Process management method, device and storage medium

Abstract

The present application discloses a process management method, device and storage medium. The method includes: monitoring the processes of a terminal; when a first process is monitored, determining the first desktop corresponding to the first process among multiple desktops contained in the terminal according to the desktop identifier carried by the first process; the system operation permissions corresponding to each of the multiple desktops contained in the terminal are the same or different; the processes corresponding to each of the multiple desktops are isolated based on a sandbox; using the correspondence between the desktop and the process processing policy, determining the first policy corresponding to the first desktop; and according to the first policy, allowing or prohibiting the terminal from executing the operation corresponding to the first process.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a process management method, device and storage medium. Background Art

[0002] With the development of technology, more and more mobile office (BYOD, Bring Your Own Device or Become Your Office Device) scenarios are appearing in people's work, and the corresponding proportion of BYOD devices continues to rise.

[0003] However, due to factors such as cost, network, and user privacy protection, the data protection (i.e., data leakage prevention) solutions in related technologies can only cover a portion of the company's personal computer (PC) users, and cannot provide data protection in BYOD scenarios and small branch office scenarios (such as file transfer between R&D department staff and sales department staff within the same company). Summary of the invention

[0004] To solve the related technical problems, the embodiments of the present application provide a process management method, device and storage medium.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application provides a process management method, including:

[0007] Monitoring the processes of the terminal; when a first process is monitored, determining, according to the desktop identifier carried by the first process, a first desktop corresponding to the first process among multiple desktops included in the terminal; the system operation permissions corresponding to each of the multiple desktops included in the terminal are the same or different; and the processes corresponding to each of the multiple desktops are isolated based on the sandbox;

[0008] The first policy corresponding to the first desktop is determined by utilizing the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to execute the operation corresponding to the first process.

[0009] In the above scheme, the method further comprises:

[0010] The correspondence between the desktops and the process processing policies and the first policy are obtained from the shared memory of the multiple desktops.

[0011] In the above scheme, the multiple desktops included in the terminal include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop;

[0012] The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes:

[0013] In a case where the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop, allowing the terminal to execute the operation corresponding to the first process;

[0014] When the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0015] The files under the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

[0016] In the above scheme, the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; when allowing the terminal to execute the operation corresponding to the first process, the method further includes:

[0017] When a redirection file corresponding to the first file exists in the file directory corresponding to the second-type desktop, controlling the terminal to execute an operation corresponding to the first process for the redirection file;

[0018] When a redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, a redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop, and the terminal is controlled to execute operations corresponding to the first process for the redirection file.

[0019] In the above scheme, the method further comprises:

[0020] When controlling the terminal to execute the operation corresponding to the first process with respect to the redirection file, the redirection file is encrypted.

[0021] In the above solution, the allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes:

[0022] When the operation corresponding to the first process includes an operation in which the first type of desktop pastes text or an image copied from the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process;

[0023] In the case where the operation corresponding to the first process includes the operation of the second type of desktop pasting text or image copied from the first type of desktop, allowing the terminal to execute the operation corresponding to the first process; wherein,

[0024] The clipboard of each of the multiple desktops is isolated based on the sandbox.

[0025] In the above solution, the allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes:

[0026] If it is determined according to the first policy that the first desktop has the permission to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

[0027] If it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0028] The system service interface and network connection function corresponding to each of the multiple desktops are isolated based on the sandbox;

[0029] The operation corresponding to the first process includes one of the following:

[0030] Access the first LAN;

[0031] Access the second LAN;

[0032] Call the system service interface.

[0033] In the above solution, the operation corresponding to the first process includes a screenshot operation;

[0034] The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes:

[0035] If the first desktop has the screenshot permission, allowing the terminal to execute the operation corresponding to the first process;

[0036] In the case that the first desktop does not have the screenshot permission, the terminal is prohibited from executing the operation corresponding to the first process; or a screenshot image containing traceable watermark information is generated.

[0037] The present application also provides a process management device, including:

[0038] A monitoring unit, configured to monitor processes of a terminal; when a first process is detected, determining, based on a desktop identifier carried by the first process, a first desktop corresponding to the first process among multiple desktops included in the terminal; the system operation permissions corresponding to each of the multiple desktops included in the terminal are the same or different; and the processes corresponding to each of the multiple desktops are isolated based on a sandbox;

[0039] The processing unit is used to determine the first policy corresponding to the first desktop by utilizing the correspondence between the desktop and the process processing policy; and according to the first policy, allow or prohibit the terminal from executing the operation corresponding to the first process.

[0040] The embodiment of the present application also provides a process management device, comprising: a processor and a memory for storing a computer program that can be run on the processor;

[0041] Wherein, the processor is used to execute the steps of any of the above methods when running the computer program.

