Data leakage prevention method, device and system

Abstract

The present invention provides a data leakage prevention method, device and system, which relates to the field of information security technology. The method is applied to a client, and the method includes: obtaining watermark configuration data and public key data; generating watermark data according to the watermark configuration data; randomly generating symmetric key data; encrypting the symmetric key data with the public key data to obtain ciphertext data; encrypting the data to be protected with the symmetric key data to obtain an encrypted message; the data to be protected includes the watermark data; sending the ciphertext data and the encrypted message to a server, so that the server performs business processing according to the ciphertext data and the encrypted message. The dynamic watermark provided by the present invention can flexibly display content according to business needs, encrypt the randomly generated symmetric key with the public key data, and then protect the data to be protected and the watermark data, and at the same time of preventing leakage, it is convenient to trace the source after leakage according to the watermark information.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data leakage prevention method, device and system. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] For some applications that are only tested internally by a small number of users due to certain considerations, it is crucial to protect the application interface and data from being leaked. Therefore, whether it is the interface or data transmission, it is necessary for developers to perform a certain degree of encryption.

[0004] At present, during user pilots of confidential applications, it is often necessary to prevent terminal users from taking photos and recording some application interfaces and leaking them to the outside, as well as to prevent security risks of simulated attacks on some back-end data through front-end interactions. Moreover, it is difficult to locate the target of attack after each problem is solved, and defense can only be carried out through back-end monitoring log warnings. The front-end is often powerless to do anything about this. Summary of the invention

[0005] The present invention provides a data leakage prevention method, device and system, which can prevent leakage and facilitate post-leakage tracing based on watermark information.

[0006] In a first aspect, an embodiment of the present invention provides a data leakage prevention method, which is applied to a client and includes:

[0007] Acquire watermark configuration data and public key data; generate watermark data according to the watermark configuration data; randomly generate symmetric key data; use the public key data to encrypt the symmetric key data to obtain ciphertext data; use the symmetric key data to encrypt the data to be protected to obtain an encrypted message; the data to be protected includes the watermark data; send the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0008] In a second aspect, an embodiment of the present invention further provides a data leakage prevention method, which is applied to a server and includes:

[0009] Receive ciphertext data and encrypted messages sent by the client; decrypt the ciphertext data to obtain symmetric key data; use the symmetric key data to decrypt the encrypted message to obtain data to be protected; the data to be protected includes watermark data; perform business processing according to the data to be protected, and encrypt the business processing result using the symmetric key data; send the encrypted business processing result to the client, so that the client performs business processing according to the encrypted business processing result.

[0010] In a third aspect, an embodiment of the present invention provides a data leakage prevention device, which is applied to a client and includes:

[0011] An acquisition module is used to acquire watermark configuration data and public key data; a watermark module is used to generate watermark data according to the watermark configuration data; a secret key module is used to randomly generate symmetric secret key data; a ciphertext module is used to encrypt the symmetric secret key data using the public key data to obtain ciphertext data; an encryption module is used to encrypt the data to be protected using the symmetric secret key data to obtain an encrypted message; the data to be protected includes the watermark data; a sending module is used to send the ciphertext data and the encrypted message to a server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0012] In a fourth aspect, an embodiment of the present invention provides a method for preventing data leakage, wherein the device is applied to a server, and the device includes:

[0013] A receiving module is used to receive ciphertext data and encrypted messages sent by a client; an acquisition module is used to decrypt the ciphertext data to obtain symmetric key data; a decryption module is used to decrypt the encrypted message using the symmetric key data to obtain data to be protected; the data to be protected includes watermark data; a business module is used to perform business processing based on the data to be protected and encrypt the business processing result using the symmetric key data; a result module is used to send the encrypted business processing result to the client, so that the client performs business processing based on the encrypted business processing result.

[0014] In a fifth aspect, an embodiment of the present invention provides a data leakage prevention system, which includes: a client and a server, wherein the client is communicatively connected with the server; the client includes any one of the above-mentioned data leakage prevention devices applied to the client; the server includes any one of the above-mentioned data leakage prevention devices applied to the server.

