A computer automatic protection system and method

Abstract

This invention discloses an automatic computer protection system and method, relating to the field of computer file security protection. The technical solution includes: detecting user idle time; identifying sensitive tabs in the browser when the user is about to leave, and extracting the ORB feature point set of their content area as a content fingerprint; creating a Gaussian blur overlay window when the user has left, tracking the positional changes of the content area through feature point matching and affine transformation, and dynamically adjusting the position and size of the overlay window so that the overlay always follows the movement of the file content; and destroying the overlay window when the user returns, restoring the file to normal display. This invention, through content area tracking based on visual features and progressive blurring, solves the problem of sensitive file content being exposed and background tasks being interrupted when a user is briefly away, achieving fine-grained protection at the file and tab levels, and helping to improve the security of computer files in the office environment.

Description

Technical Field

[0001] This invention relates to the field of computer file security protection, and more specifically, to an automatic computer protection system and method. Background Technology

[0002] With the increasing use of computers in office and confidential environments, if users forget to lock their screens when leaving their computers, sensitive files can easily be viewed or stolen by others.

[0003] Existing technologies primarily employ full-screen locking or screen savers, such as automatically locking the computer operating system after detecting user absence using infrared sensors (e.g., Chinese patent CN101154254A). While these solutions prevent unauthorized access, their protection granularity is the entire computer system. Once locked, all background tasks (such as downloading, compiling, and audio / video playback) are interrupted, requiring the user to unlock and restore applications upon returning, impacting work efficiency. Furthermore, existing file-level protection schemes (e.g., Chinese patent CN118940318A) combine encryption and access control, identifying abnormal activity through behavioral analysis. However, their protection strategies are based on preset rules and cannot dynamically adjust protection strength according to the user's real-time presence. They also suffer from the problem of interrupting the user's current operation upon protection triggering. For browser multi-tab scenarios, existing technologies lack the ability to selectively mask the content of individual tabs, making it difficult to protect sensitive files while maintaining the normal operation of non-sensitive tabs. Therefore, a computer automatic protection system and method are proposed to address the above problems. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a computer automatic protection system and method. The technical problem to be solved is: how to selectively cover and protect the content of sensitive files displayed in the browser without interrupting background tasks and user workflow when the user briefly leaves the computer, so as to prevent sensitive information from being viewed by others.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a computer automatic protection method, comprising the following steps: S1: Call the operating system input idle time detection interface to obtain the idle duration of continuous no user input events. When the idle duration is greater than the first threshold, it is determined that the user is about to leave, so as to start the protection preparation process before the user leaves completely.

[0006] S2: When about to leave the browser window, iterate through all tabs in the current browser window, obtain the title, Uniform Resource Locator (URL), and visible text content in the document object model of each tab, match the title, URL, and visible text content with a preset sensitive word library, calculate the sensitivity score of each tab, and mark tabs with sensitivity scores greater than or equal to a preset sensitivity threshold as sensitive tabs, thereby identifying the tabs containing sensitive files that need to be protected.

[0007] S3: For each sensitive tab, locate the content container that carries the file content in the tab, obtain the coordinate rectangle of the content container in the viewport as the initial content area, extract the ORB feature point set of the image within the initial content area, associate the feature point set with the coordinate rectangle of the initial content area and store it as the content fingerprint of the sensitive tab, which is used for visual tracking of the content area during subsequent user absence.

[0008] S4: When the idle time exceeds the second threshold, it is determined that the user has left the state, where the second threshold is greater than the first threshold. A Gaussian blur overlay window is created for each sensitive tab. The initial position and initial size of the overlay window are set to the position and size of the coordinate rectangle of the initial content area, respectively, to visually mask the sensitive file content.

[0009] S5: While the user is in an abandoned state, repeat the following sub-steps at fixed time intervals of 200 milliseconds to continuously track changes in the position of the content area and dynamically adjust the masking layer: S51: Using the geometric center of the current overlay window as the center, expand the width and height of the window upwards, downwards, leftwards, and rightwards by a preset ratio as the search area, capture the screen image of the search area, and thus obtain a local image for feature matching.

[0010] S52: Extract the current ORB feature point set from the screen image for matching with the initial content fingerprint.

[0011] S53: For each feature point in the initial feature point set, in the matching with the current feature point set, select the matching point pair with the smallest Hamming distance that is less than the preset distance threshold to obtain the matching point pair set, thereby establishing the feature correspondence between the initial content region and the current screen image.

[0012] S54: Using a set of matching point pairs, calculate the affine transformation matrix from the initial content region to the current content region through a random sampling consistency algorithm. This matrix describes the overall displacement, rotation, and scaling changes of the content region.