[0042] An embodiment of the present application further provides a storage medium, wherein the medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0043] The process management method, device and storage medium provided in the embodiment of the present application monitor the processes of the terminal; when the first process is monitored, the first desktop corresponding to the first process in the multiple desktops contained in the terminal is determined according to the desktop identifier carried by the first process; the system operation permissions corresponding to each desktop in the multiple desktops contained in the terminal are the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox; the first policy corresponding to the first desktop is determined by using the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to execute the operation corresponding to the first process. The scheme of the embodiment of the present application isolates the processes corresponding to the multiple desktops with different permissions contained in the user terminal based on the sandbox, and when the process of the terminal is monitored, the process processing policy corresponding to the corresponding desktop is determined, and the terminal is allowed or prohibited to execute the operation corresponding to the corresponding process based on the determined policy. In this way, when the user implements BYOD scenarios and small and micro branch office scenarios based on the multi-desktop form of the terminal, it can avoid the leakage of office data, improve the security of office data, and thus improve the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flowchart of a process management method according to an embodiment of the present application;

[0045] Figure 2 A schematic diagram of an application scenario of an embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of the structure of the process management device of the application embodiment of the present application;

[0047] Figure 4 This is a schematic diagram of the structure of the process management device of an embodiment of the present application;

[0048] Figure 5 This is a schematic diagram of the hardware structure of the process management device of an embodiment of the present application. DETAILED DESCRIPTION

[0049] The technical solution of the present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0050] In the related art, the office data protection (i.e., office data leakage prevention) solutions of enterprises can be divided into hardware solutions and software solutions. Among them, the deployment cost of hardware solutions is usually high, and it may be necessary to configure an external device for office data protection for each PC user in the enterprise. This device usually has high requirements for the network and cannot support ultra-low bandwidth office and offline office. Software solutions usually include functions such as screen recording, remote control, and behavior auditing, which infringe on the privacy of PC users in the enterprise, and are difficult to promote in BYOD scenarios and small and micro branch office scenarios. At the same time, some hardware solutions and software solutions may have complex operation and maintenance and compatibility issues when applied to scenarios with low bandwidth and no administrators such as small and micro branch office scenarios. It can be seen that the office data protection solutions in the related art have problems such as high deployment cost, complex deployment methods and operation and maintenance, and poor user experience.

[0051] In addition, when designing office data protection solutions in BYOD scenarios and small and micro branch office scenarios, it is necessary to consider users' concerns about the security of office data in BYOD scenarios and small and micro branch office scenarios, such as users' concerns about the use of virtual private networks (VPNs) due to the impact of ransomware incidents, which may lead to intranet virus infection incidents. Therefore, it is necessary to consider users' needs for secure control of office data flow, such as the need for secure control of office data flow after using VPNs. At the same time, it is also necessary to consider users' concerns about the security of the operating system.

[0052] Based on this, in various embodiments of the present application, the processes corresponding to multiple desktops with different permissions contained in the user terminal are isolated based on the sandbox. When the terminal process is monitored, the process handling strategy corresponding to the corresponding desktop is determined, and the terminal is allowed or prohibited to perform operations corresponding to the corresponding process based on the determined strategy. In this way, when users implement BYOD scenarios and small branch office scenarios based on the multi-desktop form of the terminal, they can avoid office data leakage, improve the security of office data, and thus enhance user experience.

[0053] At the same time, since the various embodiments of the present application are implemented based on the multi-desktop form of the terminal itself, there is no need to protect office data through external devices. Therefore, the deployment cost is greatly reduced, and the difficulty of deployment method and subsequent operation and maintenance is also reduced.

[0054] In addition, since the various embodiments of the present application are implemented based on the multi-desktop form of the terminal itself, users can directly switch between BYOD scenarios and / or small branch office scenarios and other application scenarios (such as the user's personal application scenarios) through desktop switching. The operation is simple and convenient, thereby further improving the user experience.

[0055] The present application embodiment provides a process management method, such as Figure 1 As shown, the method comprises the following steps:

[0056] Step 101: monitoring the processes of the terminal; when a first process is detected, determining a first desktop corresponding to the first process among multiple desktops included in the terminal according to a desktop identifier carried by the first process;

[0057] Here, the system operation permissions corresponding to each of the multiple desktops included in the terminal are the same or different; the processes corresponding to each of the multiple desktops are isolated based on the sandbox;

[0058] Step 102: Determine a first policy corresponding to the first desktop by using the correspondence between the desktop and the process processing policy; and allow or prohibit the terminal from executing the operation corresponding to the first process according to the first policy.

[0059] Here, it should be noted that the terminal can be any electronic device with multiple desktop forms, such as a PC, a mobile phone, etc.; the PC can include a desktop computer, a laptop computer, a tablet computer, etc. Each of the multiple desktops corresponds to a virtual workspace, and the workspace corresponding to each of the multiple desktops is isolated based on the sandbox; in addition, the multiple desktops use the same physical disk, and the disk does not divide the use area of ​​each desktop. When the user operates the corresponding desktop, the screen presented by the terminal is the workspace corresponding to the corresponding desktop.

[0060] Specifically, in actual application, the process corresponding to each desktop among the multiple desktops can be isolated by using a sandbox implemented based on unified endpoint management (UEM) so that each desktop can correspond to a virtual workspace.

[0061] In actual application, the method of monitoring the process of the terminal can be set according to the operating system of the terminal and user requirements. Exemplarily, when the operating system of the terminal is a Microsoft Windows operating system, the process of the terminal can be monitored by a process callback.

[0062] In actual application, a shared memory of the multiple desktops can be set in the terminal. After determining the first desktop, the correspondence between the desktop and the process processing policy can be obtained from the shared memory, such as obtaining a first configuration file, which contains the correspondence between the desktop and the process processing policy; and after determining the first policy, the first policy can be obtained from the shared memory, such as obtaining a second configuration file, which contains the first policy.

[0063] Based on this, in one embodiment, the method may further include:

[0064] The correspondence between the desktops and the process processing policies and the first policy are obtained from the shared memory of the multiple desktops.