[0015] In a sixth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned data leakage prevention method when executing the computer program.

[0016] In a seventh aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above-mentioned data leakage prevention method.

[0017] The embodiments of the present invention bring the following beneficial effects: the embodiments of the present invention provide a data leakage prevention scheme, which includes: obtaining watermark configuration data and public key data; generating watermark data according to the watermark configuration data; randomly generating symmetric key data; encrypting the symmetric key data with the public key data to obtain ciphertext data; encrypting the data to be protected with the symmetric key data to obtain an encrypted message; the data to be protected includes the watermark data; sending the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message. The dynamic watermark provided by the implementation of the present invention can flexibly display content according to business needs, encrypt the randomly generated symmetric key with the public key data, and then protect the data to be protected and the watermark data, and at the same time prevent leakage, it is convenient to trace the source after leakage according to the watermark information.

[0018] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0019] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flow chart of a data leakage prevention method applied to a client provided by an embodiment of the present invention;

[0022] Figure 2 A flow chart of a data leakage prevention method applied to a server provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of the overall operation flow provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of a view watermark generation process provided by an embodiment of the present invention;

[0025] Figure 5 A structural block diagram of a data leakage prevention device applied to a client provided by an embodiment of the present invention;

[0026] Figure 6 A structural block diagram of a data leakage prevention device applied to a server provided by an embodiment of the present invention;

[0027] Figure 7 A structural block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] At present, there are great shortcomings in the industry's front-end confidentiality technology. Even if some companies have self-developed solutions, there are still problems such as poor versatility and inability to be universally applied. Front-end developers often have room for improvement in this area, and targeted development is also time-consuming and labor-intensive.

[0030] Based on this, the embodiments of the present invention provide a data leakage prevention method, device and system. In terms of interface leakage prevention, this solution provides a dynamic watermark that can flexibly display content according to business needs; in terms of data leakage prevention, data can be added with watermark information as a code mark according to the configuration of the project system itself. The solution provided by the present invention can take into account the advantages of code embedding and no embedding, and provide users with a more flexible means of information collection.

[0031] To facilitate understanding of this embodiment, a data leakage prevention method disclosed in an embodiment of the present invention is first introduced in detail.

[0032] The present invention provides a method for preventing data leakage. Figure 1 The data leakage prevention method flow chart shown in the figure is applied to the client, and the method comprises the following steps:

[0033] Step S102, obtaining watermark configuration data and public key data.

[0034] In the embodiment of the present invention, the watermark configuration data includes the content, shape, position, style and appearance timing of the watermark displayed on the interface. The watermark configuration data and public key data can be read from the backend interface during the application initialization phase. The public key data can be generated in advance.

[0035] Step S104: Generate watermark data according to the watermark configuration data.

[0036] In the embodiment of the present invention, the watermark data can be used for display in the interface. The number of watermarks arranged in the container is calculated, and the watermark model is placed in the global component for rendering. The watermark data can be dynamic watermark data, and the content can be flexibly displayed according to business needs.

[0037] Step S106, randomly generate symmetric key data.

[0038] In the embodiment of the present invention, the symmetric key data may be SM4 type key data.

[0039] Step S108, using the public key data to encrypt the symmetric key data to obtain ciphertext data.

[0040] In the embodiment of the present invention, the public key data is used as an encryption factor to perform AES asymmetric encryption on the symmetric key data to generate ciphertext data.

[0041] Step S110: encrypt the data to be protected using the symmetric key data to obtain an encrypted message.

[0042] In the embodiment of the present invention, the data to be protected includes watermark data. The watermark information can be added as an encryption code mark according to the configuration of the project system itself, so as to facilitate the later leakage tracing.

[0043] Step S112, sending the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0044] In the embodiment of the present invention, the client and the server can be connected in communication, and the client sends the ciphertext data and the encrypted message to the server.