[0013] S55: Transform the coordinates of the four corner points of the initial content area using an affine transformation matrix to obtain the coordinates of the four transformed corner points. Calculate the bounding rectangle of the quadrilateral determined by the four transformed corner point coordinates. Move the overlay window to the position of the bounding rectangle and adjust its size to the size of the bounding rectangle, so that the overlay window is always aligned with the current position of the file content area.

[0014] S6: Continuously monitor idle time. When the idle time decreases from greater than the second threshold to less than the first threshold, it is determined as a user return event. The overlay window is destroyed to remove the obscuring of the file content and restore normal display.

[0015] Furthermore, in step S2, a sensitivity score is calculated for each tab. The method is as follows: ,in The number of sensitive words matched. The ratio of the total number of words in the sensitive word library is used to quantify the sensitivity of the tab; the preset sensitivity threshold is 0.6, which is used to determine whether a tab needs to be marked as a sensitive tab.

[0016] Furthermore, the Gaussian blur overlay window created in step S4 has a blur radius that increases over time. Let the duration of the user's "away" state be . If the unit is seconds, then: when hour, Pixel; when hour, Pixel; when hour, Pixel; when hour, Pixel; This piecewise function gradually increases the occlusion strength as the user is away, so as to maintain low visual disturbance when the user is away for a short time and provide higher protection strength when the user is away for a long time.

[0017] Furthermore, the method also includes performing the following steps while the user is in an abandoned state: By listening to tab activation switching events, browser window scaling events, and page scrolling events through browser extensions, external operations that may cause changes in the position of content areas can be captured. When a tab activation switching event is detected and the newly activated tab is a marked sensitive tab, steps S51 to S55 are immediately executed to update the overlay window for that sensitive tab. When a browser window zoom event or page scroll event is detected, steps S51 to S55 are immediately executed for all current sensitive tabs, thereby adjusting the position of the overlay layer in real time when the event occurs and avoiding delays in periodic tracking.

[0018] Furthermore, during step S53, if the number of selected matching point pairs is less than 3, the feature point matching is deemed to have failed. In this case, the overlay window is updated using the following method as a fallback: Obtain the vertical scroll distance dy and horizontal scroll distance dx of the current document through the browser extension; Let the coordinate rectangle of the initial content area be... Then the estimated current content area rectangle is ; The overlay window is moved to the position of the estimated rectangle and its size is adjusted to the size of the estimated rectangle, so that basic occlusion following can still be provided based on scroll offset when visual feature matching fails; At the same time, the sensitive tab is marked as a low-precision tracking mode, and the fixed time interval is increased from 200 milliseconds to 500 milliseconds to reduce computing resource consumption.

[0019] Furthermore, in step S1, the first threshold is 10 seconds and the second threshold is 15 seconds. The two thresholds distinguish between the state of about to leave and the state of already leaving, reserving a time window for the pre-registered content fingerprint. The operating system input idle time detection interface is the GetLastInputInfo function in the Windows operating system or the input device idle time query interface in the Linux operating system, used to uniformly obtain the user input idle time across platforms.

[0020] Furthermore, the preset ratio in step S51 is 20%, and the search area is specifically: taking the geometric center of the current overlay window as the center, expanding the width and height of the window by 20% in all directions. This expansion ratio ensures the possible displacement range of the overlay content area while controlling the amount of data captured in the image, so as to balance tracking accuracy and processing performance.

[0021] Furthermore, in step S6, the method for destroying the overlay window is as follows: call the operating system window destruction interface to release the overlay window resources, and delete the content fingerprint of the sensitive tab from memory, so as to completely remove the system resources occupied by the protection mechanism and avoid memory leaks.

[0022] The present invention also provides a computer automatic protection system for performing the method described in any of the above-mentioned embodiments, comprising: The user presence awareness module calls the operating system's idle time detection interface to obtain and output the idle time duration, which is used to monitor whether the user is in front of the computer in real time. The sensitive file tab identification module connects its input to the output of the user presence awareness module. When the idle time exceeds a first threshold, it traverses the browser tabs, obtains the title, Uniform Resource Locator (URL), and visible text content in the page's Document Object Model (DOM) for each tab, matches them with a preset sensitive word library, calculates a sensitivity score, and outputs the identifier of tabs with a sensitivity score greater than or equal to 0.6 and their corresponding content container coordinate rectangle, thereby completing the automatic identification of sensitive tabs. The file content fingerprint registration module has its input end connected to the output end of the sensitive file tag recognition module. It is used to extract ORB feature point set from the image within the coordinate rectangle of the content container, associate the feature point set with the coordinate rectangle and store it as a content fingerprint to provide a visual reference for subsequent tracking. The overlay management module connects to the output of the file content fingerprint registration module. It is used to create a Gaussian blur overlay window and set its initial position and size, as well as to call the operating system window destruction interface to destroy the overlay window, thereby realizing the lifecycle management of the masking layer. The feature point tracking module, whose input is connected to the output of the overlay management module, is used to capture screen images of the search area at 200-millisecond intervals during idle periods longer than a second threshold, extract the current ORB feature point set, match the feature point set in the content fingerprint, calculate the affine transformation matrix, and update the position and size of the overlay window according to the affine transformation matrix, thereby dynamically maintaining the alignment of the overlay with the file content area while the user is away.

