File protection method, device and storage medium

Abstract

The present invention discloses a file protection method, device and storage medium, the method comprising: first, receiving a remote control request from a control terminal, and obtaining a session identifier and a corresponding remote control protocol address of the control terminal. Then, if the remote control protocol address of the control terminal does not belong to a first set, and the session identifier of the control terminal does not belong to a second set, the session identifier of the control terminal is recorded in the second set, wherein the first set is a remote control protocol address set for which operations are allowed; the second set is a session identifier set for which operations are prohibited; finally, when an operation request from the control terminal is received, if the operation object is a protected file, and the session identifier of the control terminal belongs to the second set, the operation request is prohibited. The above method can limit the remote control authority of a user who logs in to the operating system based on the remote control protocol, avoid users from tampering with the remotely controlled system files or directories, achieve the protection effect of files, and further improve network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a file protection method, device and storage medium. Background Art

[0002] With the continuous development of network technology, users enjoy a variety of network services in real time based on network technology. At the same time, corporate users or individual users maliciously access servers and tamper with files, and the tampering methods are constantly changing. Among them, some users access the Windows operating system through the Remote Desktop Protocol (RDP) and maliciously tamper with special directories and files in this remote access scenario. Therefore, how to limit users' remote control permissions is an urgent problem to be solved. Summary of the invention

[0003] The present invention provides a file protection method, device and storage medium, which are used to solve the problem in the prior art that a user tampers with files on a controlled end through a remote control protocol.

[0004] In a first aspect, an embodiment of the present invention provides a file protection method, the method comprising:

[0005] Receiving a remote control request from a control terminal, and obtaining a session identifier and a corresponding remote control protocol address of the control terminal;

[0006] If the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set; wherein the first set is a set of remote control protocol addresses for which operations are allowed; and the second set is a set of session identifiers for which operations are prohibited;

[0007] When receiving an operation request from the control end, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited.

[0008] In a possible implementation manner, the receiving a remote control request from a control terminal and acquiring a session identifier and a corresponding remote control protocol address of the control terminal includes:

[0009] The remote control request of the control end is received through the driver layer, a connection is established with the control end, and the session identifier and the corresponding remote control protocol address of the control end are obtained through the application layer.

[0010] In a possible implementation, when receiving an operation request from the control end, if the operation object is a protected file and the session identifier of the control end belongs to the second set, prohibiting the operation request includes:

[0011] When receiving an operation request from the control end through the driver layer, sending an acquisition request for the second set to the application layer through the driver layer;

[0012] After receiving the acquisition request through the application layer, after acquiring the second set from the user side through the application layer, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited through the driver layer.

[0013] In a possible implementation manner, the first set is obtained from a network side, and the method further includes:

[0014] After receiving the update message sent by the network side, updating the first set;

[0015] Determining whether there is a target session identifier in the second set, wherein the remote control protocol address corresponding to the target session identifier is in the updated first set;

[0016] If yes, delete the target session identifier from the second set.

[0017] In a possible implementation manner, whether the operation object is a protected file is determined in the following manner:

[0018] If the operation object is stored in a preset protected storage location, the operation object is determined to be the protected file.

[0019] In a second aspect, an embodiment of the present invention provides a file protection device, the device comprising: at least one processing unit and at least one storage unit, wherein the storage unit stores a program code, and when the program code is executed by the processing unit, the processing unit performs the following process:

[0020] Receiving a remote control request from a control terminal, and obtaining a session identifier and a corresponding remote control protocol address of the control terminal;

[0021] If the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set; wherein the first set is a set of remote control protocol addresses for which operations are allowed; and the second set is a set of session identifiers for which operations are prohibited;

[0022] When receiving an operation request from the control end, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited.

[0023] In a possible implementation manner, the processing unit is specifically configured to:

[0024] The remote control request of the control end is received through the driver layer, a connection is established with the control end, and the session identifier and the corresponding remote control protocol address of the control end are obtained through the application layer.

[0025] In a possible implementation manner, the processing unit is specifically configured to:

[0026] When receiving an operation request from the control end through the driver layer, sending an acquisition request for the second set to the application layer through the driver layer;

[0027] After receiving the acquisition request through the application layer, after acquiring the second set from the user side through the application layer, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited through the driver layer.

