it is impossible to recover the original data from the residual traces; NIST SP 800-88 aims to provide practical media cleaning decision guidance for organizations to ensure that data is not leaked due to improper handling. The standard emphasizes making cleaning decisions based on the confidentiality classification of information and is applicable to various types of storage media, including solid-state drives (SSD), NVMe hard drives, etc.

[0029] Among them, the enterprise-level blockchain node in step four adopts a Hyperledger Fabric architecture.

[0030] Hyperledger Fabric is an open-source enterprise-level blockchain framework that adopts a modular architecture design, dividing the blockchain network into multiple independent components, including member services, consensus services, smart contracts (chaincode), and storage services. This design allows enterprises to select and combine different modules according to business scenarios, and is specifically developed for building private, permissioned blockchain networks, supporting flexible customization and expansion of blockchain solutions according to actual needs.

[0031] Among them, the audit log in step four needs to meet international compliance requirements and be retained for 7 years.

[0032] The core purpose of audit log retention is to enable security incident traceability: when a data breach, tampering or internal violation occurs, complete log retention can restore the operation link, locate the responsible person, for example, by comparing file hash values to confirm whether the data has been tampered with, and timestamps can trace the operation sequence; At the same time, regular analysis of audit logs can discover potential threats (such as abnormal login, frequent file access), and optimize security policies.

[0033] Among them, the instruction safety execution in step three is equipped with an exception handling mechanism throughout the whole process: when the network is interrupted, the to-be-executed instruction is temporarily stored in the local encrypted database (SQLite), and after detecting the network recovery every 5 minutes, it is automatically retransmitted; When a policy version conflict is detected, the current task is immediately terminated and the new version of the policy is loaded to re-execute; When parsing errors occur, the problem line is automatically skipped, and when resource overload occurs, intelligent flow control is performed.

[0034] Introducing an exception handling mechanism throughout the whole process in the instruction safety execution can significantly improve the reliability, security, compliance and user experience of the system, especially in complex distributed environments or high-risk operation scenarios (such as financial transactions, medical data management, industrial control, etc.), Its value is particularly prominent. When the network is interrupted or the server fails, the to-be-executed instruction is temporarily stored in the local encrypted database, which can effectively avoid operation interruption or data inconsistency caused by network problems.

[0035] It should be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the term "includes", "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device.

[0036] Although embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A technical method for automatically backing up and clearing sensitive information files according to a list for a company device, characterized in that, The specific steps are as follows: Step one: dynamic monitoring of the list The terminal deploys a lightweight monitoring execution engine, which detects changes in the list file in the specified directory of the desktop in real time through a system-level file listening interface. The monitoring parameters are set to poll once every second, and the parsing engine is triggered after detecting that the file size has not changed for 2 seconds, ensuring that the complete generated list is read; Step two: list parsing and instruction extraction After the parsing engine loads the list file, it accurately extracts the key fields in the Excel workbook according to the extension and automatically checks the path existence and instruction legality. The core extraction fields include: A column file absolute path, B column operation instruction (backup or wipe), C column strategy version number. The parsing process implements strict fault tolerance: invalid paths are automatically skipped and warning logs are recorded, and the single file parsing time is controlled within 50 milliseconds; Step three: safe execution of instructions The executor calls different modules according to the instruction type: Backup operation (B column is Backup"): first compress the file using zlib library, text file compression rate ≥75%, then encrypt it using AES-256-CBC algorithm, and finally transfer it to the backup storage area in blocks (each block is 4MB), in addition, it also supports breakpoint resume; Wipe operation (B column is Wipe): call the underlying security tool to perform 3 times of magnetic track overwrite according to DoD 5220.22-M standard to ensure that the data cannot be recovered. When the file is occupied, the system injects a hook to monitor the process release event (handle release) and automatically retries (up to 3 automatic retries, each time interval is 2 seconds); Step four: audit evidence All operations generate structured audit logs (including file path, operation type, operation timestamp, file hash value), which are transmitted to the central audit server through TLS1.3 encryption. The SHA-256 digest is generated synchronously for key wipe operations and written to the enterprise-level blockchain node, achieving 5-second on-chain evidence.

2. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step one, the system-level file listening interface is called by ReadDirectoryChangesW API in Windows environment, and inotify or kqueue mechanism is used in Linux / macOS environment.

3. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step two, the adapter is called according to the extension. CSV files use RFC4180 standard parser, and JSON files follow JSON Schema verification.

4. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step three, the AES-256-CBC algorithm encryption requires a key, which is dynamically managed by the enterprise KMS.

5. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step three, the underlying security tool is called. Windows integrates SDelete.exe, and Linux / macOS uses the shred command.

6. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step three, the magnetic track overwrite is specific: 0x00, 0xFF and random values are written in turn, and it also needs to meet the NIST SP 800-88 irrecoverable standard.

7. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step four, the enterprise-level blockchain node uses the Hyperledger Fabric architecture.

8. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: In step four, the audit log needs to meet the international compliance requirements, and the retention period is 7 years.

9. The technical method for automatically backing up and clearing sensitive information files according to the list for company equipment according to claim 1, characterized in that: The instruction safety execution in step three is equipped with an exception processing mechanism: when the network is interrupted, the to-be-executed instruction is temporarily stored in a local encryption database (SQLite), and after detecting network recovery every 5 minutes, automatic retransmission is performed; When a policy version conflict is detected, the current task is immediately terminated and a new version of the policy is loaded for re-execution; when a parsing error is detected, the problem line is automatically skipped, and when resource overload is detected, intelligent flow limiting and queuing are performed.

Images