[0023] Furthermore, the feature point tracking module includes: The image capture unit is used to call the operating system screenshot interface at 200 millisecond intervals to capture the screen image with the geometric center of the current overlay window as the center, and expand the width and height of the window by 20% in all directions (up, down, left, and right) as the search area, so as to obtain local visual data for matching. The feature extraction unit is used to extract ORB feature points from the captured screen image and convert the image into a matchable feature description. The feature matching unit is used to select the matching point pair with the smallest Hamming distance and less than a preset distance threshold in the matching with the current feature point set for each initial feature point in the content fingerprint, and to establish the feature correspondence between the initial image and the current image. The transformation calculation unit is used to calculate the affine transformation matrix using the selected matching point pairs through a random sampling consistency algorithm, which describes the overall geometric changes of the content region. The position update unit is used to transform the coordinates of the four corner points of the initial content area through an affine transformation matrix to obtain a new quadrilateral, calculate the bounding rectangle of the new quadrilateral, call the operating system window movement and scaling interface to move the overlay window to the position of the bounding rectangle and adjust its size to the size of the bounding rectangle, thereby completing the dynamic repositioning of the masking layer.

[0024] The technical effects and advantages of this invention are as follows: This invention uses a user presence awareness module to detect idle time in real time. When a user is about to leave, it pre-identifies sensitive tabs and registers the visual fingerprints of their content areas. After the user confirms their departure, a Gaussian blur overlay window is created to mask the content. Because the masking operation only affects the overlay window and does not terminate or modify the original file content, background tasks in each tab of the browser (such as downloads, audio playback, and real-time communication) can continue to run, helping to maintain the continuity of the user's workflow while protecting sensitive information.

[0025] This invention employs ORB feature point extraction and a random sampling consistency algorithm to calculate the affine transformation matrix, performing visual tracking of the content area. This allows the overlay window to dynamically adjust its position and size following page scrolling, window scaling, and tab switching. When the user returns, the overlay window is automatically destroyed, allowing the user to resume normal viewing without needing to enter a password or reload the page, thus improving the impact of the protection mechanism on the user experience.

[0026] This invention targets multi-tab browser environments, only masking tabs with sensitivity scores exceeding a threshold, while non-sensitive tabs remain displayed and interactive. Simultaneously, the blur radius increases in segments with the duration of absence, with lighter masking for short absences and stronger masking for longer absences. This achieves an adaptive match between protection strength and absence duration, helping to strike a balance between security and convenience. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the method execution of the present invention.

[0028] Figure 2 This is a system module framework diagram of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1 As attached Figures 1 to 2The computer automatic protection system and method shown herein are implemented as follows: I. Overall System Implementation The computer automatic protection system of the present invention is deployed in the operating system of the user's computer and is used to perform automatic masking protection on the sensitive file content displayed in the browser when the user leaves.

[0031] The system consists of a user presence awareness module, a sensitive file tab recognition module, a file content fingerprint registration module, an overlay management module, and a feature point tracking module.

[0032] The entire system operation process is as follows: S1. The user presence awareness module continuously acquires the idle time t and outputs the user status.

[0033] S2. When t exceeds the first threshold T1, the sensitive file tab identification module is triggered. This module traverses all tabs in the current browser window, identifies tabs that have loaded sensitive files, and outputs the identifier of the sensitive tab and the coordinate rectangle (x1, y1, x2, y2) of its content container.

[0034] S3. The file content fingerprint registration module receives the coordinate rectangle, calls the operating system's screenshot interface to capture the image of the rectangular area, uses the ORB feature extraction algorithm to extract the initial feature point set K0 from the image, and associates K0 with the coordinate rectangle to store it as the content fingerprint of the sensitive tab.

[0035] S4. When t exceeds the second threshold T2 (T2>T1), the overlay management module creates a Gaussian blur overlay window for each sensitive tab, and sets the initial position and initial size of the window to (x1, y1) and width W=x2-x1 and height H=y2-y1 respectively, so as to achieve visual masking of sensitive file content.

[0036] S5. During the period when t exceeds T2, the feature point tracking module performs the following operations in a fixed time interval of 200 milliseconds: expand the search area outwards from the current overlay window by a ratio of k=0.2, capture the screen image of the search area, extract the current feature point set K1 from the image, match K1 with K0 for feature points, calculate the affine transformation matrix H using the matching point pairs through the random sampling consistency algorithm, and update the position and size of the overlay window according to H, so that the masking layer always follows the movement of the file content area.