[0028] In a possible implementation manner, the processing unit is further configured to:

[0029] After receiving the update message sent by the network side, updating the first set;

[0030] Determining whether there is a target session identifier in the second set, wherein the remote control protocol address corresponding to the target session identifier is in the updated first set;

[0031] If yes, delete the target session identifier from the second set.

[0032] In a possible implementation manner, whether the operation object is a protected file is determined in the following manner:

[0033] If the operation object is stored in a preset protected storage location, the operation object is determined to be the protected file.

[0034] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes a method as described in any one of the first aspects.

[0035] The beneficial effects of the present invention are as follows:

[0036] The present invention discloses a file protection method, device and storage medium, the method comprising: first, receiving a remote control request from a control terminal, and obtaining a session identifier and a corresponding remote control protocol address of the control terminal. Then, if the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set, wherein the first set is a remote control protocol address set for which operations are allowed; the second set is a session identifier set for which operations are prohibited; finally, when an operation request from the control terminal is received, if the operation object is a protected file, and the session identifier of the control terminal belongs to the second set, the operation request is prohibited. The above method can limit the remote control authority of a user who logs in to the operating system based on the remote control protocol, avoid the user from tampering with the remotely controlled system files or directories, achieve the protection effect of the files, and further improve the network security. In addition, the present invention only limits the operation authority of a specific control terminal and a specific file, thereby avoiding the wrong restriction of the control terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0038] Figure 1 A flowchart of a file protection method provided by an embodiment of the present invention;

[0039] Figure 2 A flowchart of an information updating method provided by an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of a specific process of a file protection method provided by an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the structure of a file protection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Currently, users can use the multi-channel protocol developed by Microsoft to help local computers connect to remote computers, namely the Remote Desktop Protocol (RDP) to access the Windows operating system of the remote computer. When the control end is connected to the controlled end, the controlled end can identify the session ID (Session ID, SID) of the control end, where the session ID is composed of processes and other system objects (such as window stations, desktops, and windows), representing a user's workstation login session. After a user logs in to the Windows system, whether the user logs in locally or remotely, the system will assign a new SID to the user. In this remote access scenario, special directories and files can be maliciously tampered with. Therefore, how to limit the user's remote access rights is an urgent problem to be solved.

[0044] Based on the above problems, the embodiments of the present invention provide a file protection method, device and storage medium to solve the problem in the prior art that users tamper with files on a controlled end through a remote control protocol.

[0045] The following describes the file protection method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this regard.

[0046] like Figure 1 FIG. 1 is a flow chart of a file protection method provided by an embodiment of the present invention, the method comprising:

[0047] Step 101: Receive a remote control request from a control terminal, and obtain a session identifier and a corresponding remote control protocol address of the control terminal.

[0048] Step 102, if the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, then the session identifier of the control terminal is recorded in the second set;

[0049] The first set is a set of remote control protocol addresses that are allowed to be operated; the second set is a set of session identifiers that are prohibited to be operated;

[0050] Step 103: When receiving an operation request from the control terminal, if the operation object is a protected file and the session identifier of the control terminal belongs to the second set, the operation request is prohibited.

[0051] The present invention discloses a file protection method, which comprises: first, receiving a remote control request from a control terminal, and obtaining a session identifier and a corresponding remote control protocol address of the control terminal. Then, if the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set, wherein the first set is a remote control protocol address set for which operations are allowed; and the second set is a session identifier set for which operations are prohibited; finally, when an operation request from the control terminal is received, if the operation object is a protected file, and the session identifier of the control terminal belongs to the second set, the operation request is prohibited. The above method can limit the remote control authority of a user who logs in to the operating system based on the remote control protocol, avoid the user from tampering with the remotely controlled system files or directories, achieve the protection effect of the files, and further improve the network security. In addition, the present invention only limits the operation authority of a specific control terminal and a specific file, thereby avoiding the wrong restriction of the control terminal.

[0052] The above file protection method is further described below in conjunction with specific embodiments:

[0053] like Figure 2 As shown, it is a flow chart of an information updating method provided by an embodiment of the present invention, which is used to update the information in the first set and the second set, and the method includes:

[0054] Step 201: The first set on the network side is updated, and an update message is sent to the controlled end.

[0055] In a possible embodiment, when a developer updates the first set on the network side, such as adding IP: 192.168.1.4 to the first set, the network side sends an update message to the controlled end, wherein the update message includes reminder information for reminding the controlled end to update and update information of the first set.

[0056] Step 202: After receiving the update message sent by the network side, the controlled end updates the first set.