[0065] In actual application, the user can set the system operation permissions corresponding to each of the multiple desktops included in the terminal according to the needs. For example, Figure 2 As shown, the user can set three desktops in the terminal 200: desktop A, desktop B and desktop C, wherein desktop A may have the authority to log in to the intranet of the first enterprise, but does not have the authority to browse ordinary web pages; desktop B may have the authority to browse ordinary web pages, but does not have the authority to log in to the intranet of the first enterprise; desktop C may have the authority to play videos and audios, but does not have the authority to log in to the intranet of the first enterprise and the authority to browse ordinary web pages. The process processing strategy corresponding to the corresponding desktop reflects the system operation authority corresponding to the corresponding desktop. For example, desktop B does not have the authority to log in to the intranet of the first enterprise. The process processing strategy corresponding to desktop B may include: when the monitored process includes an operation to access the intranet of the first enterprise, prohibiting the terminal from executing the operation corresponding to the monitored process, that is, prohibiting the user from accessing the intranet of the first enterprise through desktop B. Here, the taskbar 201 of each desktop in the multiple desktops may include a desktop switching button 202, and the user can switch the desktop through the desktop switching button 202, such as switching from desktop A to desktop C, switching from desktop C to desktop B, etc.

[0066] In actual application, in order to further ensure the security of office data, users can classify the system operation permissions corresponding to each of the multiple desktops contained in the terminal as needed, so that users cannot open or edit files in the file directory corresponding to the desktop with a higher level of system operation permissions through the desktop with a lower level of system operation permissions. Exemplarily, the user can set the above-mentioned desktop A and desktop D as office desktops, desktop D has the permission to log in to the intranet of the second enterprise, but does not have the permission to browse ordinary web pages, and set the system operation permissions corresponding to desktop A and desktop D to level one; at the same time, set the above-mentioned desktop B, desktop C and desktop E as personal desktops, desktop E has the permission to browse ordinary web pages, but does not have the permission to log in to the intranet of the second enterprise, and set the system operation permissions corresponding to desktop B, desktop C and desktop E to level two. Here, the workspaces corresponding to desktop B, desktop C, and desktop E can be collectively referred to as personal domains, and the workspaces corresponding to desktop A and desktop D can be collectively referred to as security domains. The usage methods (such as file storage methods) of personal domains and security domains are exactly the same (i.e., the original file storage methods of the terminal itself), and users cannot perceive the difference between using personal domains and using security domains, and do not need to change their usage habits; both personal domains and security domains can directly access the disk files of the terminal, and can be isolated based on file redirection, but the files before and after redirection are stored on the same disk (i.e., the disk currently set by the terminal). Through the process processing strategy corresponding to the corresponding desktop, users cannot open or edit the files in the file directories corresponding to desktops A and D through desktops B, desktop C, and desktop E, that is, the personal domain cannot access and use the files in the security domain, while the security domain can access and use the files in the personal domain, and the user does not need to copy the files, and the operation is simple and convenient. In this way, the isolation of the files in the file directories corresponding to each of the multiple desktops contained in the terminal is achieved, further ensuring the security of office data.

[0067] Based on this, in one embodiment, the multiple desktops included in the terminal may include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop; and according to the first policy, allowing or prohibiting the terminal from executing the operation corresponding to the first process may include:

[0068] In a case where the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop, allowing the terminal to execute the operation corresponding to the first process;

[0069] When the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0070] The files under the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

[0071] Specifically, in actual application, each of the multiple desktops included in the terminal may correspond to a different file directory, and the user cannot view or edit files in the file directory corresponding to the second type of desktop through the first type of desktop, but the user can view or edit files in the file directory corresponding to the first type of desktop through the second type of desktop. Here, when the user views or edits files in the file directory corresponding to the first type of desktop through the second type of desktop, in order to make the user's editing of files in the file directory corresponding to the first type of desktop through the second type of desktop invisible to the first type of desktop, the files in the file directory corresponding to the first type of desktop that the user views and / or edits can be redirected to the file directory corresponding to the second type of desktop. In this way, the security of office data can be further guaranteed.

[0072] Based on this, in one embodiment, when the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; when allowing the terminal to execute the operation corresponding to the first process, the method may further include:

[0073] When a redirection file corresponding to the first file exists in the file directory corresponding to the second-type desktop, controlling the terminal to execute an operation corresponding to the first process for the redirection file;

[0074] When a redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, a redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop, and the terminal is controlled to execute operations corresponding to the first process for the redirection file.

[0075] In actual application, in order to further ensure the security of office data, when controlling the terminal to execute the operation corresponding to the first process for the redirected file, the redirected file can be encrypted. In this way, even if the terminal is lost, the redirected file will not be leaked, further ensuring the security of office data.

[0076] Based on this, in one embodiment, the method may further include:

[0077] When controlling the terminal to execute the operation corresponding to the first process with respect to the redirection file, the redirection file is encrypted.

[0078] Specifically, in actual application, after controlling the terminal to execute the operation corresponding to the first process for the redirection file, the redirection file can be encrypted before being written to the disk, and before controlling the terminal to execute the operation corresponding to the first process for the redirection file, the redirection file can be decrypted when reading the redirection file from the disk.

[0079] In actual application, the Minifilter technology can be used to redirect files and encrypt and decrypt redirected files.