[0037] S6. When t falls back to less than T1, the overlay management module destroys all overlay windows, the feature point tracking module stops tracking, and the user can seamlessly resume normal viewing of the file content after returning.

[0038] II. Specific implementation of the user presence perception module This module is used to obtain the idle duration of consecutive user input events and output the user status according to a preset threshold as a condition for triggering file protection.

[0039] The user presence perception module calls the input idle time detection interface provided by the operating system.

[0040] In the Windows operating system, the GetLastInputInfo function is called, and this function returns the timestamp of the system's last input event; In Linux X11, XScreenSaverQueryInfo is called; In macOS, CGEventSourceSecondsSinceLastEventType is called.

[0041] The module obtains the current system timestamp, calculates the difference and converts it to seconds to obtain the idle duration t (in seconds).

[0042] The module sets the first threshold T1 = 10 seconds and the second threshold T2 = 15 seconds (T2 > T1). The status determination logic is as follows: If t ≤ T1, "Present" is output.

[0043] If T1 < t ≤ T2, "About to leave" is output.

[0044] If t > T2, "Has left" is output.

[0045] If the previous status was "Has left" and the current t < T1, "Return event" is output.

[0046] This module repeats the detection at a fixed period of 100 milliseconds and notifies other modules through a callback function when the status changes.

[0047] III. Specific implementation of the sensitive file tab recognition module This module is used to identify which tabs in the current browser window have loaded sensitive file content (such as confidential documents, contracts, password information, etc.) and obtain the display area coordinates of the sensitive content on the screen.

[0048] 3.1 Obtaining tab information The system communicates with the browser through a browser extension. The extension program is installed in the target browser in the form of a plugin. When receiving the "About to leave" signal, the system main program sends a query request to the extension.

[0049] The extension calls the browser's tab API to retrieve the following information for all tabs in the current browser window: tab title, Uniform Resource Locator (URL), and visible text content in the page's Document Object Model (DOM) (obtained via script injection using `document.body.innerText`). The extension then packages this information and sends it back.

[0050] 3.2 Calculate the sensitivity score The system's main program has a built-in sensitive word library, which contains terms related to file content security (such as "contract", "confidential", "password", "salary", "customer", "code", "internal information", etc.).

[0051] Let the total number of words in the sensitive word database be N. For each tab, the obtained title, Uniform Resource Locator (URL), and visible text content are concatenated into a string. The Aho-Corasick multi-pattern matching algorithm is used to match sensitive words in this string, and the number of matched sensitive words M is recorded.

[0052] Calculate the sensitivity score S = M / N. The value of S ranges from 0 to 1. The preset sensitivity threshold is 0.6. If S ≥ 0.6, then the tab is marked as a sensitive tab.

[0053] 3.3 Obtaining the coordinate rectangle of the content container For each sensitive tab, the system sends a location request to the browser extension. The extension then performs the following location logic on the target tab: First, find semantic container elements, matching selectors such as article, main, div[role=main], and .content in sequence, and take the first matching element as the content container.

[0054] If there is no semantic container, iterate through all block-level elements, calculate the area (width × height) of each element in the viewport, and select the element with the largest area as the content container.

[0055] If none of the above methods work, the entire scrollable area of ​​the document (document.documentElement) will be used as the content container.

[0056] After obtaining the container element, the `getBoundingClientRect` method is called to get the coordinate rectangle of the element relative to the viewport, including the left, top, right, and bottom boundaries. The system assigns these values ​​to (x1, y1, x2, y2), in screen pixels.

[0057] IV. Detailed Implementation of the Document Content Fingerprint Registration Module This module is used to extract visual features of content areas in sensitive tabs to form content fingerprints, which are then used for dynamic tracking of file content areas during subsequent user absence.

[0058] 4.1 Extracting the content area image Call the operating system's screenshot interface (BitBlt in Windows, XGetImage in Linux X11, and CGWindowListCreateImage in macOS) to capture the screen image within the rectangular area with (x1, y1) as the top left corner, width W = x2 - x1, and height H = y2 - y1, and obtain the bitmap image B0.

[0059] 4.2 Extracting ORB Feature Point Set Image B0 is processed using the ORB (Oriented FAST and Rotated BRIEF) feature extraction algorithm. The ORB algorithm first uses the FAST algorithm to detect keypoint locations and calculate orientation, and then uses the BRIEF algorithm to calculate a descriptor for each keypoint. The descriptor is a 256-bit binary vector, denoted as f.

[0060] The extracted result is a set of feature points, denoted as K0. Each feature point contains: position coordinates (u, v) (relative to the top left corner of image B0), orientation angle θ, and descriptor f.

