A monitoring method based on the combination of document management system and third-party secret label system

Abstract

The present invention relates to the field of document management technology, and specifically to a monitoring method based on the combination of a document management system and a third-party secret label system, characterized in that it includes the following steps: S1, the client of the third-party secret label system encrypts the file, generates a secret label file, and outputs it to the user; S2, when the user successfully logs in to the document management system and uploads the file, the document management system accesses the server of the third-party secret label system; S3, the server detects whether the file has a confidentiality level mark, if not, directly uploads it, if yes, returns the confidentiality level mark of the file to the document management system, so that the document management system determines the user's confidentiality level and the file's confidentiality level, if the user's confidentiality level is higher than or equal to the file's confidentiality level, uploads it, otherwise, does not upload it. This method makes the docking of the document management system and the third-party secret label system universal, instead of using customized docking, greatly reducing the complexity of docking.

Description

Technical Field

[0001] The present invention relates to the technical field of document processing, and in particular to a monitoring method and system based on the combination of a document management system and a third-party secret label system. Background Art

[0002] At present, in order to meet the confidentiality requirements of the confidential intranet for the document management system, the system needs to adopt confidentiality management for personnel, mark the file data as confidential, and ensure that personnel obtain file data within the prescribed scope of the confidentiality level. At the same time, it provides management services for the entire life cycle of the file and can trace the entire life cycle of confidential files.

[0003] However, in the prior art, a customized access method is used for the connection of the secret label system, and multiple sets of interfaces are required for connection with different third-party systems, which greatly increases the complexity of the connection.

[0004] Therefore, a method for connecting a document management system with a third-party secret label system is needed to reduce the complexity of the connection. Summary of the invention

[0005] Technical issues solved

[0006] In view of the above-mentioned shortcomings of the prior art, the present invention provides a monitoring method based on the combination of a document management system and a third-party secret label system. This method makes the docking between the document management system and the third-party secret label system universal instead of adopting customized docking, thereby greatly reducing the complexity of docking.

[0007] Technical Solution

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0009] The present invention provides a monitoring method based on the combination of a document management system and a third-party secret label system, comprising the following steps:

[0010] S1. The client of the third-party secret tag system encrypts the file, generates a secret tag file, and outputs it to the user;

[0011] S2. When the user successfully logs into the document management system and uploads a file, the document management system is connected to the server of the third-party secret label system;

[0012] S3. The server detects whether the file has a confidentiality level identification. If not, it directly uploads the file. If so, it returns the confidentiality level identification of the file to the document management system so that the document management system can determine the user confidentiality level and the file confidentiality level. If the user confidentiality level is higher than or equal to the file confidentiality level, it is uploaded; otherwise, it is not uploaded.

[0013] Furthermore, step S2 also includes: when a user successfully logs into the document management system and uploads a file, first checking whether the user has file upload authority, if so, the document management system is connected to the server, otherwise, it is not connected.

[0014] Based on the same inventive concept, the present invention also provides a document management system, which uses the above method to monitor file upload, including a first interface and a second interface, wherein the first interface is used to access the client of a third-party secret tag system, the client is used to encrypt the file, generate a secret tag file and output it to the user, and the second interface is used to access the server of the third-party secret tag system, the server is used to detect whether the file has a confidentiality level when the user uploads the file, if not, it is directly uploaded, if so, the confidentiality level of the file is returned to the document management system, so that the document management system determines the user's confidentiality level and the file's confidentiality level, if the user's confidentiality level is higher than or equal to the file's confidentiality level, it is uploaded, otherwise, it is not uploaded.

[0015] Furthermore, it also includes a permission detection unit, which is used to detect whether the user has file upload permission when the user successfully logs into the document management system and uploads a file. If so, the document management system is connected to the server, otherwise, it is not connected.

[0016] Based on the same inventive concept, the present invention also provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, any of the methods described above is implemented.

[0017] Based on the same inventive concept, the present invention further provides a readable storage medium, wherein the readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the above-mentioned methods is implemented.

