A data security processing method and device

Abstract

The application discloses a data security processing method and device, and relates to the technical field of computers. A specific implementation manner of the method comprises the following steps: in response to a printing operation on data, searching for a to-be-printed temporary file matched with file information indicated by the printing operation; in the case of searching, performing sensitive information analysis on content included in the to-be-printed temporary file; if the analysis result indicates that sensitive information is included in the to-be-printed temporary file, adding a specific transparent identifier to the to-be-printed temporary file, wherein the specific transparent identifier corresponds to a terminal device initiating the printing. The implementation manner can effectively improve the effectiveness of data protection by tracking the terminal device initiating the printing based on the mark.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a data security processing method and apparatus. Background Technology

[0002] Printing data has become one of the ways in which corporate data or information is leaked. Adding watermarks to printed data is a way to protect data privacy.

[0003] Currently, adding watermarks to printed data mainly relies on the built-in watermarking functions of documents such as PDF, Word, and Excel, and involves manually adding watermarks to the documents.

[0004] Because the existing watermarking method allows for selective manual manipulation, the effectiveness of data protection is relatively low. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a data security processing method and apparatus for printing labels on files containing sensitive information, and for tracking the terminal device that initiates printing based on the labels, thereby effectively improving the effectiveness of data protection.

[0006] To achieve the above objectives, according to one aspect of the present invention, a data security processing method is provided, comprising:

[0007] In response to a print operation on data, locate a temporary file to be printed that matches the file information indicated by the print operation;

[0008] If found, perform sensitive information analysis on the contents of the temporary file to be printed;

[0009] If the analysis results indicate that the temporary file to be printed contains sensitive information, a specific transparent identifier is added to the temporary file to be printed, wherein the specific transparent identifier corresponds to the terminal device that initiated the printing.

[0010] Optionally, after the analysis results indicate that the temporary file to be printed contains sensitive information, before adding a specific transparent identifier to the temporary file to be printed, the method further includes:

[0011] Determine whether the sensitive information included in the temporary file to be printed is allowed to be printed. If so, execute the step of adding a specific transparent identifier to the temporary file to be printed; otherwise, prohibit printing the temporary file to be printed.

[0012] Optionally, the above data security processing method further includes:

[0013] The server receives and stores a printing policy for the terminal device, wherein the printing policy includes: identification types for sensitive information;

[0014] Generate and store specific transparent identifiers that match the identifier types included in the printing strategy;

[0015] Adding a specific transparent identifier to the temporary file to be printed includes:

[0016] Add a specific transparent identifier that matches the identifier type to a designated location in the temporary file to be printed.

[0017] Optionally, the step of prohibiting the printing of the temporary file to be printed includes:

[0018] Invoke the cancel print command to block the printing of the temporary file to be printed;

[0019] or,

[0020] Access to the temporary file to be printed is prohibited for the printing service.

[0021] Optionally, when the identifier type is a dot matrix type, the printing strategy further includes: a dot matrix corresponding to multiple characters;

[0022] The generation of a specific transparent identifier that matches the identifier types included in the printing strategy includes:

[0023] First feature information of the terminal device is determined, target dot matrix corresponding to each character included in the first feature information is determined, and multiple target dot matrices are combined.

[0024] Optionally, when the identifier type is an image, the printing strategy further includes: a QR code generation script;

[0025] The generation of a specific transparent identifier that matches the identifier types included in the printing strategy includes:

[0026] The second feature information of the terminal device is determined, and the second feature information is converted into a QR code image through the QR code generation script.

[0027] Optionally, generating a specific transparent identifier that matches the identifier type included in the printing strategy includes: when the identifier type is an image type, calling a pre-installed QR code tool to convert the determined second feature information of the terminal device into a QR code.

[0028] Optionally, when the identifier type is text, the printing strategy further includes: the server randomly generating multiple identifier characters for the terminal device;

[0029] The generation of a specific transparent identifier that matches the identifier types included in the printing strategy includes:

[0030] Combine multiple of the aforementioned identifier characters, and determine the combined result as the specific transparent identifier.

[0031] Secondly, embodiments of the present invention provide a data security processing apparatus, comprising: a searching unit, an analysis unit, and a printing processing unit, wherein...

[0032] The search unit is configured to, in response to a printing operation on data, search for a temporary file to be printed that matches the file information indicated by the printing operation.