[0061] 4.3 Storage Content Fingerprint The feature point set K0 is associated with and stored with the initial coordinate rectangle (x1, y1, x2, y2) to form the content fingerprint of this sensitive tab. The content fingerprint is stored in memory as key-value pairs, where the key is the unique identifier of the tab and the value is a data structure containing K0 and the coordinate rectangle.

[0062] V. Specific Implementation Methods of the Overlay Management Module This module is used to create, dynamically adjust, and destroy overlay windows to visually mask sensitive file content.

[0063] 5.1 Creating an Overlay Window When a "left" signal is received (t>T2), for each sensitive tab, the operating system window creation interface (CreateWindowEx in Windows, XCreateWindow in Linux X11, and the initialization method of NSWindow in macOS) is called to create a borderless, top-level window that is on top and allows mouse events to pass through.

[0064] The window's initial position is set to (x1, y1), its initial width to W, and its initial height to H. Then, the operating system's window blur effect setting interface is called (SetWindowCompositionAttribute and set ACCENT_ENABLE_BLURBEHIND in Windows, the blur function of the Composition Manager in Linux, and NSVisualEffectView in macOS) to set the window to a Gaussian blur effect.

[0065] 5.2 Dynamically Adjusting the Blur Radius Let T be the duration of the user's "left" state (in seconds). When the user's state first changes to "left", T starts from 0. During the period t>T2, T increases by 1 for every 1 second.

[0066] The relationship between the fuzzy radius R and T is a piecewise increasing function: When T < 15, R = 5 pixels; When 15 ≤ T < 30, R = 15 pixels; When 30 ≤ T < 60, R = 30 pixels; When T≥60, R=50 pixels.

[0067] Each time R changes, the window blur effect settings interface is called again to adjust the blur parameters (e.g., modifying the GradientColor component in ACCENT_POLICY in Windows) to achieve different levels of blur intensity. This design results in lighter occlusion when the user is away for a short time and increased occlusion intensity when away for a long time.

[0068] 5.3 Destroy the overlay window When a "return event" signal is received (t decreases from greater than T2 to less than T1), the operating system window destruction interface (DestroyWindow in Windows, XDestroyWindow in Linux, and the close method of NSWindow in macOS) is called to destroy the overlay window and remove the corresponding content fingerprint from memory.

[0069] VI. Detailed Implementation of the Feature Point Tracking Module This module is used to continuously track the positional changes of sensitive file content areas while the user is away, and dynamically adjust the position and size of the overlay window to ensure that the overlay layer always accurately covers the file content.

[0070] 6.1 Start the tracing thread When t>T2, start a separate background thread that executes the following steps in a loop at fixed time intervals of 200 milliseconds until the user returns (t≤T1).

[0071] 6.2 Determine the search area and capture the image Using the geometric center of the current overlay window as the center, expand the width and height of the window upwards, downwards, leftwards, and rightwards by a ratio k=0.2 to form the search area.

[0072] Let the boundary coordinates of the current overlay window be (c1, c2, c3, c4), where c1 is the left boundary, c2 is the top boundary, c3 is the right boundary, and c4 is the bottom boundary. Then the current width W1 = c3 - c1, and the height H1 = c4 - c2.

[0073] The search area rectangle is: (c1-k·W1, c2-k·H1, c3+k·W1, c4+k·H1); Call the operating system's screenshot interface to capture only the screen image within the search area, resulting in image B1.

[0074] 6.3 Extracting the current feature point set Image B1 is processed using the same ORB feature extraction algorithm as in step 4.2 to obtain the current feature point set K1.

[0075] 6.4 Feature Point Matching The current feature point set K1 is matched with the initial feature point set K0 in the content fingerprint. The matching algorithm uses brute-force matching combined with Hamming distance: for each feature point in K0, the Hamming distance (i.e., the number of different corresponding bits in two binary vectors) between its descriptor and each feature point in K1 is calculated, and the one with the smallest Hamming distance is selected as the candidate match, and this minimum distance must be less than the preset distance threshold D0=50. After filtering, the set of matching point pairs P is obtained.

[0076] 6.5 Calculate the affine transformation matrix Using the set of matching point pairs P, the affine transformation matrix H from the initial content region to the current content region is calculated using the random sample consensus algorithm. The affine transformation matrix H is a 2×3 matrix, in the form: H = [abp] [cdq] Where (a, b, c, d) are rotation and scaling components, and (p, q) are translation components.

[0077] The specific steps of the random sample consensus algorithm are as follows: 1. Set the number of iterations N0=100 and the threshold distance between interior points e=5 pixels.

[0078] 2. Initialize the best inlier set as empty and the number of best inliers as 0.

[0079] 3. Repeat N0 times: a. Randomly select 3 pairs of matching point pairs from P (at least 3 non - collinear points are required for affine transformation).