[0018] Beneficial Effects

[0019] The present invention provides an independent confidentiality level operation and an intermediate interface for the file management system to achieve seamless connection between the background business system and various third-party confidentiality systems. The user confidentiality level, file confidentiality level, and the management module of the role-based access control are combined to achieve fine-grained permission control and confidentiality level classification control of the files in the system, and ensure the security of various business data; further, the independent confidentiality level operation and file management intermediate interface can be connected to various third-party confidentiality systems through this set of interfaces to improve the scalability of the business system; finally, fine-grained permission control and confidentiality level classification control, combined with the permission control mechanism of the cloud document system, on the basis of file confidentiality level control, fine-grained permission control is also performed to prevent unauthorized access to file data and cause information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram of the steps of a monitoring method based on the combination of a document management system and a third-party secret labeling system provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of a monitoring method framework based on a combination of a document management system and a third-party secret labeling system provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] First, technical terms used in the present invention are explained.

[0025] Classification mark (classification label): To prevent electronic files from being leaked, electronic files of different confidentiality levels are classified into categories such as no confidentiality (internal, public, etc.), secret, confidential and top secret. Then, different categories of electronic files are marked by technical means, and the electronic files are protected to a corresponding degree. This process is the classification mark process, and the mark on the confidentiality level of the electronic file is the classification mark.

[0026] Circulation link: the process through which a file circulates in a business system.

[0027] See also Figure 1 and Figure 2An embodiment of the present invention is a monitoring method based on the combination of a document management system and a third-party secret tag system, comprising the following steps: S1, a client of the third-party secret tag system encrypts a file, generates a secret tag file, and outputs it to the user; S2, when the user successfully logs in to the document management system and uploads a file, the document management system accesses the server of the third-party secret tag system; S3, the server detects whether the file has a secret level identification, if not, directly uploads it, if so, returns the secret level identification of the file to the document management system, so that the document management system determines the user secret level and the file secret level, if the user secret level is higher than or equal to the file secret level, uploads it, otherwise, does not upload it.

[0028] During the specific implementation, the business logic of the entire system combines the third-party secret label system to unify the file classification and document management system to store and manage various documents. Each service is designed and developed in accordance with the RESTFUL interface specification. User authentication and authorization: After the visitor's identity is authenticated and the accessed resources are authorized, the interface call phase can be entered. Interface call steps: Check the user's permissions on the folder; obtain the secret label middleware version interface; determine whether the secret label file interface is based on the file stream. The secret label attribute query interface is divided into two steps in terms of calling method:

[0029] Step 1: Access the URL: http: / / IP:port / headSize, request parameter: data file binary data, return parameter: {"ret":0 success, -2 non-encrypted file, "data":520 binary stream corresponding to the file header length};

[0030] Step 2: Access the URL: http: / / IP:port / attribute_stream, request parameters: {data file binary data, headSize returned file header length, type attribute type}, return parameters: {"ret":0 success, -2 non-secret file, "data":"secret attribute"}; if the above conditions are not met, return the error message to the user, obtain the interface return value and outgoing parameters, organize the http response message, and complete the call.

[0031] In this embodiment, step S2 also includes: when a user successfully logs into the document management system and uploads a file, first checking whether the user has file upload authority, if so, the document management system is connected to the server, otherwise, it is not connected.

[0032] Based on the same inventive concept, the present invention also provides a document management system, which uses the above method to monitor file upload, including a first interface and a second interface, wherein the first interface is used to access the client of a third-party secret tag system, the client is used to encrypt the file, generate a secret tag file and output it to the user, and the second interface is used to access the server of the third-party secret tag system, the server is used to detect whether the file has a confidentiality level when the user uploads the file, if not, it is directly uploaded, if so, the confidentiality level of the file is returned to the document management system, so that the document management system determines the user's confidentiality level and the file's confidentiality level, if the user's confidentiality level is higher than or equal to the file's confidentiality level, it is uploaded, otherwise, it is not uploaded.

[0033] In this embodiment, it also includes a permission detection unit. When a user successfully logs into the document management system and uploads a file, the permission detection unit is used to first detect whether the user has the file upload permission. If so, the document management system is connected to the server, otherwise, it is not connected.

[0034] Based on the same inventive concept, the present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the monitoring method based on the combination of the document management system and the third-party secret label system is implemented.

[0035] In some embodiments, the processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor (e.g., a GPU (Graphics Processing Unit)), or other data processing chips. The processor is generally used to control the overall operation of the electronic device. In this embodiment, the processor is used to run the program code stored in the memory or process data, such as running the program code of the monitoring method based on the combination of the document management system and the third-party secret label system.