[0033] The analysis unit is used to perform sensitive information analysis on the content of the temporary file to be printed when the search unit finds a temporary file to be printed that matches the file information indicated by the print operation.

[0034] The printing processing unit is configured to add a specific transparent identifier to the temporary file to be printed if the analysis result of the analysis unit indicates that the temporary file to be printed contains sensitive information, wherein the specific transparent identifier corresponds to the terminal device that initiated the printing.

[0035] One embodiment of the above invention has the following advantages or beneficial effects: For data printing operations, a temporary file to be printed that matches the file information indicated by the printing operation is found; sensitive information analysis is performed on the content of the found temporary file to be printed; if the analysis result indicates that the temporary file to be printed contains sensitive information, a specific transparent identifier is added to the temporary file to be printed, wherein the specific transparent identifier corresponds to the terminal device that initiated the printing. Since the specific transparent identifier is added to the temporary file to be printed, the printer is unaware of the process of adding the specific transparent identifier during printing, realizing seamless monitoring of the printing of files containing sensitive information, and enabling the tracking of the terminal device that initiated the printing based on the identifier, effectively improving the effectiveness of data protection.

[0036] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0037] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0038] Figure 1This is a schematic diagram of the system architecture upon which the application scenario according to the embodiments of the present invention depends;

[0039] Figure 2 This is a schematic diagram of the main flow of a data security processing method according to an embodiment of the present invention;

[0040] Figure 3 This is a schematic diagram of a dot matrix according to an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of the main flow of another data security processing method according to an embodiment of the present invention;

[0042] Figure 5 This is a schematic diagram of the main units of a data security processing device according to an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of the main equipment of the data security processing system according to an embodiment of the present invention;

[0044] Figure 7 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0045] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0046] Figure 1 An exemplary system architecture 100 is shown on which the following embodiments of the present invention can be applied in application scenarios.

[0047] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, a server 105, and a printing device 106 connected to the terminal devices. Network 104 serves as a medium for providing communication links between terminal devices 101, 102, and 103 and the server 105, and between terminal devices 101, 102, and 103 and the printing device 106. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0048] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104, enabling server 105 to distribute printing policies to terminal devices 101, 102, and 103, and to manage document printing on the terminal devices 101, 102, and 103 under its management. Terminal devices 101, 102, and 103 can have the necessary software for connecting to printer 106 and various communication client applications installed, such as web browsers, search applications, instant messaging tools, email clients, and social media platforms (for example only).

[0049] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers running Linux.

[0050] Server 105 can be a server providing various services, such as a background management server that provides targeted printing strategies for terminal devices 101, 102, and 103 and supports these printing strategies (this is just an example). When terminal devices 101, 102, and 103 transmit stored files to printing device 106, they can process the files to be printed using the printing parameters allocated by server 105, such as adding a transparent watermark array to a temporary file of the file to be printed. The background management server can manage and adjust the printing strategies for various terminal devices, and it can also receive array combinations sent by each terminal device.

[0051] It should be noted that the data security processing method provided in the embodiments of the present invention is generally executed by a combination of terminal devices 101, 102, 103 and server 105. Accordingly, data security processing devices are respectively set in terminal devices 101, 102, 103 and server 105.

[0052] It should be understood that Figure 1 The number of terminal devices, networks, servers, and printing devices shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, servers, and printing devices can be included.

[0053] Figure 2 This is a schematic diagram of the main flow of a data security processing method according to an embodiment of the present invention. Figure 2 As shown, this data security processing method may include the following steps:

[0054] Step S201: In response to a print operation on data, locate a temporary file to be printed that matches the file information indicated by the print operation;

[0055] The printing operation can send any file from the terminal device, or a file received by communication software on the terminal device such as email or instant messaging software, to the printer so that the printer can print these files. Temporary files to be printed refer to temporary files generated by the terminal device for printing; these temporary files are deleted after printing is complete.

[0056] Step S202: If found, perform sensitive information analysis on the contents of the temporary file to be printed;

[0057] Sensitive information analysis mainly involves using existing sensitive information detection methods, such as sensitive keyword matching, to detect sensitive information contained in a document and the specific content of that sensitive information.

[0058] Step S203: If the analysis results indicate that the temporary file to be printed contains sensitive information, add a specific transparent identifier to the temporary file to be printed, wherein the specific transparent identifier corresponds to the terminal device that initiated the printing.