[0080] b. Solve the candidate affine transformation matrix H2 based on the 3 pairs of points. The solution method is: for each pair of points, represent the point coordinates in homogeneous form (x, y, 1), establish a linear equation system about the components of H2 and solve it.

[0081] c. For all matching point pairs in P, transform the initial feature points through H2 to obtain the estimated positions, and calculate the Euclidean distance d1 between the estimated position and the corresponding current feature point. If d1 < e, mark this point pair as an inlier.

[0082] d. Record the number of inliers. If it is greater than the current best number of inliers, update the best inlier set and the best number of inliers.

[0083] 4. If the best number of inliers ≥ 3, use the best inlier set to recalculate the final affine transformation matrix H by the least - squares method; otherwise, determine that the transformation calculation fails.

[0084] 6.6 Update the position and size of the overlay window Convert the four corner point coordinates (x1, y1), (x2, y1), (x2, y2), (x1, y2) of the initial content area into homogeneous coordinates (x, y, 1) respectively.

[0085] Construct the extended matrix E. E is a 3×3 matrix, the first two rows of which are H, and the third row is [0, 0, 1]. For each corner point, calculate the transformed homogeneous coordinates: (x', y', 1) = (x, y, 1) × E; Take (x', y') as the transformed corner point coordinates.

[0086] After obtaining the four transformed corner point coordinates, calculate their axis - aligned bounding rectangle: Minimum abscissa = min(x - coordinates of all transformed corner points); Maximum abscissa = max(x - coordinates of all transformed corner points); Minimum ordinate = min(y - coordinates of all transformed corner points); Maximum ordinate = max(y - coordinates of all transformed corner points); Call the operating system window movement and scaling interface (SetWindowPos in Windows, XMoveResizeWindow in Linux, and setFrame:display: in macOS) to move the overlay window to the position of (minimum x-coordinate, minimum y-coordinate) and set the window width to (maximum x-coordinate - minimum x-coordinate) and the height to (maximum y-coordinate - minimum y-coordinate).

[0087] 6.7 Instant Updates Triggered by Events In addition to periodic tracking, the system also listens for the following events through browser extensions: tab activation toggling events, browser window zooming events, and page scrolling events.

[0088] When these events occur, immediately perform steps 6.2 through 6.6 to update the overlay window for the sensitive tab, and then resume periodic tracking.

[0089] 6.8 Downgrade Processing If the number of matching point pairs selected in step 6.4 is less than 3, the feature point matching is deemed to have failed. At this point, the system enters degraded mode. Get the vertical scroll distance dy (using window.scrollY) and horizontal scroll distance dx (using window.scrollX) of the current document through the browser extension, both in pixels.

[0090] Since scrolling causes the content area to move backward on the screen, the estimated current content area rectangle is: (x1-dx, y1-dy, x2-dx, y2-dy); Move the overlay window to the position of the estimated rectangle and adjust its size to the size of the estimated rectangle.

[0091] Mark the sensitive tab as low-precision tracking mode and increase the periodic tracking interval from 200 milliseconds to 500 milliseconds.

[0092] When a feature point is successfully matched in a subsequent iteration (number of matched point pairs ≥ 3), the low-precision tracking mode will automatically exit, and the recovery time interval will be 200 milliseconds.

[0093] VII. Implementation methods for adapting to different operating systems This invention is compatible with multiple operating systems, and the specific implementation differences for each operating system are as follows: Windows operating system: Input detection uses GetLastInputInfo; screenshots use BitBlt; overlay window creation uses CreateWindowEx in conjunction with WS_EX_LAYERED and WS_EX_TRANSPARENT styles; blur effect uses SetWindowCompositionAttribute to set ACCENT_ENABLE_BLURBEHIND; window movement and scaling use SetWindowPos.

[0094] Linux operating system (X11): Input detection uses XScreenSaverQueryInfo; screenshots use XGetImage; overlay window creation uses XCreateSimpleWindow with the _NET_WM_STATE_ABOVE property set; blur effect requires a compound manager (such as KDE's KWindowEffects::enableBlurBehind); if no compound manager is available, a semi-transparent black fill is used instead; window movement and scaling use XMoveResizeWindow.

[0095] macOS operating system: Input detection uses CGEventSourceSecondsSinceLastEventType; screenshots use CGWindowListCreateImage; overlay window creation uses NSWindow with NSFloatingWindowLevel set; blur effect uses NSVisualEffectView with NSVisualEffectMaterialHUDWindow set; window movement and scaling use setFrame:display:.

[0096] VIII. Implementation methods for browser adaptation Chrome / Edge (Chromium kernel): Uses chrome.tabs.query to get tabs, chrome.tabs.sendMessage to inject scripts, chrome.tabs.onActivated to listen for activation events, and NativeMessaging uses chrome.runtime.connectNative.