[0057] Step 203 , determining whether there is a target session identifier in the second set, if so, executing step 204 , otherwise, executing step 205 .

[0058] It should be noted that the target session identifier refers to the session identifier of the corresponding remote control protocol address in the updated first set.

[0059] Step 204: The controlled end deletes the target session identifier from the second set, and the update ends.

[0060] Step 205, end the update.

[0061] In a possible embodiment, continuing with the above example, if the target session identifier SID: 4 corresponding to IP: 192.168.1.4 has been recorded in the second set, the target session identifier SID: 4 is deleted from the second set.

[0062] Through the above method, when the first set information on the network side is updated, the first set that has been sent to the controlled end is updated, and the second set is further updated, and the target session identifier corresponding to the remote control protocol address that has been added to the first set is deleted, thereby avoiding erroneous restrictions on remote control users due to failure to update the second set in time.

[0063] The following is a detailed description of the above file protection method under the network side, the controlled end application layer, the controlled end driver layer and the control end architecture:

[0064] like Figure 3 FIG. 1 is a schematic diagram of a specific process of a file protection method provided by an embodiment of the present invention, the method comprising:

[0065] Step 301: The controlled end is started, and the driver layer of the controlled end performs driver initialization.

[0066] It should be noted that the driver initialization here refers to the driver initialization registration process callback and the file system filter driver framework (File System Minifilter Drivers, Minifilter), where Minifilter refers to a set of frameworks provided to simplify the development of file filter drivers by third-party developers.

[0067] Step 302: The application layer of the controlled end sends a first set acquisition request to the network side.

[0068] It should be noted that the first set is a set of remote control protocol addresses that are allowed to operate, that is, a remote control protocol whitelist.

[0069] Step 303: After receiving the first set acquisition request, the network side sends the first set to the application layer of the controlled end.

[0070] It should be noted that the network side may be a server or other computer that provides computing or application services to the client.

[0071] Step 304: If the first set on the network side is updated, an update message is sent to the application layer.

[0072] Step 305: After receiving the update message sent by the network side, the application layer updates the first set.

[0073] Step 306: The application layer determines whether there is a target session identifier in the second set. If so, the target session identifier is deleted from the second set. Otherwise, the update is terminated.

[0074] Step 307: The control end sends a remote control request to the driver layer of the controlled end through the remote control protocol.

[0075] Step 308: The driver layer receives the remote control request and establishes a connection with the control end.

[0076] Specifically, when a Winlogon process is created, that is, when the controlled end establishes a connection with the control end, the driver process monitoring callback is triggered, and the driver layer notifies the application layer of the Winlogon process event, so that the application layer obtains the session identifier of the control end and the corresponding remote control protocol address.

[0077] Furthermore, according to the needs of developers, the present invention can trigger the driver process monitoring callback when a Winlogon process ends, that is, when the controlled end is disconnected from the controlling end, and the driver layer notifies the application layer of the Winlogon process event so that the application layer obtains the session identifier of the controlling end and the corresponding remote control protocol address.

[0078] Step 309: The application layer obtains the session identifier of the control end and the corresponding remote control protocol address.

[0079] Specifically, the application layer of the controlled end traverses the current session identification information to obtain the session identification of the control end and its corresponding remote control protocol address.

[0080] It should be noted that the driver layer of the controlled end cannot identify the remote control protocol address, but can determine the corresponding remote control protocol address by identifying the session identifier.

[0081] Step 310: If the remote control protocol address of the control end does not belong to the first set, and the session identifier of the control end does not belong to the second set, the application layer of the controlled end records the session identifier of the control end into the second set.

[0082] It should be noted that the second set is a set of session identifiers for which operations are prohibited, that is, a session identifier blacklist.

[0083] Specifically, the application layer of the controlled end records the session identifiers whose remote control protocol addresses do not belong to the first set and whose session identifiers of the control end do not belong to the second set into the second set.

[0084] Step 311: The control end sends an operation request to the driver layer of the controlled end.

[0085] It should be noted that the operation request includes but is not limited to operations such as adding content, reducing content, deleting files, and copying files.

[0086] Step 312: The driver layer sends a request for obtaining the second set to the application layer.

[0087] Step 313: The application layer obtains the second set from the user side and sends it to the driver layer.