[0059] These specific transparent markers are mainly used to annotate images, characters, symbols, etc., in printed documents. The position of these markers in the printed document can be selected or set according to actual needs.

[0060] exist Figure 2 In the illustrated embodiment, for the printing operation, a temporary file to be printed that matches the file information indicated by the printing operation is searched. Sensitive information analysis is performed on the content of the found temporary file. If the analysis indicates that the temporary file contains sensitive information, a specific transparent identifier is added to it. This identifier corresponds to the terminal device that initiated the printing. Because the identifier is added to the temporary file, the printer is unaware of this process during printing, enabling seamless monitoring of the printing of files containing sensitive information. Furthermore, the terminal device initiating the printing can be tracked based on the identifier, effectively improving the effectiveness of data protection.

[0061] Using the above method, when data is discovered to be disseminated through printed documents or other digital forms, the source of the data leak can be quickly located based on the specific transparent identifiers included in the data.

[0062] In addition, by adding specific transparent identifiers to temporary documents to be printed, the printer can be prevented from tampering with the specific transparent identifiers, thereby ensuring that the printed documents can more accurately reflect the information of the terminal device that initiated the printing.

[0063] In this embodiment of the invention, after the analysis indicates that the temporary file to be printed contains sensitive information, before adding a specific transparent identifier to the temporary file to be printed, the method may further include: determining whether the sensitive information included in the temporary file to be printed is allowed to be printed; if so, then performing the step of adding a specific transparent identifier to the temporary file to be printed; otherwise, prohibiting the printing of the temporary file to be printed. The sensitive information may be set by the server according to user needs. By allowing or disallowing the printing of sensitive information, differentiated printing configurations can be implemented for different terminals to better meet the differentiated printing configurations of different employees within an enterprise, thereby better managing printed documents and improving document security.

[0064] Specific implementations for preventing the printing of temporary files to be printed may include: invoking a print cancellation command to block the printing of the temporary file, or prohibiting the printing service from accessing the temporary file. The print cancellation command may be carried by the terminal device's system or provided to the terminal device in advance by the printing service. This process ensures data security.

[0065] In this embodiment of the invention, in order to print specific transparent identifiers, the above-mentioned data security processing method may further include: receiving and storing a printing policy for a terminal device sent by the storage client, wherein the printing policy includes: identifier types for sensitive information; generating and storing specific transparent identifiers that match the identifier types included in the printing policy; correspondingly, a specific implementation of adding specific transparent identifiers to a temporary file to be printed may include: adding the stored specific transparent identifiers that match the identifier types to a specified location of the temporary file to be printed.

[0066] There can be various types of identifiers, such as dot matrix, image, and text.

[0067] Specifically, when the identifier type is a dot matrix type, the printing strategy further includes: dot matrices corresponding to multiple characters; correspondingly, the specific implementation method for generating a specific transparent identifier that matches the identifier type included in the printing strategy may include: determining first feature information of the terminal device, determining the target dot matrix corresponding to each character included in the first feature information, and combining multiple target dot matrices. The first feature information may be information such as username and terminal device number.

[0068] Among them, the dot matrix can be like Figure 3 As shown, it may include: a dot matrix corresponding to the starting point, dot matrices corresponding to the numbers 0-9, and dot matrices corresponding to A-F. This dot matrix can be randomly generated. It is worth noting that... Figure 3 This is merely an example of one implementation of a dot matrix; other variations based on this form are within the scope of protection of this application.

[0069] For example, if the first feature information is the terminal device number 34567EF, then the target dot matrix is ​​the dot matrix corresponding to 3, the dot matrix corresponding to 4, the dot matrix corresponding to 5, the dot matrix corresponding to 6, the dot matrix corresponding to 7, the dot matrix corresponding to E, and the dot matrix corresponding to F.

[0070] Setting a starting dot matrix can increase the difficulty of dot matrix decryption, making the printed document easier to track.

[0071] In addition, the distribution of the dot matrix in the printed document can be evenly distributed across each page according to the number of pages in the printed document.

[0072] Furthermore, when the identifier type is an image, the printing strategy may further include a QR code generation script. Correspondingly, a specific implementation method for generating a specific transparent identifier matching the identifier type included in the printing strategy may include: determining the second feature information of the terminal device, and converting the second feature information into a QR code image using the QR code generation script. The terminal device initiating the printing or the printer's information can be marked using the QR code image, facilitating the tracking of printed documents.