[0045] The embodiment of the present invention provides a data leakage prevention scheme, which includes: obtaining watermark configuration data and public key data; generating watermark data according to the watermark configuration data; randomly generating symmetric key data; encrypting the symmetric key data with the public key data to obtain ciphertext data; encrypting the data to be protected with the symmetric key data to obtain an encrypted message; the data to be protected includes the watermark data; sending the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message. The dynamic watermark provided by the implementation of the present invention can flexibly display content according to business needs, encrypt the randomly generated symmetric key with the public key data, and then protect the data to be protected and the watermark data, and at the same time prevent leakage, it is convenient to trace the source after leakage according to the watermark information.

[0046] In one embodiment, generating watermark data according to watermark configuration data may be performed according to the following steps:

[0047] Construct a watermark component according to the watermark configuration data; generate watermark arrangement data according to the watermark component, container parameters and display parameters; render according to the watermark arrangement data to obtain watermark data.

[0048] In the embodiment of the present invention, the container refers to the size of the area of ​​the interface used to display the watermark data, for example, it can be the full screen of the interface or a partial area of ​​the interface. The container parameter is used to determine the display area of ​​the container. The display parameter can be set according to actual needs to determine the display effect.

[0049] See also Figure 4 The process of the dynamic watermark covering the view on the interface shown is that when the page is loaded for the first time, the interface will build the watermark component of the unit according to the data obtained from the backend; then calculate the horizontal and vertical columns of the watermark in the view according to the required length and width of the container and the unit size and tilt angle of the watermark component rendered this time; then render it in the container according to the number of arrangements; finally, mount the entire rendered watermark container on the view.

[0050] It should be noted that the spatial attributes related to the watermark itself (size, color, font, thickness, position, tilt, etc.) can be customized by the user.

[0051] In one embodiment, the ciphertext data and the encrypted message are sent to the server, which can be performed according to the following steps:

[0052] The encrypted data is stored in the request message; the request message and the encrypted message are sent to the server.

[0053] In the embodiment of the present invention, the ciphertext data may be set at the header position of the request message, and the encrypted message and the request message carrying the ciphertext data may be sent to the server.

[0054] In one embodiment, after the ciphertext data is stored in the request message, the following steps may be performed:

[0055] Encrypt the plaintext data in the request message to obtain encrypted information; send the encrypted information, ciphertext data and encrypted message to the server.

[0056] In an embodiment of the present invention, in order to avoid tampering, the plaintext data in the request message may be encrypted with MD5 before the front-end request, and then placed in the request message header for transmission, so that the server can encrypt the decrypted message with MD5 for comparison, thereby further ensuring the security of the information.

[0057] The present invention provides a method for preventing data leakage. Figure 2 The data leakage prevention method flow chart shown in the figure is applied to the server, and the method comprises the following steps:

[0058] Step S202, receiving ciphertext data and encrypted message sent by the client.

[0059] Step S204, decrypt the ciphertext data to obtain symmetric key data.

[0060] Step S206, decrypt the encrypted message using the symmetric key data to obtain the data to be protected.

[0061] In the embodiment of the present invention, the data to be protected includes watermark data.

[0062] Step S208: Perform business processing according to the data to be protected, and encrypt the business processing result using the symmetric key data.

[0063] Step S210: sending the encrypted business processing result to the client, so that the client performs business processing according to the encrypted business processing result.

[0064] In one embodiment, the method may further perform the following steps:

[0065] Receive encrypted information; obtain plaintext data in the request message according to the encrypted information.

[0066] In one embodiment, the method may further perform the following steps:

[0067] The data to be protected is determined according to the watermark data; and the information of the leaker is determined according to the data to be protected.

[0068] See also Figure 3 The overall operation flow diagram is shown, and the implementation of the scheme is described below with a specific embodiment.