[0080] In actual application, for each of the multiple desktops included in the terminal, a large file can be pre-allocated to the corresponding desktop as the file storage space of the workspace corresponding to the corresponding desktop, that is, the virtual disk of the workspace corresponding to the corresponding desktop. All files generated by the workspace corresponding to the corresponding desktop are stored in the corresponding virtual disk, and the entire virtual disk is encrypted. There is no need to encrypt a single file. In this way, when migrating data, only one large file needs to be migrated, which improves the convenience of data migration.

[0081] In actual application, the registry corresponding to each desktop in the desktop can also be isolated in the same way as file isolation, that is, the registry under the registry directory corresponding to each desktop in the multiple desktops is isolated based on the sandbox. Allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy may include: allowing the terminal to execute the operation corresponding to the first process when the operation corresponding to the first process includes the operation of the second type of desktop on the registry under the registry directory corresponding to the first type of desktop; prohibiting the terminal from executing the operation corresponding to the first process when the operation corresponding to the first process includes the operation of the first type of desktop on the registry under the registry directory corresponding to the second type of desktop.

[0082] At the same time, when the operation corresponding to the first process includes the operation of the second type of desktop on the first registry under the registry directory corresponding to the first type of desktop; when the terminal is allowed to execute the operation corresponding to the first process, the method may also include: when there is a redirected registry corresponding to the first registry under the registry directory corresponding to the second type of desktop, controlling the terminal to execute the operation corresponding to the first process on the redirected registry; when there is no redirected registry corresponding to the first file under the registry directory corresponding to the second type of desktop, generating a redirected registry corresponding to the first registry under the registry directory corresponding to the second type of desktop, and controlling the terminal to execute the operation corresponding to the first process on the redirected registry.

[0083] In actual application, in order to further ensure the security of office data, it is necessary to prevent users from pasting content (text or pictures) copied from the second type of desktop to the first type of desktop.

[0084] Based on this, in one embodiment, allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy may include:

[0085] When the operation corresponding to the first process includes an operation in which the first type of desktop pastes text or an image copied from the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process;

[0086] In the case where the operation corresponding to the first process includes the operation of the second type of desktop pasting text or image copied from the first type of desktop, allowing the terminal to execute the operation corresponding to the first process; wherein,

[0087] The clipboard of each of the multiple desktops is isolated based on the sandbox.

[0088] In actual application, in order to further ensure the security of office data, the first policy may include the first desktop's permission to access the network, the permission to access the network, and the permission to call the system service interface, etc.; in this way, it can prevent the user from leaking office data through interfaces such as the network or printer when using the desktop for office work.

[0089] Based on this, in one embodiment, allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy may include:

[0090] If it is determined according to the first policy that the first desktop has the permission to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

[0091] If it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0092] The system service interface and network connection function corresponding to each of the multiple desktops are isolated based on the sandbox;

[0093] The operation corresponding to the first process includes one of the following:

[0094] Access the first LAN;

[0095] Access the second LAN;

[0096] Call the system service interface.

[0097] In actual application, the first local area network may be an intranet of an enterprise; the second local area network may be a wireless local area network such as a wireless Bluetooth local area network, a wireless infrared local area network, etc. The system service interface may include a printer interface, a Universal Serial Bus (USB) interface, etc.; in this way, it is possible to prevent users from leaking office data through the network, printer, or USB, etc., further improving the security of office data.

[0098] In actual application, in order to further ensure the security of office data, the first policy may also include screenshot permissions, so as to prevent the user from leaking office data through screenshots when using the desktop for office work.

[0099] Based on this, in one embodiment, the operation corresponding to the first process includes a screenshot operation; and allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy may include:

[0100] If the first desktop has the screenshot permission, allowing the terminal to execute the operation corresponding to the first process;

[0101] In the case that the first desktop does not have the screenshot permission, the terminal is prohibited from executing the operation corresponding to the first process; or a screenshot image containing traceable watermark information is generated.

[0102] The process management method provided in the embodiment of the present application monitors the processes of the terminal; when a first process is monitored, the first desktop corresponding to the first process in the multiple desktops included in the terminal is determined according to the desktop identifier carried by the first process; the system operation permissions corresponding to each desktop in the multiple desktops included in the terminal are the same or different; the process corresponding to each desktop in the multiple desktops is isolated based on a sandbox; the first policy corresponding to the first desktop is determined by utilizing the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to execute the operation corresponding to the first process; in this way, when the user implements BYOD scenarios and small and micro branch office scenarios based on the multi-desktop form of the terminal, it can avoid office data leakage, improve the security of office data, and thus improve user experience.

[0103] At the same time, since the process management method provided in the embodiment of the present application is implemented based on the multi-desktop form of the terminal itself, there is no need to protect office data through external devices. Therefore, the deployment cost is greatly reduced, and the difficulty of deployment and subsequent operation and maintenance is also reduced.

[0104] In addition, since the process management method provided in the embodiment of the present application is implemented based on the multi-desktop form of the terminal itself, users can directly switch between BYOD scenarios and / or small branch office scenarios and other application scenarios (such as users' personal application scenarios) through desktop switching. The operation is simple and convenient, thereby further improving the user experience.

[0105] The present application is further described in detail below in conjunction with application examples.