[0073] Another implementation of generating specific transparent identifiers that match the identifier types included in the printing strategy may include: when the identifier type is an image, using a pre-installed QR code tool to convert the determined second feature information of the terminal device into a QR code. That is, using existing QR code tools to obtain the QR code; thus, the solution provided in this embodiment of the invention can be combined with existing QR code tools, reducing development costs.

[0074] Furthermore, when the identifier type is text, the printing strategy may further include: the server randomly generating multiple identifier characters for the terminal device; correspondingly, the specific implementation of generating a specific transparent identifier that matches the identifier type included in the printing strategy may include: combining multiple identifier characters and determining the combined result as the specific transparent identifier. This identifier character can be assigned to different terminal devices as needed, to achieve tracking of the printer or the terminal device initiating printing based on the identifier character. Additionally, the combined result and the terminal device's feature information can be stored on the server, enabling the server to query the specific transparent identifier of the terminal device or to retrieve the information of the terminal device initiating printing through text watermark information / QR code watermark information / dot matrix watermark information in the printed document.

[0075] In summary, the aforementioned specific transparent identifier is attached to the temporary file to be printed so that the printed file carries the specific transparent identifier, while the original file on the terminal device is not modified. Even if the user views the original file, the watermark cannot be seen, thus making the printed specific transparent identifier somewhat concealed.

[0076] It is worth noting that the solutions provided in the various embodiments of the present invention are mainly for terminal devices with Linux systems. They mainly deal with temporary files to be printed generated by the Linux system, such as calling the Linux system's cancel printing command or disabling printing service to prevent the printing of temporary files, so that the whole process is the behavior of the terminal device's own system.

[0077] The following example illustrates the specific implementation of a data security processing method: A server assigns a printing policy to terminal device A that prohibits printing any materials; a server assigns a printing policy to terminal device B that adds a QR code to printed documents containing sensitive information; a server assigns a printing policy to terminal device C that prohibits printing materials containing sensitive information S1 and adds a dot matrix to documents containing sensitive information S2; and a server assigns a printing policy to terminal device D that adds text to documents containing sensitive information. Figure 4 As shown, this data security processing method may include the following steps:

[0078] Step S401: The server sends the integrated data packets to terminal devices A, B, C, and D respectively.

[0079] Step S402: Terminal device A, terminal device B, terminal device C and terminal device D respectively install the integrated data packet to realize the installation of data security processing device in terminal device A, terminal device B, terminal device C and terminal device D;

[0080] Step S403: The server sends printing policies corresponding to terminal devices A, B, C, and D respectively to terminal devices A, B, C, and D. Terminal device A executes step S404; terminal device B executes step S407; terminal device C executes step S410; and terminal device D executes step S416.

[0081] For example, the server sends a policy to terminal device A that prohibits the printing of any materials, a printing policy including a QR code generation script or a QR code printing policy to terminal device B, a printing policy including a policy that prohibits the printing of materials carrying sensitive information S1, a dot matrix of multiple characters, and a printing policy that adds a dot matrix to files carrying sensitive information S2 to terminal device C, and a printing policy including a policy that adds a text generation script to files carrying sensitive information to terminal device D.

[0082] Step S404: Terminal device A sends a print-blocking command to the installed data security processing device;

[0083] Step S405: After receiving a print operation for any file, terminal device A generates a temporary file to be printed for the file;

[0084] The temporary file to be printed was generated by the system of terminal device A.

[0085] Step S406: After receiving the print operation, the data security processing device in terminal device A initiates a print prohibition command to stop the print operation, thereby prohibiting printing and ending the current process;

[0086] This step can also be achieved by disabling the print service from accessing temporary print files.

[0087] Step S407: Terminal device B uses a QR code generation script to convert its latest stored user information into a QR code image;

[0088] This step can also be done by using existing QR code tools to convert the latest user information into QR code images.

[0089] Step S408: After receiving a print operation for any file, terminal device B generates a temporary file to be printed for the file;

[0090] Step S409: After receiving the print operation, the data security processing device in terminal device B prints the QR code image to the designated location of the temporary file so that the printer prints the file carrying the QR code image and ends the current process.

[0091] The specified location can be a location specified by the server, such as the top left corner or bottom right corner of each page in the file.