[0097] Firefox: Use browser.tabs.query, browser.tabs.sendMessage, browser.tabs.onActivated, and NativeMessaging uses browser.runtime.connectNative.

[0098] Safari: Uses the safari.extension API, which has limited support. You can downgrade to using the operating system's UI automation framework.

[0099] IX. Implementation methods independent of browser extensions If users do not wish to install browser extensions or their browsers do not support extensions, the system can use the operating system's UI automation framework as an alternative.

[0100] In Windows, using the UIAutomation (UIA) interface: create a CUIAutomation object, get the desktop root element, find the browser window by its window class name, traverse its visual tree to locate the tab control, get the title through IUIAutomationElement::get_CurrentName, get the coordinate rectangle through get_CurrentBoundingRectangle, and get the page text content through ValuePattern or TextPattern.

[0101] This method does not require browser extensions, but compatibility depends on the browser's support for the UIA interface.

[0102] 10. Implementation methods for multi-monitor scenarios In a multi-monitor environment, both screenshots and overlay window creation are based on the monitor coordinate system of the target browser window. Specific steps: 1. Get the screen coordinates of the browser window.

[0103] 2. Call MonitorFromRect or MonitorFromWindow to obtain the handle of the display where the window is located.

[0104] 3. Call GetMonitorInfo to obtain the screen coordinate range of the monitor.

[0105] 4. Convert the content container coordinate rectangle to the coordinate space of this display (in extended mode, the coordinates are already global coordinates; in copy mode, the conversion needs to be based on the offset).

[0106] 5. Specify the device context of the display when taking a screenshot.

[0107] 6. When creating an overlay window, set its parent window or owner to the browser window so that it moves across monitors with the browser window.

[0108] XI. Performance Optimization Implementation Methods To reduce system resource consumption, the present invention adopts the following optimization measures: The time interval for feature point tracking threads is fixed at 200 milliseconds to avoid excessive frequency.

[0109] In degraded mode, the time interval is increased to 500 milliseconds, significantly reducing the computational load.

[0110] Only the search area with an expansion ratio of k=0.2 is captured, instead of the entire screen, reducing the amount of screenshot data.

[0111] The number of feature points per frame is limited to 500 to control memory and computational overhead.

[0112] The priority of the tracking thread is set to be lower than the normal priority to avoid affecting user interaction.

[0113] The above description is merely one specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A computer automatic protection method for masking sensitive file content displayed in a browser when the user leaves the computer, characterized in that, Includes the following steps: S1: Call the operating system input idle time detection interface to obtain the idle time without continuous user input events. When the idle time is greater than the first threshold, it is determined that the user is about to leave. S2: When about to leave, iterate through each tab of the current browser window, obtain the title, Uniform Resource Locator (URL), and visible text content in the document object model of each tab, match the title, URL, and visible text content with the preset sensitive word library, calculate the sensitivity score of each tab, and mark the tabs with sensitivity scores greater than or equal to the preset sensitivity threshold as sensitive tabs. S3: For each sensitive tab, locate the content container that carries the file content in the tab, obtain the coordinate rectangle of the content container in the viewport as the initial content region, extract the ORB feature point set from the image within the initial content region, and associate the feature point set with the coordinate rectangle of the initial content region to store it as the content fingerprint of the sensitive tab. S4: When the idle time is greater than the second threshold, it is determined that the user has left the state, where the second threshold is greater than the first threshold. A Gaussian blur overlay window is created for each sensitive tab, and the initial position and initial size of the overlay window are set to the position and size of the coordinate rectangle of the initial content area, respectively. S5: While the user is in the abandoned state, repeat the following sub-steps at fixed time intervals of 200 milliseconds: S51: Using the geometric center of the current overlay window as the center, expand the width and height of the window upwards, downwards, leftwards, and rightwards by a preset ratio as the search area, and capture the screen image of the search area; S52: Extract the current ORB feature point set from the screen image; S53: For each feature point in the initial feature point set, in the matching with the current feature point set, select the matching point pair with the smallest Hamming distance that is less than the preset distance threshold to obtain the matching point pair set; S54: Using the set of matching point pairs, calculate the affine transformation matrix from the initial content region to the current content region through the random sampling consistency algorithm; S55: Transform the coordinates of the four corner points of the initial content area using an affine transformation matrix to obtain the coordinates of the four transformed corner points. Calculate the bounding rectangle of the quadrilateral determined by the coordinates of the four transformed corner points. Move the overlay window to the position of the bounding rectangle and adjust its size to the size of the bounding rectangle. S6: Continuously monitor idle time. When the idle time decreases from greater than the second threshold to less than the first threshold, it is determined as a user return event, and the overlay window is destroyed.