[0106] This application embodiment provides a data leakage prevention solution based on the UEM sandbox, which comprehensively protects the data of user terminals in BYOD scenarios and small and micro branch office scenarios from multiple perspectives (i.e., protects office data). Specifically, based on the user's personal desktop space that comes with the operating system of the user terminal, one or more dedicated desktop workspaces are created, that is, a multi-desktop form is constructed in the user terminal. At the same time, Figure 3 As shown, a UEM data anti-leakage control unit 301, a multi-desktop form unit 302, a process identification and isolation unit 303, a file isolation unit 304, a file encryption and decryption unit 305, a VPN and network isolation unit 306, a registry isolation unit 307, a clipboard isolation unit 308, a screen watermark and anti-screenshot unit 309, a service isolation unit 310 and an infrared and Bluetooth device isolation unit 311 are set in the user terminal to implement data protection functions such as VPN security link isolation, file isolation, file encryption, network isolation, clipboard isolation, process isolation, registry isolation, screen watermark, service isolation and infrared and Bluetooth device isolation for the software (applications) running in the workspace corresponding to each desktop in the multiple desktops.

[0107] Specifically, the UEM data leakage prevention control unit 301 is used to provide a sandbox function based on UEM implementation, which serves as the basis for the process identification and isolation unit 303, the file isolation unit 304, the file encryption and decryption unit 305, the VPN and network isolation unit 306, the registry isolation unit 307, the clipboard isolation unit 308, the screen watermark and anti-screenshot unit 309, the service isolation unit 310 and the infrared and Bluetooth device isolation unit 311; at the same time, the UEM data leakage prevention control unit 301 is used to obtain the correspondence between the desktop and the data protection policy (i.e., the above-mentioned process processing policy) from the shared memory of the multiple desktops (which can be called global shared memory) and the data protection policy corresponding to each desktop and provide them to other units.

[0108] The multi-desktop form unit 302 is used to construct a multi-desktop form including a personal desktop (i.e., the first type of desktop mentioned above) and a secure desktop (i.e., the second type of desktop mentioned above). Here, the user's data protection needs to be reflected in the secure desktop, and the following key technologies can be used to ensure it, such as process identification, file encryption and decryption, file isolation, registry isolation, network isolation, clipboard isolation, etc. At the same time, a desktop switching button is displayed in the taskbar of each desktop for quick switching between the personal desktop and the secure desktop.

[0109] The process identification and isolation unit 303 is used to accurately identify whether the process operating the data belongs to the personal desktop or the secure desktop, so as to protect the data in the secure desktop. For example, in the Windows system, the process space belonging to a certain desktop contains the corresponding desktop information (i.e. the above-mentioned desktop identification, which can be expressed in English as DesktopInformation, or DesktopInfo for short), so as to mark whether the process is a personal process (i.e. the process corresponding to the personal desktop) or a secure process (i.e. the process corresponding to the secure desktop); at the same time, a process callback function can be registered in the Windows driver by calling the corresponding application programming interface (API, Application Programming Interface) PsSetCreateProcessNotifyRoutineEx. When a process starts and exits, the system will call the registered callback function to notify the driver, and then obtain the PEB information (representing the PEB structure) of the process through the EPROCESS object of the process (representing the EPROCESS structure of the process), and obtain DesktopInfo from the PEB information to determine the desktop to which this process belongs.

[0110] The file isolation unit 304 is used to isolate files. Specifically, in the initial state, the files in the personal desktop and the files in the secure desktop are the same. Later, when the secure process opens the file with write permission, before the file is actually opened, the Minifilter technology can be used to copy the file to the redirection directory belonging to the secure desktop. The subsequent opening of the file corresponds to the file in the redirection directory, and the subsequent operations on the file are replaced by operations on the corresponding file in the redirection directory.

[0111] The file encryption and decryption unit 305 is used to encrypt and decrypt files in the redirected directory. Specifically, in the initial state, the files in the personal desktop and the files in the secure desktop are the same, both in an unencrypted state. Through the Minifilter technology, when the subsequent security process performs a write operation on the files in the redirected directory, the corresponding files will be encrypted before being written to the disk; when the security process performs a read operation on the files in the redirected directory, the read data of the corresponding files will be decrypted before being returned to the security process.

[0112] The VPN and network isolation unit 306 is used to perform VPN and network isolation. Specifically, the secure desktop needs to have the function of accessing the enterprise intranet. The network protocol support level of the software in the secure desktop is no different from that of the intranet PC. It must support the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP) and the Internet Control Message Protocol (ICMP); at the same time, it is necessary to ensure that only the software in the secure desktop can access the intranet, and the software in the personal desktop cannot access the intranet; in addition, the software in the secure desktop needs to support the Domain Name System (DNS) resolution. Here, the network driver of the Windows Filtering Platform (WFP) based on sslVPN (a VPN technology for establishing a remote secure access channel based on the Secure Sockets Layer (SSL) protocol) can be used to isolate the security process and the personal process from the network.

[0113] The registry isolation unit 307 is used to isolate the registry. Specifically, in the initial state, the registry in the personal desktop and the registry in the secure desktop are the same. Later, when the secure process opens the registry with write permission, before the corresponding registry is actually opened, the driver technology can be used to replace the path of the corresponding registry with the redirected registry path of the secure desktop, thereby opening the registry under the redirected path corresponding to the corresponding registry path, and subsequent operations on the corresponding registry are replaced by operations on the registry under the redirected registry path. Exemplarily, a registry callback can be registered in the Windows driver by calling the CmRegisterCallbackEx API, and when a registry operation occurs, the system will call the registered callback to notify the driver.