[0092] Step S410: Terminal device C sends the print-blocking command to the installed data security processing device and combines the dot matrix of multiple characters into a dot matrix sequence that matches its own number;

[0093] For example, the dot matrix of multiple characters obtained by terminal device C is Figure 3The dot matrix shown includes the dot matrix corresponding to the starting point, the dot matrix corresponding to each number from 0 to 9, and the dot matrices corresponding to A, B, C, D, E, and F. The terminal device C is numbered 1F3A23EB. Based on this number 1F3A23EB, the following dot matrices are selected: the starting point dot matrix, the dot matrix corresponding to 1, the dot matrix corresponding to 3, the dot matrix corresponding to A, the dot matrix corresponding to 2, the dot matrix corresponding to E, and the dot matrix corresponding to B. These selected dot matrices are then sorted in the order 1→F→3→A→2→3→E→B, so that the printed dot matrix sequence is arranged as follows: starting point dot matrix → dot matrix corresponding to 1 → dot matrix corresponding to 3 → dot matrix corresponding to A → dot matrix corresponding to 2 → dot matrix corresponding to 3 → dot matrix corresponding to E → dot matrix corresponding to B. The positions of the individual dots can be randomly arranged as needed. For example, in a single-page document, the dots are distributed sequentially on the same page; in a multi-page document, the dots are evenly distributed across the pages. The position of the dots on the page can be set by the server as needed, such as in the top left corner, bottom right corner, or between line spacing. Furthermore, dot attributes such as dot size can also be set by the server.

[0094] Step S411: After receiving a print operation for any file, terminal device C generates a temporary file to be printed for the file;

[0095] Step S412: After receiving the print operation, the data security processing device in terminal device C determines whether the temporary print file contains sensitive information S1 and S2. If it only contains S1, then proceed to step S413; if it contains S2, then proceed to step S414; if it does not contain S1 and S2, then proceed to step S415.

[0096] Step S413: Activate the print disable command to prevent the print service from accessing the temporary print file, thereby disabling printing and ending the current process;

[0097] This step can also be achieved by stopping the printing operation.

[0098] Step S414: Add the dot matrix sequence to the temporary file to be printed so that the printed file contains the dot matrix sequence, and end the current process;

[0099] Step S415: Do not process the temporary file to be printed, allow the file to be printed normally, and end the current process;

[0100] Step S416: Terminal device D uses a text generation script to generate text from its own number;

[0101] Step S417: After receiving a print operation for a file, terminal device D generates a temporary file to be printed for the file;

[0102] Step S418: After receiving the print operation, the data security processing device in terminal device D determines whether the temporary file to be printed contains sensitive information. If so, step S419 is executed; otherwise, step S420 is executed.

[0103] Step S419: Add the generated text to the specified position in the temporary file to be printed, print the temporary file to be printed, and end the current process;

[0104] Step S420: Print the temporary file to be printed directly.

[0105] like Figure 5 As shown, this embodiment of the invention provides a data security processing device 500, which may include: a search unit 501, an analysis unit 502, and a printing processing unit 503, wherein...

[0106] The lookup unit 501 is used to look up a temporary file to be printed that matches the file information indicated by the print operation in response to a print operation on data.

[0107] Analysis unit 502 is used to perform sensitive information analysis on the contents of the temporary file to be printed when the search unit 501 finds a temporary file to be printed that matches the file information indicated by the print operation.

[0108] The printing processing unit 503 is configured to add a specific transparent identifier to the temporary file to be printed if the analysis result of the analysis unit 502 indicates that the temporary file to be printed contains sensitive information, wherein the specific transparent identifier corresponds to the terminal device that initiated the printing.

[0109] In this embodiment of the invention, the printing processing unit 503 is further configured to determine whether the sensitive information included in the temporary file to be printed is allowed to be printed. If so, the step of adding a specific transparent identifier to the temporary file to be printed is performed; otherwise, the printing of the temporary file to be printed is prohibited.

[0110] In this embodiment of the invention, the data security processing device 500 may further include: an interaction unit 504, wherein,

[0111] The interaction unit 504 is used to receive and store the printing policy for the terminal device sent by the storage client, wherein the printing policy includes: identification types for sensitive information;

[0112] The print processing unit 503 is further configured to generate and store a specific transparent identifier that matches the identifier type included in the print strategy; and to add the stored specific transparent identifier that matches the identifier type to a specified location in the temporary file to be printed.