[0069] During the application initialization phase, configuration data is read from the backend interface, and the content, shape, position, style, and timing of the watermark displayed on the interface are input into the watermark class model for creation;

[0070] Calculate the number of watermarks arranged in the container, and place the watermark model in the global component for rendering;

[0071] The front end randomly generates a symmetric secret key (M1) of SM4, and uses the SM2 public key (M2) obtained in step S101 as an encryption factor to perform AES asymmetric encryption on the SM4 public key to generate a ciphertext (A1);

[0072] Put the secret key A1 generated in the third step in the header of the front-end request body and use M1 to encrypt the request message body, and transmit it to the back-end together;

[0073] The backend receives the message body of the frontend request, decrypts A1 in the Header to obtain M1, and then decrypts the Body information body to perform the normal business process and then returns the encrypted data;

[0074] The front end receives the returned message body and directly decrypts it using M1.

[0075] At the same time, in order to avoid tampering, the plaintext body can be encrypted with MD5 before the front-end request and sent together with the request header. The back-end will encrypt the decrypted body with MD5 for comparison.

[0076] The present invention consists of two parts: a server and a client. The server provides the front end with the required configuration data, including the public and private keys of a certain encryption link and the back-end configurable watermark-related information. In the application initialization stage, the server sends the background configuration data to the front end, and the front end uses it to save and initialize the interface watermark, thereby ensuring that the watermark is evenly covered in the user's visible view range; in the front-end and back-end data interaction, the data is encrypted in combination with the watermark information, which ensures the encryption effect while also making the encrypted ciphertext identifiable. This process is repeated in each interaction, and ensures that the front-end and back-end can continuously encrypt and decrypt.

[0077] The present invention provides a data leakage prevention method, device and system, which prevents some leakage behaviors from the user view and business data. In addition, the developer also refines the watermark design according to the business scenario needs and the interface aesthetics needs to achieve the effect of both the host and the guest enjoying the experience. Compared with the existing solutions, in addition to the characteristics of effectively preventing leakage, this solution also makes relevant preparations for tracing the source after the leakage. For each interface and each piece of data, the root cause can be traced according to the watermark, and the leaker can be quickly located, which greatly enhances the security of the application.

[0078] The present invention also provides a data leakage prevention device applied to a client, as described in the following embodiments. Since the principle of the device to solve the problem is similar to that of the data leakage prevention method applied to the client, the implementation of the device can refer to the implementation of the data leakage prevention method applied to the client, and the repeated parts will not be repeated. Figure 5 The structure block diagram of the data leakage prevention device applied to the client is shown, and the device includes:

[0079] The acquisition module 51 is used to obtain watermark configuration data and public key data; the watermark module 52 is used to generate watermark data according to the watermark configuration data; the secret key module 53 is used to randomly generate symmetric secret key data; the ciphertext module 54 is used to encrypt the symmetric secret key data with the public key data to obtain ciphertext data; the encryption module 55 is used to encrypt the data to be protected with the symmetric secret key data to obtain an encrypted message; the data to be protected includes the watermark data; the sending module 56 is used to send the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0080] In one embodiment, the watermark module is specifically used to: construct a watermark component according to watermark configuration data; generate watermark arrangement data according to the watermark component, container parameters and display parameters; and render according to the watermark arrangement data to obtain watermark data.

[0081] In one embodiment, the sending module includes: a processing unit, used to store the ciphertext data in the request message; and a data unit, used to send the request message and the encrypted message to the server.

[0082] In one embodiment, the processing unit is specifically used to: encrypt the plaintext data in the request message to obtain encrypted information; and send the encrypted information, the ciphertext data and the encrypted message to the server.