[0114] The clipboard isolation unit 308 is used to isolate the clipboard. Specifically, the data inside the secure desktop is not allowed to be copied to the personal desktop. The API (including user32.dll! GetClipboardData and user32.dll! SetClipboardData) of the process operating the clipboard can be hooked through the hook technology. When the process calls user32.dll! SetClipboardData to copy, the security attributes of the currently copied process can be set in the global shared memory. When the process calls user32.dll! GetClipboardData to paste, the security attributes of the process that triggers the copy are obtained from the global shared memory and compared with the security attributes of the currently pasted process to determine whether the current paste behavior is trusted. That is, when the security attribute of the process that triggers the copy is a secure process and the security attribute of the currently pasted process is a personal process, it can be determined that the current paste behavior is untrustworthy and the execution of the pasted process is rejected; when the security attribute of the process that triggers the copy is a personal process and the security attribute of the currently pasted process is a secure process, it can be determined that the current paste behavior is trustworthy and the execution of the pasted process is allowed.

[0115] The screen watermark and anti-screenshot unit 309 is used to prevent users from leaking information through screenshots. Specifically, a striking watermark (such as DesktopInfo, user name, user account, etc.) can be displayed in the corresponding workspace, and the screenshot screen generated after the screenshot will contain the watermark information for subsequent tracking.

[0116] The service isolation unit 310 is used to perform service isolation. Specifically, users can be prevented from leaking information through printing by prohibiting the process in the secure desktop from using the printing function. Exemplarily, through the Hook technology, the APIs that call the printer service (including Winspool.drvl! OpenPrinter, Winspool.drv! AddPrinter, Winspool.drv! StartDocPrinter, Winspool.drv! StartPagePrinter and Winspool.drv! WritePrinter) are hooked, and when the secure process calls these APIs that operate the printer, failure is directly returned.

[0117] The infrared and Bluetooth device isolation unit 311 is used to isolate the wireless infrared LAN and the wireless Bluetooth LAN. Specifically, similar to network isolation, WFP is used to achieve the isolation of the wireless infrared LAN and the wireless Bluetooth LAN. Here, the protocol family (which can be expressed as AF in English) used to achieve the isolation of the wireless infrared LAN is AF_IRDR (26), the AF used to achieve the isolation of the wireless Bluetooth LAN is AF_BTH (32), and the AF used to achieve the isolation of ordinary networks (such as corporate intranets) is AF_INET and AF_INET6. Here, the infrared and Bluetooth device isolation unit 311 determines whether to enable infrared and Bluetooth device interception based on the data protection policy corresponding to the corresponding desktop. If the corresponding interception is enabled, the access of the secure process to the infrared and Bluetooth devices will be denied, and the non-secure process will not be controlled (that is, the non-secure process can access the infrared and Bluetooth devices).

[0118] In actual application, in addition to building multiple desktop forms on the user terminal, you can also use widgets (which can be expressed as Web Widgets in English, or simply referred to as Widgets). Adding a new workspace (i.e. desktop) means adding a new Widget, and using the UEM sandbox to isolate the workspaces corresponding to each Widget.

[0119] The data leakage prevention solution based on UEM sandbox provided by this application embodiment creates one or more secure workspaces (i.e., the above-mentioned security domain) in the user terminal that are completely logically isolated from the personal desktop (i.e., the above-mentioned personal domain). The software (application) running in the secure workspace has data protection functions such as VPN security link isolation, file isolation, file encryption, network isolation, clipboard isolation, process isolation, registry isolation, screen watermark, service isolation, infrared and Bluetooth device isolation, etc. Compared with the data leakage prevention solution in the related art, it does not change the user's existing desktop usage habits. At the same time, the network, file and other operations in the secure workspace are completely isolated from the personal workspace, which is more secure.

[0120] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a process management device, which is set on the terminal, such as Figure 4 As shown, the device comprises:

[0121] The monitoring unit 401 is used to monitor the processes of the terminal; when a first process is monitored, the first desktop corresponding to the first process among the multiple desktops included in the terminal is determined according to the desktop identifier carried by the first process; the system operation permissions corresponding to each of the multiple desktops included in the terminal are the same or different; the processes corresponding to each of the multiple desktops are isolated based on the sandbox;

[0122] The processing unit 402 is used to determine the first policy corresponding to the first desktop by using the correspondence between the desktop and the process processing policy; and according to the first policy, allow or prohibit the terminal from executing the operation corresponding to the first process.

[0123] In one embodiment, the process management device further includes:

[0124] An acquisition unit is used to acquire the correspondence between the desktops and the process processing policies and the first policy from the shared memory of the multiple desktops.

[0125] In one embodiment, the plurality of desktops included in the terminal include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop;

[0126] The processing unit 402 is configured to:

[0127] In a case where the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop, allowing the terminal to execute the operation corresponding to the first process;

[0128] When the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0129] The files under the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

[0130] In one embodiment, the operation corresponding to the first process includes an operation of the second-type desktop on a first file in a file directory corresponding to the first-type desktop; when allowing the terminal to execute the operation corresponding to the first process, the processing unit 402 is used to:

[0131] When a redirection file corresponding to the first file exists in the file directory corresponding to the second-type desktop, controlling the terminal to execute an operation corresponding to the first process for the redirection file;

[0132] When a redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, a redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop, and the terminal is controlled to execute operations corresponding to the first process for the redirection file.

[0133] In one embodiment, the processing unit 402 is used to encrypt the redirection file when controlling the terminal to execute the operation corresponding to the first process on the redirection file.