[0113] In this embodiment of the invention, the printing processing unit 503 is further configured to invoke a cancel printing instruction to block the printing of the temporary file to be printed; or, to prohibit the printing service from accessing the temporary file to be printed.

[0114] In this embodiment of the invention, when the identifier type is a dot matrix type, the printing strategy may further include: dot matrices corresponding to multiple characters; correspondingly, the printing processing unit 503 is further used to determine the first feature information of the terminal device, determine the target dot matrix corresponding to each character included in the first feature information, and combine multiple target dot matrices.

[0115] In this embodiment of the invention, when the identifier type is an image, the printing strategy further includes: a QR code generation script; correspondingly, the printing processing unit 503 is further used to determine the second feature information of the terminal device and convert the second feature information into a QR code image through the QR code generation script.

[0116] In this embodiment of the invention, the printing processing unit 503 is further configured to, when the identifier type is an image, invoke a pre-installed QR code tool to convert the determined second feature information of the terminal device into a QR code.

[0117] In this embodiment of the invention, when the identifier type is text, the printing strategy further includes: the server randomly generates multiple identifier characters for the terminal device; correspondingly, the printing processing unit 503 is further used to combine the multiple identifier characters and determine that the combined result is a specific transparent identifier.

[0118] like Figure 6 As shown, this embodiment of the invention provides a data security processing system 600, which may include: multiple terminal devices 601 and a server 602, wherein...

[0119] Each of the terminal devices 601 is equipped with the above-mentioned Figure 5 The illustrated embodiment provides a data security processing device 500;

[0120] Server 602 is used to provide an installation package for the data security processing device 500 and a printing policy corresponding to the terminal devices for multiple terminal devices.

[0121] The following is for reference. Figure 7It shows a schematic diagram of the structure of a computer system 700 suitable for implementing terminal devices or servers of the present invention. Figure 7 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0122] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0123] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 170 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0124] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this invention.

[0125] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] The units described in the embodiments of the present invention can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor can be described as including a search unit, an analysis unit, and a printing processing unit. The names of these units do not necessarily limit the specific unit; for example, a search unit can also be described as "searching for a temporary file to be printed that matches the file information indicated by the printing operation."

[0128] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to include: in response to a printing operation on data, searching for a temporary file to be printed that matches the file information indicated by the printing operation; if found, performing sensitive information analysis on the content of the temporary file to be printed; if the analysis indicates that the temporary file to be printed contains sensitive information, adding a specific transparent identifier to the temporary file to be printed, wherein the specific transparent identifier corresponds to the terminal device initiating the printing.

[0129] According to the technical solution of the present invention, for the printing operation of data, a temporary file to be printed that matches the file information indicated by the printing operation is found, and the content of the found temporary file to be printed is analyzed for sensitive information; if the analysis result indicates that the temporary file to be printed contains sensitive information, a specific transparent identifier is added to the temporary file to be printed, wherein the specific transparent identifier corresponds to the terminal device that initiates the printing. Since the specific transparent identifier is added to the temporary file to be printed, the printer can be unaware of the process of adding the specific transparent identifier during the printing process, realizing the unobtrusive monitoring of the printing of files with sensitive information, and can track the terminal device that initiates the printing based on the marker, effectively improving the effectiveness of data protection.

[0130] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data security processing method, characterized by, The method comprises: in response to a print operation for data, searching for a to-be-printed temporary file matching file information indicated by the print operation, the print operation being sending an arbitrary file on a terminal device or a file received by communication software on the terminal device to a printer to print, the to-be-printed temporary file being a temporary file generated by the terminal device for printing, and the temporary file being deleted accordingly after printing is completed; in the case of searching, performing sensitive information analysis on content included in the to-be-printed temporary file; if the analysis result indicates that sensitive information is included in the to-be-printed temporary file, adding a specific transparent identifier to the to-be-printed temporary file, wherein the specific transparent identifier corresponds to the terminal device that initiates printing; the data security processing method further comprises: receiving and storing a print policy sent by a server for the terminal device, wherein the print policy comprises: an identifier type for sensitive information, the identifier type comprising: a dot matrix type, a picture type, and a text type; the print policy further comprises: dot matrices corresponding to a plurality of characters corresponding to the dot matrix type and a plurality of identifier characters corresponding to the text type randomly generated by the server for the terminal device, wherein the dot matrices comprise a starting point corresponding dot matrix, dot matrices corresponding to numbers 0-9, and dot matrices corresponding to A-F respectively; generating and storing a specific transparent identifier matching the identifier type included in the print policy, specifically comprising: for the case where the identifier type is the dot matrix type, determining first feature information of the terminal device, determining target dot matrices corresponding to each character included in the first feature information, and combining a plurality of the target dot matrices; for the case where the identifier type is the picture type, determining second feature information of the terminal device, converting the second feature information into a two-dimensional code picture; combining a plurality of the identifier characters corresponding to the text type randomly generated by the server for the terminal device, and determining the combined result as the specific transparent identifier.