[0083] The present invention also provides a data leakage prevention device applied to the server, as described in the following embodiments. Since the principle of the device to solve the problem is similar to the data leakage prevention method applied to the server, the implementation of the device can refer to the implementation of the data leakage prevention method applied to the server, and the repeated parts will not be repeated. Figure 6 The structure block diagram of the data leakage prevention device applied to the server is shown, and the device includes:

[0084] The receiving module 61 is used to receive the ciphertext data and encrypted message sent by the client; the data module 62 is used to decrypt the ciphertext data to obtain the symmetric key data; the decryption module 63 is used to decrypt the encrypted message using the symmetric key data to obtain the data to be protected; the data to be protected includes the watermark data; the business module 64 is used to perform business processing according to the data to be protected, and encrypt the business processing result using the symmetric key data; the result module 65 is used to send the encrypted business processing result to the client, so that the client can perform business processing according to the encrypted business processing result.

[0085] In one embodiment, the device further includes a plaintext module, which is used to: receive encrypted information; and obtain plaintext data in the request message according to the encrypted information.

[0086] In one embodiment, it also includes an anti-leakage module, which is used to: determine the data to be protected according to the watermark data; and determine the leaker information according to the data to be protected.

[0087] A data leakage prevention system is also provided in an embodiment of the present invention, which includes a client and a server, wherein the client and the server are in communication connection; the client includes any one of the above-mentioned data leakage prevention devices applied to the client; and the server includes any one of the above-mentioned data leakage prevention devices applied to the server.

[0088] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device embodiment for implementing all or part of the content of the above data leakage prevention method. The electronic device specifically includes the following content:

[0089] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between related devices; the electronic device can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the electronic device can be implemented with reference to the embodiment for realizing the above-mentioned data leakage prevention method and the embodiment for realizing the above-mentioned data leakage prevention device, and the contents thereof are incorporated herein and the repeated parts are not repeated.

[0090] Figure 7 FIG. 1 is a schematic diagram of a system structure of an electronic device provided in an embodiment of the present invention. Figure 7 As shown, the electronic device 70 may include a processor 701 and a memory 702; the memory 702 is coupled to the processor 701. It is worth noting that Figure 7is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0091] In one embodiment, the functions implemented by the data leakage prevention method may be integrated into the processor 701. The processor 701 may be configured to perform the following control:

[0092] Acquire watermark configuration data and public key data; generate watermark data according to the watermark configuration data; randomly generate symmetric key data; use the public key data to encrypt the symmetric key data to obtain ciphertext data; use the symmetric key data to encrypt the data to be protected to obtain an encrypted message; the data to be protected includes the watermark data; send the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0093] From the above, it can be seen that the electronic device provided in the embodiment of the present invention provides a dynamic watermark that can flexibly display content according to business needs, and use public key data to encrypt the randomly generated symmetric key, thereby protecting the protected data and watermark data. While preventing leakage, it is convenient to trace the source after leakage based on the watermark information.

[0094] In another embodiment, the data leakage prevention device may be configured separately from the processor 701. For example, the data leakage prevention device may be configured as a chip connected to the processor 701, and the function of the data leakage prevention method may be implemented under the control of the processor.

[0095] like Figure 7 As shown, the electronic device 70 may also include: a communication module 703, an input unit 704, an audio processing unit 705, a display 706, and a power supply 707. It is worth noting that the electronic device 70 does not necessarily have to include Figure 7 In addition, the electronic device 70 may also include Figure 7 For components not shown, reference may be made to the prior art.

[0096] like Figure 7 As shown, the processor 701 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The processor 701 receives inputs and controls the operations of various components of the electronic device 70 .

[0097] The memory 702 may be, for example, a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices, or one or more thereof. The above-mentioned information related to the failure may be stored, and a program for executing the related information may also be stored. The processor 701 may execute the program stored in the memory 702 to implement information storage or processing, etc.

[0098] The input unit 704 provides input to the processor 701. The input unit 704 is, for example, a key or a touch input device. The power supply 707 is used to provide power to the electronic device 70. The display 706 is used to display display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0099] The memory 702 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that stores information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 702 may also be some other type of device. The memory 702 includes a buffer memory 7021 (sometimes referred to as a buffer). The memory 702 may include an application / function storage unit 7022, which is used to store application programs and function programs or processes for executing the operation of the electronic device 70 through the processor 701.