[0134] In one embodiment, the processing unit 402 is configured to:

[0135] When the operation corresponding to the first process includes an operation in which the first type of desktop pastes text or an image copied from the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process;

[0136] In the case where the operation corresponding to the first process includes the operation of the second type of desktop pasting text or image copied from the first type of desktop, allowing the terminal to execute the operation corresponding to the first process; wherein,

[0137] The clipboard of each of the multiple desktops is isolated based on the sandbox.

[0138] In one embodiment, the processing unit 402 is configured to:

[0139] If it is determined according to the first policy that the first desktop has the permission to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

[0140] If it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0141] The system service interface and network connection function corresponding to each of the multiple desktops are isolated based on the sandbox;

[0142] The operation corresponding to the first process includes one of the following:

[0143] Access the first LAN;

[0144] Access the second LAN;

[0145] Call the system service interface.

[0146] In one embodiment, the operation corresponding to the first process includes a screenshot operation; the processing unit 402 is used to:

[0147] If the first desktop has the screenshot permission, allowing the terminal to execute the operation corresponding to the first process;

[0148] In the case that the first desktop does not have the screenshot permission, the terminal is prohibited from executing the operation corresponding to the first process; or a screenshot image containing traceable watermark information is generated.

[0149] Here, the function of the monitoring unit 401 is equivalent to part of the function of the process identification and isolation unit 303 in the application embodiment of the present application; the function of the acquisition unit is equivalent to part of the function of the UEM data anti-leakage control unit 301 in the application embodiment of the present application; the function of the processing unit 402 is equivalent to other functions of the UEM data anti-leakage control unit 301 and the process identification and isolation unit 303 in the application embodiment of the present application, as well as the functions of the multi-desktop form unit 302, the file isolation unit 304, the file encryption and decryption unit 305, the VPN and network isolation unit 306, the registry isolation unit 307, the clipboard isolation unit 308, the screen watermark and anti-screenshot unit 309, the service isolation unit 310 and the infrared and Bluetooth device isolation unit 311.

[0150] The monitoring unit 401 and the acquiring unit may be implemented by a processor in the process management device in combination with a communication interface; the processing unit 402 may be implemented by a processor in the process management device.

[0151] It should be noted that: the process management device provided in the above embodiment only uses the division of the above program modules as an example to illustrate when managing processes. In actual application, the above processing can be assigned to different program modules as needed, that is, the internal structure of the process management device is divided into different program modules to complete all or part of the processing described above. In addition, the process management device provided in the above embodiment and the process management method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0152] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a process management device, which is set on the terminal, such as Figure 5 As shown, the process management device 500 includes:

[0153] Communication interface 501, capable of exchanging information with other electronic devices;

[0154] A processor 502, connected to the communication interface 501 to implement information interaction with other electronic devices, and used to execute the method provided by one or more of the above technical solutions when running a computer program;

[0155] The memory 503 is used to store a computer program that can be executed on the processor 502 .

[0156] Specifically, the processor 502 is configured to perform the following operations:

[0157] Monitoring the processes of the terminal; when a first process is monitored, determining, according to a desktop identifier carried by the first process, a first desktop corresponding to the first process among multiple desktops included in the terminal; the system operation permissions corresponding to each of the multiple desktops included in the terminal are the same or different; and the processes corresponding to each of the multiple desktops are isolated based on a sandbox;

[0158] The first policy corresponding to the first desktop is determined by utilizing the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to execute the operation corresponding to the first process.

[0159] In one embodiment, the processor 502 is configured to perform the following operations:

[0160] The correspondence between the desktops and the process processing policies and the first policy are obtained from the shared memory of the multiple desktops.

[0161] In one embodiment, the plurality of desktops included in the terminal include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop; the processor 502 is configured to perform the following operations:

[0162] In a case where the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop, allowing the terminal to execute the operation corresponding to the first process;

[0163] When the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0164] The files under the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

[0165] In one embodiment, the operation corresponding to the first process includes an operation of the second type of desktop on a first file in a file directory corresponding to the first type of desktop; when allowing the terminal to execute the operation corresponding to the first process, the processor 502 is configured to perform the following operations:

[0166] When a redirection file corresponding to the first file exists in the file directory corresponding to the second-type desktop, controlling the terminal to execute an operation corresponding to the first process for the redirection file;

[0167] When a redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, a redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop, and the terminal is controlled to execute operations corresponding to the first process for the redirection file.

[0168] In one embodiment, the processor 502 is configured to perform the following operations:

[0169] When controlling the terminal to execute the operation corresponding to the first process with respect to the redirection file, the redirection file is encrypted.

[0170] In one embodiment, the processor 502 is configured to perform the following operations:

[0171] When the operation corresponding to the first process includes an operation in which the first type of desktop pastes text or an image copied from the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process;

[0172] In the case where the operation corresponding to the first process includes the operation of the second type of desktop pasting text or image copied from the first type of desktop, allowing the terminal to execute the operation corresponding to the first process; wherein,

[0173] The clipboard of each of the multiple desktops is isolated based on the sandbox.

[0174] In one embodiment, the processor 502 is configured to perform the following operations:

[0175] If it is determined according to the first policy that the first desktop has the permission to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

[0176] If it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

[0177] The system service interface and network connection function corresponding to each of the multiple desktops are isolated based on the sandbox;

[0178] The operation corresponding to the first process includes one of the following:

[0179] Access the first LAN;

[0180] Access the second LAN;

[0181] Call the system service interface.