[0088] It should be noted that the second set is pre-established and stored on the user side. When establishing the initial second set, a preset session identifier can be written, or the initial second set can be left empty and the session identifier content of the second set can be corrected in subsequent connections.

[0089] Step 314: If the operation object is a protected file and the session identifier of the control terminal belongs to the second set, the driver layer prohibits the operation request; otherwise, the driver layer approves the operation request of the control terminal.

[0090] Specifically, if the operation object is stored in a preset protection storage location, the driver layer determines that the operation object is a protected file. If the operation object is not a file that needs to be protected, the driver layer passes the operation request of the control end. If the remote control protocol of the control end belongs to the first set, that is, the remote control protocol that the developer believes can be trusted, then regardless of whether the operation object is a file that needs to be protected, the driver layer will open permissions to the control end and pass the operation request of the control end.

[0091] It should be noted that the operation objects include but are not limited to file contents such as documents and physical addresses such as directories.

[0092] In a possible embodiment, if the developer sets to protect all files under the C drive, if file A is stored in the C drive, the driver layer determines that the operation object is a protected file. When a user accesses the Windows operating system in the form of RDP, the user's control authority is partially restricted so that the user cannot tamper with the files or directories that need to be protected. Furthermore, the file modification authority can be opened to the RDP user logged in through the remote control protocol address recorded in the first set. For the RDP login user whose remote control protocol address does not belong to the first set, although he can log in to the controlled end system normally, he has no right to modify the protected files and directories.

[0093] The specific method of protecting the above files is described below in conjunction with specific embodiments:

[0094] In a possible embodiment, the first set includes IP: 192.168.1.1, IP: 192.168.1.2, IP: 192.168.1.3 and IP: 192.168.1.4, the initial second set does not include a session identifier, and the storage path of the protected file is C:\Windows\Downloaded Program Files.

[0095] The controlled end starts and loads the driver. The application layer of the controlled end sends a first set acquisition request to the server to obtain the above-mentioned first set information. The control end establishes a connection with the controlled end through the remote control protocol. The application layer obtains the session identifier SID: 3 of the control end and the corresponding remote control protocol address IP: 192.168.1.5. Since IP: 192.168.1.5 does not belong to the first set and SID: 3 does not belong to the second set, the application layer of the controlled end records SID: 3 in the second set. The control end sends a modification operation request to the driver layer of the controlled end for the operation object C:\Windows\Downloaded Program Files\a.html. The driver layer sends a second set acquisition request to the application layer. The application layer obtains the second set from the user side and sends it to the driver layer. The driver layer authenticates the operation object a.html according to the storage path of the file. Since the storage path of the operation object is C:\Windows\Downloaded Program Files, it can be determined that the operation object is a protected file. At the same time, the session identifier of the control end belongs to the second set, so the driver layer prohibits the modification operation of the control end.

[0096] Based on the same inventive concept, an embodiment of the present invention further provides a file protection device. The implementation of the device can refer to the implementation of the above-mentioned file protection method, and the repeated parts will not be elaborated again.

[0097] like Figure 4 FIG. 4 is a schematic diagram of a file protection device provided by an embodiment of the present invention. The device includes: at least one processing unit 401 and at least one storage unit 402, wherein the storage unit stores program codes. When the program codes are executed by the processing unit, the processing unit performs the following processes:

[0098] Receive the remote control request from the control end, and obtain the session identifier of the control end and the corresponding remote control protocol address;

[0099] If the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set; wherein the first set is a set of remote control protocol addresses for which operations are allowed; and the second set is a set of session identifiers for which operations are prohibited;

[0100] When receiving an operation request from the control end, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited.

[0101] In a possible embodiment, the processing unit 401 is specifically configured to:

[0102] The driver layer receives the remote control request from the control end, establishes a connection with the control end, and obtains the session identifier and the corresponding remote control protocol address of the control end through the application layer.

[0103] In a possible embodiment, the processing unit 401 is specifically configured to:

[0104] When receiving an operation request from the control end through the driver layer, sending a second set of acquisition requests to the application layer through the driver layer;

[0105] After receiving the acquisition request through the application layer, after acquiring the second set from the user side through the application layer, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited through the driver layer.

[0106] In a possible embodiment, the processing unit 401 is further configured to:

[0107] After receiving the update message sent by the network side, updating the first set;

[0108] Determining whether there is a target session identifier in the second set, wherein the remote control protocol address corresponding to the target session identifier is in the updated first set;

[0109] If yes, the target session identifier is deleted from the second set.