2. The method of claim 1, wherein, after the analysis result indicates that sensitive information is included in the to-be-printed temporary file, before the specific transparent identifier is added to the to-be-printed temporary file, further comprising: determining whether the sensitive information included in the to-be-printed temporary file is allowed to be printed, if yes, performing the step of adding the specific transparent identifier to the to-be-printed temporary file, otherwise, prohibiting the to-be-printed temporary file from being printed.

3. The method of claim 1, wherein the adding of the specific transparent identifier to the to-be-printed temporary file comprises: adding the stored specific transparent identifier matching the identifier type to a specified position of the to-be-printed temporary file.

4. The method of claim 2, wherein, the prohibiting of the to-be-printed temporary file from being printed comprises: calling a cancel print instruction to block the to-be-printed temporary file from being printed through the cancel print instruction; or prohibiting a print service from accessing the to-be-printed temporary file.

5. The method of claim 1, wherein ​ In a case where the identification category is a picture type, the printing strategy further comprises a two-dimensional code generation script; The generating the specific transparent identification matching the identification category included in the printing strategy comprises: determining second feature information of the terminal device, and converting the second feature information into a two-dimensional code picture through the two-dimensional code generation script; Or, The generating the specific transparent identification matching the identification category included in the printing strategy comprises: in a case where the identification category is a picture type, calling a pre-installed two-dimensional code tool to convert the determined second feature information of the terminal device into a two-dimensional code.

6. A data security processing device, characterized by comprising: Comprise: a finding unit, an analysis unit and a printing processing unit, wherein The finding unit is configured to, in response to a printing operation on data, find a to-be-printed temporary file matching file information indicated by the printing operation, the printing operation being sending an arbitrary file on a terminal device or a file received by communication software on the terminal device to a printer to print, and the to-be-printed temporary file being a temporary file generated by the terminal device for printing, and the temporary file being deleted correspondingly after printing is completed; The analysis unit is configured to, in a case where the finding unit finds the to-be-printed temporary file matching the file information indicated by the printing operation, analyze content included in the to-be-printed temporary file for sensitive information; The printing processing unit is configured to, if the analysis result of the analysis unit indicates that the to-be-printed temporary file includes sensitive information, add a specific transparent identification to the to-be-printed temporary file, wherein the specific transparent identification corresponds to a terminal device initiating printing; The data security processing apparatus further comprises an interaction unit, wherein The interaction unit is configured to receive and store a printing strategy for a terminal device sent by a server, wherein the printing strategy comprises an identification category of sensitive information, the identification category comprises a dot matrix type, a picture type and a text type, and the printing strategy further comprises dot matrices corresponding to a plurality of characters corresponding to the dot matrix type and a plurality of identification characters corresponding to the text type randomly generated by the server for the terminal device, wherein the dot matrices comprise a starting point corresponding dot matrix, dot matrices corresponding to numbers 0-9 and dot matrices corresponding to A-F. The printing processing unit is further configured to generate and store a specific transparent identification matching the identification category included in the printing strategy, specifically comprising: in a case where the identification category is a dot matrix type, determining first feature information of the terminal device, determining target dot matrices corresponding to each character included in the first feature information, and combining a plurality of the target dot matrices; in a case where the identification category is a picture type, determining second feature information of the terminal device, converting the second feature information into a two-dimensional code picture; combining a plurality of the identification characters corresponding to the text type randomly generated by the server for the terminal device, and determining a combined result as the specific transparent identification.

7. An electronic device, comprising: Comprise: one or more processors; a storage device configured to store one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement a method as claimed in any of claims 1-5.

8. A computer readable medium having stored thereon a computer program, characterized in that, The program, which when executed by a processor, implements a method as claimed in any of claims 1-5.

Images