[0182] In one embodiment, the operation corresponding to the first process includes a screenshot operation; the processor 502 is configured to perform the following operations:

[0183] If the first desktop has the screenshot permission, allowing the terminal to execute the operation corresponding to the first process;

[0184] In the case that the first desktop does not have the screenshot permission, the terminal is prohibited from executing the operation corresponding to the first process; or a screenshot image containing traceable watermark information is generated.

[0185] It should be noted that: the specific process of the processor 502 performing the above operations is detailed in the method embodiment, which will not be repeated here.

[0186] Of course, in actual application, the various components in the process management device 500 are coupled together through the bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 5 Various buses are labeled as bus system 504 .

[0187] The memory 503 in the embodiment of the present application is used to store various types of data to support the operation of the process management device 500. Examples of such data include: any computer program used to operate on the process management device 500.

[0188] The method disclosed in the above embodiment of the present application can be applied to the processor 502, or implemented by the processor 502. The processor 502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 502. The above processor 502 may be a general processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 502 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 503, and the processor 502 reads the information in the memory 503 and completes the steps of the above method in combination with its hardware.

[0189] In an exemplary embodiment, the process management device 500 can be implemented by one or more application-specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general-purpose processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0190] It can be understood that the memory 503 of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

[0191] In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory 503 storing a computer program, and the computer program can be executed by a processor 502 of a process management device 500 to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0192] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0193] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0194] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A process management method, characterized in that: include: Monitoring the processes of the terminal; when a first process is monitored, determining the first desktop corresponding to the first process among the multiple desktops included in the terminal according to the desktop identifier carried by the first process; the multiple desktops included in the terminal include first-class desktops and second-class desktops; the system operation authority corresponding to the first-class desktop is lower than the system operation authority corresponding to the second-class desktop; the system operation authority corresponding to each of the multiple desktops included in the terminal is the same or different; the process corresponding to each of the multiple desktops is isolated based on the sandbox; Determine a first policy corresponding to the first desktop by using a correspondence between desktops and process processing policies; and allow or prohibit the terminal from executing an operation corresponding to the first process according to the first policy; The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes: In a case where the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop, allowing the terminal to execute the operation corresponding to the first process; When the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein, The files under the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

2. The method according to claim 1, characterized in that The method further comprises: The correspondence between the desktops and the process processing policies and the first policy are obtained from the shared memory of the multiple desktops.

3. The method according to claim 1, characterized in that The operation corresponding to the first process includes the operation of the second-type desktop on the first file in the file directory corresponding to the first-type desktop; When allowing the terminal to execute the operation corresponding to the first process, the method further includes: When a redirection file corresponding to the first file exists in the file directory corresponding to the second-type desktop, controlling the terminal to execute an operation corresponding to the first process for the redirection file; When a redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, a redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop, and the terminal is controlled to execute operations corresponding to the first process for the redirection file.

4. The method according to claim 3, characterized in that The method further comprises: When controlling the terminal to execute the operation corresponding to the first process with respect to the redirection file, the redirection file is encrypted.

5. The method according to claim 1, characterized in that The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes: When the operation corresponding to the first process includes an operation in which the first type of desktop pastes text or an image copied from the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; In the case where the operation corresponding to the first process includes the operation of the second type of desktop pasting text or image copied from the first type of desktop, allowing the terminal to execute the operation corresponding to the first process; wherein, The clipboard of each of the multiple desktops is isolated based on the sandbox.

6. The method according to claim 1 or 2, characterized in that: The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes: If it is determined according to the first policy that the first desktop has the permission to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process; If it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibiting the terminal from executing the operation corresponding to the first process; wherein, The system service interface and network connection function corresponding to each of the multiple desktops are isolated based on the sandbox; The operation corresponding to the first process includes one of the following: Access the first LAN; Access the second LAN; Call the system service interface.

7. The method according to claim 1 or 2, characterized in that: The operation corresponding to the first process includes a screenshot operation; The allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy includes: If the first desktop has the screenshot permission, allowing the terminal to execute the operation corresponding to the first process; In the case that the first desktop does not have the screenshot permission, the terminal is prohibited from executing the operation corresponding to the first process; or a screenshot image containing traceable watermark information is generated.

8. A process management device, characterized in that: include: A monitoring unit, configured to monitor processes of a terminal; when a first process is monitored, determining, according to a desktop identifier carried by the first process, a first desktop corresponding to the first process among multiple desktops included in the terminal; the multiple desktops included in the terminal include first-category desktops and second-category desktops; the system operation authority corresponding to the first-category desktop is lower than the system operation authority corresponding to the second-category desktop; the system operation authority corresponding to each of the multiple desktops included in the terminal is the same or different; the process corresponding to each of the multiple desktops is isolated based on a sandbox; A processing unit, configured to determine a first policy corresponding to the first desktop by using a correspondence between desktops and process processing policies; and to allow or prohibit the terminal from executing an operation corresponding to the first process according to the first policy; The processing unit is specifically configured to allow the terminal to execute the operation corresponding to the first process when the operation corresponding to the first process includes an operation of the second-type desktop on a file in a file directory corresponding to the first-type desktop; When the operation corresponding to the first process includes the operation of the first type of desktop on the files in the file directory corresponding to the second type of desktop, the terminal is prohibited from executing the operation corresponding to the first process; wherein the files in the file directory corresponding to each of the multiple desktops are isolated based on the sandbox.

9. A process management device, characterized in that: include: a processor and a memory for storing a computer program capable of being executed on the processor; Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images