2. The computer automatic protection method according to claim 1, characterized in that, In step S2, the sensitivity score for each tab is calculated. The method is as follows: ,in The number of sensitive words matched. The total number of words in the sensitive word library; the preset sensitivity threshold is 0.

6.

3. The computer automatic protection method according to claim 1, characterized in that, The Gaussian blur overlay window created in step S4 has a blur radius that increases over time. Let the duration of the user's "away" state be . If the unit is seconds, then: when hour, Pixel; when hour, Pixel; when hour, Pixel; when hour, Pixel.

4. The computer automatic protection method according to claim 1, characterized in that, It also includes performing the following steps while the user is in an abandoned state: listening for tab activation toggle events, browser window zoom events, and page scroll events via browser extensions; When a tab activation switching event is detected and the newly activated tab is a marked sensitive tab, steps S51 to S55 are immediately executed to update the overlay window for that sensitive tab. When a browser window zoom event or page scroll event is detected, steps S51 to S55 are executed immediately for all currently sensitive tabs.

5. The computer-automatic protection method according to claim 4, characterized in that, When executing step S53, if the number of selected matching point pairs is less than 3, the feature point matching is determined to be unsuccessful. In this case, the overlay window is updated in the following manner: Obtain the vertical scroll distance dy and horizontal scroll distance dx of the current document through the browser extension; Let the coordinate rectangle of the initial content area be... Then the estimated current content area rectangle is ; Move the overlay window to the position of the estimated rectangle and adjust its size to the size of the estimated rectangle; At the same time, the sensitive tab is marked as a low-precision tracking mode, and the fixed time interval is increased from 200 milliseconds to 500 milliseconds.

6. The computer automatic protection method according to claim 1, characterized in that, In step S1, the first threshold is 10 seconds and the second threshold is 15 seconds; the operating system input idle time detection interface is the GetLastInputInfo function in the Windows operating system or the input device idle time query interface in the Linux operating system.

7. The computer automatic protection method according to claim 1, characterized in that, The preset ratio in step S51 is 20%, and the search area is specifically: with the geometric center of the current overlay window as the center, the width and height of the window are expanded upwards, downwards, leftwards, and rightwards by 20%.

8. The computer automatic protection method according to claim 1, characterized in that, The method for destroying the overlay window in step S6 is as follows: call the operating system window destruction interface to release the overlay window resources, and delete the content fingerprint of the sensitive tab from memory.

9. A computer-automated protection system for executing the method according to any one of claims 1 to 8, characterized in that, include: The user presence perception module calls the operating system's idle time detection interface to obtain the idle duration and outputs it. The sensitive file tab identification module is connected to the output of the user presence awareness module. When the idle time exceeds the first threshold, it traverses the browser tabs, obtains the title, Uniform Resource Locator, and visible text content in the page document object model of each tab, matches them with a preset sensitive word library, calculates the sensitivity score, and outputs the identifier of the tab with a sensitivity score greater than or equal to 0.6 and the corresponding content container coordinate rectangle. The file content fingerprint registration module has its input end connected to the output end of the sensitive file tag recognition module. It is used to extract ORB feature point set from the image within the coordinate rectangle of the content container, and associate the feature point set with the coordinate rectangle to store it as a content fingerprint. The overlay management module connects to the output of the file content fingerprint registration module. It is used to create a Gaussian blur overlay window and set its initial position and size, as well as to call the operating system window destruction interface to destroy the overlay window. The feature point tracking module, whose input is connected to the output of the overlay management module, is used to capture the screen image of the search area at 200-millisecond intervals during idle periods longer than a second threshold, extract the current ORB feature point set, match the feature point set in the content fingerprint, calculate the affine transformation matrix, and update the position and size of the overlay window according to the affine transformation matrix.

10. The computer automatic protection system according to claim 9, characterized in that, The feature point tracking module includes: The image capture unit is used to call the operating system screenshot interface at 200 millisecond intervals to capture the screen image with the geometric center of the current overlay window as the center, and the width and height of the window extended upwards, downwards, leftwards, and rightwards by 20% each as the search area; The feature extraction unit is used to extract ORB feature points from the captured screen image; The feature matching unit is used to select the matching point pair with the smallest Hamming distance and less than a preset distance threshold in the matching of each initial feature point in the content fingerprint with the current feature point set. The transformation calculation unit is used to calculate the affine transformation matrix using the selected matching point pairs through a random sampling consensus algorithm. The position update unit is used to transform the coordinates of the four corner points of the initial content area into a new quadrilateral through an affine transformation matrix, calculate the bounding rectangle of the new quadrilateral, call the operating system window movement and scaling interface to move the overlay window to the position of the bounding rectangle, and adjust its size to the size of the bounding rectangle.

Images