[0036] The memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory can be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device. In other embodiments, the memory can also be an external storage device of the electronic device, such as a plug-in hard disk equipped on the electronic device, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory can also include both the internal storage unit of the electronic device and its external storage device. In this embodiment, the memory is generally used to store the operating method and various application software installed in the electronic device, such as the program code of the monitoring method based on the combination of the document management system and the third-party secret label system, etc. In addition, the memory can also be used to temporarily store various types of data that have been output or are to be output.

[0037] Based on the same inventive concept, the present invention also provides a readable storage medium, wherein the readable storage medium stores a computer program, and when the computer program is executed by a processor, the monitoring method based on the combination of the document management system and the third-party secret label system is implemented.

[0038] In summary, the advantages of the present invention are that it provides an independent confidentiality level operation and an intermediate interface for the file management system, and realizes seamless connection between the background business system and various third-party confidentiality systems. By combining the user confidentiality level, file confidentiality level, and the management module of role-based access control, fine-grained permission control and confidentiality classification control of files in the system can be realized to ensure the security of various business data; further, the independent confidentiality level operation and file management intermediate interface can be connected to various third-party confidentiality systems through this set of interfaces to improve the scalability of the business system; finally, fine-grained permission control and confidentiality classification control, combined with the permission control mechanism of the cloud document system, can simultaneously perform fine-grained permission control on the basis of file confidentiality level control to prevent unauthorized access to file data and cause information leakage.

[0039] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A monitoring method based on the combination of a document management system and a third-party secret label system, characterized in that: The steps include: S1. The client of the third-party secret label system encrypts the file, generates a secret label file, and outputs it to the user. The business logic of the entire system combines the third-party secret label system to unify the file classification and document management system to store and manage various documents. Each service is designed and developed in accordance with the RESTFUL interface specification. S2. When the user successfully logs into the document management system and uploads a file, the document management system is connected to the server of the third-party secret label system; After the user successfully logs in, the folder and file list information under the user's own permissions is returned through the role permission control of the authorization management; User authentication and authorization: After the visitor's identity is authenticated and the accessed resources are authorized, the interface call phase can be entered; Interface calling steps: check the user's permissions on the folder; obtain the secret label middleware version interface; determine whether it is a secret label file interface. The interface for querying secret label attributes based on the file stream is divided into two steps in terms of calling method: Step 1: Check whether there is a file classification level, specifically: access the URL: http: / / IP:port / headSize, request parameter: data file binary data, return parameter: {"ret":0 success, -2 non-classified file, "data":520 binary stream corresponding to the file header length}; if there is, go to step 2; Step 2: Query the confidentiality attribute of the specified file based on the file stream and return the confidentiality mark of the file, which is specifically manifested as: access url: http: / / IP:port / attribute_stream, request parameters: {data file binary data, headSize returned file header length, type attribute type}, return parameters: {"ret":0 success, -2 non-confidential file, "data":"confidential attribute"}; if the first or second step above is not satisfied, return the error message to the user, obtain the interface return value and outgoing parameters, organize the http response message, and complete the call; S3. The server detects whether the file has a confidentiality level identification. If not, it directly uploads the file. If so, it returns the confidentiality level identification of the file to the document management system so that the document management system can determine the confidentiality level of the user and the confidentiality level of the file. If the confidentiality level of the user is higher than or equal to the confidentiality level of the file, it is uploaded; otherwise, it is not uploaded.

2. The monitoring method based on the combination of the document management system and the third-party secret labeling system according to claim 1 is characterized in that: Step S2 also includes: when a user successfully logs into the document management system and uploads a file, first checking whether the user has file upload authority, if so, the document management system is connected to the server, otherwise, it is not connected.

3. A document management system, characterized in that: The method as claimed in claim 1 or 2 is used to monitor file upload, including a first interface and a second interface, the first interface is used to access the client of a third-party secret label system, the client is used to encrypt files, generate secret label files and output them to users, the second interface is used to access the server of the third-party secret label system, the server is used to detect whether the file has a confidentiality level when the user uploads the file, if not, directly upload it, if so, return the confidentiality level of the file to the document management system, so that the document management system determines the confidentiality level of the user and the confidentiality level of the file, if the user's confidentiality level is higher than or equal to the confidentiality level of the file, then upload it, otherwise, do not upload it.

4. The document management system according to claim 3, characterized in that: It also includes a permission detection unit, which is used to detect whether the user has file upload permission when the user successfully logs into the document management system and uploads a file. If so, the document management system is connected to the server, otherwise, it is not connected.

5. An electronic device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method according to claim 1 or 2 is implemented.

6. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to claim 1 or 2 is implemented.

Images