[0100] The memory 702 may also include a data storage unit 7023 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 7024 of the memory 702 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0101] The communication module 703 is a transmitter / receiver that sends and receives signals via the antenna 708. The communication module (transmitter / receiver) 703 is coupled to the processor 701 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0102] Based on different communication technologies, multiple communication modules 703 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) 703 is also coupled to a speaker 709 and a microphone 710 via an audio processing unit 705 to provide an audio output via the speaker 709 and receive an audio input from the microphone 710, thereby realizing a common telecommunication function. The audio processing unit 705 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processing unit 705 is also coupled to the processor 701, so that recording can be performed on the local machine through the microphone 710, and the sound stored on the local machine can be played through the speaker 709.

[0103] An embodiment of the present invention further provides a computer-readable storage medium for implementing all the steps in the data leakage prevention method in the above embodiment. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all the steps in the data leakage prevention method in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0104] Acquire watermark configuration data and public key data; generate watermark data according to the watermark configuration data; randomly generate symmetric key data; use the public key data to encrypt the symmetric key data to obtain ciphertext data; use the symmetric key data to encrypt the data to be protected to obtain an encrypted message; the data to be protected includes the watermark data; send the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message.

[0105] From the above, it can be seen that the computer-readable storage medium provided in the embodiments of the present invention and the dynamic watermark provided can flexibly display content according to business needs, use public key data to encrypt the randomly generated symmetric key, and then protect the protected data and watermark data. While preventing leakage, it is convenient to trace the source after leakage based on the watermark information.

[0106] Although the present invention provides method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the actual device or client product is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, in a parallel processor or multi-threaded processing environment).

[0107] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0108] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0111] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0112] In this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The orientation or position relationship indicated by the terms "upper", "lower", etc. is based on the orientation or position relationship shown in the accompanying drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0113] Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0114] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention is not limited to any single aspect, any single embodiment, or any combination and / or replacement of these aspects and / or embodiments. Each aspect and / or embodiment of the present invention may be used alone or in combination with one or more other aspects and / or other embodiments.

[0115] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A data leakage prevention method, characterized in that: Applied to a client; the method comprises: Obtain watermark configuration data and public key data; Generate watermark data according to the watermark configuration data; Randomly generate symmetric key data; Encrypting the symmetric key data using the public key data to obtain ciphertext data; The data to be protected is encrypted using the symmetric key data to obtain an encrypted message; the data to be protected includes the watermark data; wherein the watermark data is dynamic watermark data, and the content is flexibly displayed according to business requirements; in terms of data leakage prevention, the data is added with watermark information as an encryption code mark according to the configuration of the project system itself; Sending the ciphertext data and the encrypted message to the server, so that the server performs business processing according to the ciphertext data and the encrypted message; The step of sending the ciphertext data and the encrypted message to the server includes: Storing the ciphertext data in a request message; Sending the request message and the encrypted message to the server; After storing the ciphertext data in the request message, the method further includes: Perform MD5 encryption on the plaintext data in the request message to obtain encrypted information; Sending the encrypted information, the ciphertext data and the encrypted message to the server; Generating watermark data according to the watermark configuration data includes: Constructing a watermark component according to the watermark configuration data; the watermark configuration data includes parameters related to the content, shape, position, style and appearance timing of the watermark displayed on the interface; Generate watermark arrangement data according to the watermark components, container parameters and display parameters; Rendering is performed according to the watermark arrangement data to obtain watermark data.