[0110] In a possible embodiment, whether the operation object is a protected file is determined in the following manner:

[0111] If the operation object is stored in a preset protected storage location, the operation object is determined to be a protected file.

[0112] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the container encryption method in any of the above method embodiments.

[0113] The present invention discloses a file protection method, device and storage medium. The method comprises: a controlled end is started, and a driver layer of the controlled end performs driver initialization; an application layer of the controlled end sends a first set acquisition request to a network side; after receiving the first set acquisition request, the network side sends the first set to the application layer of the controlled end; after the control end establishes a connection with the driver layer of the controlled end through a remote control protocol, the application layer acquires a session identifier of the control end and a corresponding remote control protocol address; if the remote control protocol address of the control end does not belong to the first set and the session identifier of the control end does not belong to a second set, the application layer of the controlled end records the session identifier of the control end into the second set; when an operation request of the control end is received, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited. The above method can limit the remote control authority of a user who logs in to the operating system based on the remote control protocol, avoid the user from tampering with the remotely controlled system file or directory, achieve the protection effect of the file, further improve the network security, and the present invention only limits the operation authority of a specific control end and a specific file, thereby avoiding the wrong restriction of the control end. In addition, when the first set on the network side is updated, the controlled end determines whether there is a session identifier in the second set that corresponds to the remote control protocol address in the updated first set. If so, the controlled end deletes the target session identifier from the second set and ends the update, which can further avoid erroneous restrictions on the remote control user's operating permissions due to failure to update the second set in time.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A file protection method, characterized in that: The method comprises: The driver layer performs driver initialization and receives a remote control request from the control end to trigger the driver layer process callback, wherein the driver initialization represents the driver initialization registration process callback and the file system filter driver framework; Notify the application layer of Winlogon process events through the driver layer, and obtain the session identifier of the control terminal and the corresponding remote control protocol address through the application layer; If the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set; wherein the first set is a set of remote control protocol addresses for which operations are allowed; and the second set is a set of session identifiers for which operations are prohibited; When receiving an operation request from the control end through the driver layer, sending an acquisition request for the second set to the application layer through the driver layer; After receiving the acquisition request through the application layer, after acquiring the second set from the user side through the application layer, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited through the driver layer.

2. The method according to claim 1, characterized in that The first set is obtained from the network side, and the method further includes: After receiving the update message sent by the network side, updating the first set; Determining whether there is a target session identifier in the second set, wherein the remote control protocol address corresponding to the target session identifier is in the updated first set; If yes, delete the target session identifier from the second set.

3. The method according to any one of claims 1 to 2, characterized in that: Determine whether the operation object is a protected file by the following method: If the operation object is stored in a preset protected storage location, the operation object is determined to be the protected file.

4. A file protection device, characterized in that: The device comprises: at least one processing unit and at least one storage unit, wherein the storage unit stores a program code, and when the program code is executed by the processing unit, the processing unit performs the following process: The driver layer performs driver initialization and receives a remote control request from the control end to trigger the driver layer process callback, wherein the driver initialization represents the driver initialization registration process callback and the file system filter driver framework; Notify the application layer of Winlogon process events through the driver layer, and obtain the session identifier of the control terminal and the corresponding remote control protocol address through the application layer; If the remote control protocol address of the control terminal does not belong to the first set, and the session identifier of the control terminal does not belong to the second set, the session identifier of the control terminal is recorded in the second set; wherein the first set is a set of remote control protocol addresses for which operations are allowed; and the second set is a set of session identifiers for which operations are prohibited; When receiving an operation request from the control end through the driver layer, sending an acquisition request for the second set to the application layer through the driver layer; After receiving the acquisition request through the application layer, after acquiring the second set from the user side through the application layer, if the operation object is a protected file and the session identifier of the control end belongs to the second set, the operation request is prohibited through the driver layer.

5. The device according to claim 4, characterized in that The first set is obtained from the network side, and the processing unit is further used for: After receiving the update message sent by the network side, updating the first set; Determining whether there is a target session identifier in the second set, wherein the remote control protocol address corresponding to the target session identifier is in the updated first set; If yes, delete the target session identifier from the second set.

6. The device according to any one of claims 4 to 5, characterized in that: Determine whether the operation object is a protected file by the following method: If the operation object is stored in a preset protected storage location, the operation object is determined to be the protected file.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 3.

Images