2. A data leakage prevention method, characterized in that: Applied to the server; the method comprises: Receive ciphertext data and encrypted messages sent by the client; Decrypting the ciphertext data to obtain symmetric key data; The encrypted message is decrypted using the symmetric key data to obtain the data to be protected; the data to be protected includes watermark data; wherein the watermark data is dynamic watermark data, and the content is flexibly displayed according to business needs; in terms of data leakage prevention, the data is added with watermark information as an encryption code mark according to the configuration of the project system itself; Performing business processing according to the data to be protected, and encrypting the business processing result using the symmetric key data; Sending the encrypted business processing result to the client, so that the client performs business processing according to the encrypted business processing result; Also includes: Receive encrypted information; wherein the encrypted information is obtained by performing MD5 encryption on the plain text data in the request message; Obtaining plaintext data in the request message according to the encrypted information; The watermark data is obtained by constructing a watermark component according to watermark configuration data; the watermark configuration data includes parameters related to the content, shape, position, style and appearance timing of the watermark displayed on the interface; generating watermark arrangement data according to the watermark component, container parameters and display parameters; and rendering according to the watermark arrangement data.

3. The method according to claim 2, characterized in that Also includes: Determining the data to be protected according to the watermark data; The leaker information is determined according to the data to be protected.

4. A data leakage prevention device, characterized in that: Applied to a client; the device comprises: An acquisition module, used to obtain watermark configuration data and public key data; A watermark module, used to generate watermark data according to the watermark configuration data; The secret key module is used to randomly generate symmetric secret key data; A ciphertext module, used to encrypt the symmetric secret key data using the public key data to obtain ciphertext data; An encryption module, used to encrypt the data to be protected by using the symmetric key data to obtain an encrypted message; the data to be protected includes the watermark data; wherein the watermark data is dynamic watermark data, and the content is flexibly displayed according to business requirements; in terms of data leakage prevention, the data is added with watermark information as an encryption code mark according to the configuration of the project system itself; A sending module, used for sending the ciphertext data and the encrypted message to a server, so that the server performs service processing according to the ciphertext data and the encrypted message; Wherein, the sending module includes: A processing unit, used for storing the ciphertext data in a request message; A data unit, used to send the request message and the encrypted message to the server; The processing unit is specifically used for: Perform MD5 encryption on the plaintext data in the request message to obtain encrypted information; Sending the encrypted information, the ciphertext data and the encrypted message to the server; The watermark module is specifically used for: Constructing a watermark component according to the watermark configuration data; the watermark configuration data includes parameters related to the content, shape, position, style and appearance timing of the watermark displayed on the interface; Generate watermark arrangement data according to the watermark components, container parameters and display parameters; Rendering is performed according to the watermark arrangement data to obtain watermark data.

5. A data leakage prevention device, characterized in that: Applied to the server; the device comprises: A receiving module, used for receiving ciphertext data and encrypted messages sent by the client; A data module, used to decrypt the ciphertext data to obtain symmetric key data; A decryption module, used to decrypt the encrypted message using the symmetric key data to obtain the data to be protected; the data to be protected includes watermark data; wherein the watermark data is dynamic watermark data, and the content is flexibly displayed according to business needs; in terms of data leakage prevention, the data is added with watermark information as an encryption code mark according to the configuration of the project system itself; A business module, used to perform business processing according to the data to be protected, and encrypt the business processing result using the symmetric key data; A result module, used to send the encrypted business processing result to the client, so that the client performs business processing according to the encrypted business processing result; Also includes plaintext modules for: Receive encrypted information; wherein the encrypted information is obtained by performing MD5 encryption on the plain text data in the request message; Obtaining plaintext data in the request message according to the encrypted information; The watermark data is obtained by constructing a watermark component according to watermark configuration data; the watermark configuration data includes parameters related to the content, shape, position, style and appearance timing of the watermark displayed on the interface; generating watermark arrangement data according to the watermark component, container parameters and display parameters; and rendering according to the watermark arrangement data.

6. The device according to claim 5, characterized in that Also includes anti-leakage module for: Determining the data to be protected according to the watermark data; The leaker information is determined according to the data to be protected.

7. A data leakage prevention system, characterized in that: It includes a client and a server, wherein the client is connected to the server for communication; The client comprises the data leakage prevention device according to claim 4; The server includes the data leakage prevention device described in any one of claims 5-6.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the data leakage prevention method according to any one of claims 1 to 3 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the data leakage prevention method according to any one of claims 1 to 3 is implemented.

Images