A file flow control method based on security documents

Abstract

The application provides a file circulation control method based on a security document. In order to realize the permission control of the security document in the circulation process, the document content needs to be encrypted, and the circulation control in the permission level is performed. The authorization types of the document include organization, role and user, and the permission sizes of the three are user>organization>role. The secret levels of the document include top secret, secret, confidential and ordinary. In order to prevent the high secret and low flow situation, only the user equal to or greater than the secret level can open the document for operation. The application can effectively solve the problem of the security document in the circulation operation, still retains the convenience of the document forwarding and use, and has the advantages of high practicability and the like.

Description

Technical Field

[0001] This invention relates to the Internet field, specifically to a method for managing the flow of files based on secure documents. Background Technology

[0002] With the development of technologies such as big data and cloud computing, enterprises are undergoing digital transformation to boost efficiency and empower development. This has led to a surge in the scale of digital document management generated by enterprise IT systems, with increasingly diverse data types requiring management. These documents represent digital assets accumulated during business operations, possessing immense value and forming a core competitive advantage for enterprises in the information age. Therefore, ensuring secure and compliant document management, unified management, secure backup, cross-network use, and collaborative workflow is a crucial aspect of digital transformation for government and enterprise organizations. Ensuring the secure and controllable flow of documents within the organization is paramount to supporting all aspects of this process.

[0003] Currently, there are still many potential problems regarding document security:

[0004] 1. The scope of document circulation is uncontrollable.

[0005] Some highly confidential documents within enterprises require that only certain organizations, departments, and personnel be able to read, modify, and edit them. Currently, most enterprises can only distribute and supervise them manually, using methods such as controlling personnel to access and record documents, or using fixed machines and intranets for document security management. Some measures are difficult to ensure that the document flow fully complies with the process, which can easily lead to the leakage of document content. Although some measures can ensure document security, human intervention can greatly reduce work efficiency.

[0006] 2. Document operations are uncontrollable.

[0007] Traditional office software can only control document operation permissions in a limited way, such as read-only and document protection passwords. It cannot control user operations in a more detailed way, such as editing, copying, saving, printing, and saving as. Furthermore, documents do not have the concept of security level, so it is impossible to control the operation permissions of each security level.

[0008] 3. Operational behavior lacks an auditing mechanism.

[0009] The inability to record specific information such as the operator, time, or even the equipment used when handling classified documents makes it impossible to identify the leaker and the source of the leak if the document content is subsequently leaked. This creates security risks in the company's internal management and fails to deter document operators. As a result, document operators may lower their awareness of security due to the lack of accountability after the fact.

[0010] Therefore, it is necessary to provide a new technical solution. Summary of the Invention

[0011] To address the technical problems existing in the prior art, this invention discloses a file flow control method based on secure documents, the specific technical solution of which is as follows:

[0012] This invention provides a file flow control method based on secure documents, comprising the following steps:

[0013] 1) Verify whether the client is logged in; do not allow the client to open secure documents if the client is not logged in.

[0014] 2) Read the permission list hidden in the document and verify whether the current user has the necessary permissions;

[0015] 3) Verify the legitimacy of user accounts from the server, including: lock information, user information update information, and password reset information. If the information changes, the user will be forcibly logged out and will not be allowed to open secure documents.

[0016] 4) Verify the current status of the document from the server. If the author finds any abnormalities in the content of the document after it has been sent, or if the sender should not have the necessary permissions, the document will be immediately withdrawn or locked according to the severity of the problem, so as to prevent the document from being circulated further and to stop the loss in time.

[0017] 5) Verify the user's security level; users with low security levels are not allowed to access documents with high security levels.

[0018] 6) Verify the password to open the document; if correct, the document can be opened.

[0019] 7) Real-time count of online document openings. If the remaining count is less than or equal to 0 or the document does not exist, the document cannot be opened.

[0020] 8) Verify the document's expiration date; if it is within the expiration date, the document can be opened.

[0021] 9) After all the verifications in the above steps have passed, you can open the document.

[0022] Furthermore, document authorization types are divided into organization, role, and user. You can select an organization department to authorize all personnel under that department, or you can group relevant personnel into roles and then authorize those roles, or you can specify a specific user for authorization. The order of permissions for these three types is: user > organization > role.

[0023] Furthermore, the permissions a user has for an opened document include viewing, editing, copying, offline access, printing, decryption, authorization, number of uses, and usage period.

[0024] Furthermore, the document security classification is divided into: Top Secret, Confidential, Secret, and Normal. To prevent the situation of high-security documents being leaked to low-security users, only users with a security classification of 1 or higher can open and operate on the document.

[0025] Furthermore, it also includes a document review process. The document review process involves logging all key operations performed by a user after opening the document, as well as recording user behavior that attempts to open encrypted documents without proper user permissions. These log records are used for daily operation statistics and for tracing back in case of data breaches.

[0026] The present invention has the following beneficial effects:

[0027] 1. The document flow management method based on secure documents provided by this invention writes document permission information while encrypting the document, making the document operation permissions more hierarchical. It takes the principle of minimizing permissions and the zero-trust permission management as the standard. It can perfectly solve the security of enterprise document flow and use when combined with traditional office software, without breaking the user's operating habits, and ensures the security of documents.

[0028] 2. The file circulation control method based on secure documents provided by this invention combines secure documents with Office to achieve "prevention before the event, control during the event, and traceability after the event" for classified documents. It can encrypt documents while authorizing detailed user operation permissions. In case of mistakenly issued classified documents, it can lock and recall them to control the spread of the documents in a timely manner. In case of leakage of encrypted documents, it can achieve the purpose of post-event tracking through watermarks, operation logs, etc.

[0029] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a system flowchart provided in an embodiment of the present invention. Detailed Implementation

[0032] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0033] In the description of this invention, it should be understood that the terms "upper," "lower," "top," "bottom," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0034] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0035] This invention discloses a file flow control method based on secure documents, referencing Figure 1 It includes the following steps:

[0036] 1) Verify whether the client is logged in; do not allow the client to open secure documents if the client is not logged in.

[0037] 2) Read the permission list hidden in the document and verify whether the current user has the necessary permissions;

[0038] 3) Verify the legitimacy of user accounts from the server, including: lock information, user information update information, and password reset information. If the information changes, the user will be forcibly logged out and will not be allowed to open secure documents.

[0039] 4) Verify the current status of the document from the server. If the author finds any abnormalities in the content of the document after it has been sent, or if the sender should not have the necessary permissions, the document will be immediately withdrawn or locked according to the severity of the problem, so as to prevent the document from being circulated further and to stop the loss in time.

[0040] 5) Verify the user's security level; users with low security levels are not allowed to access documents with high security levels.

[0041] 6) Verify the password to open the document; if correct, the document can be opened.

[0042] 7) Real-time count of online document openings. If the remaining count is less than or equal to 0 or the document does not exist, the document cannot be opened.

[0043] 8) Verify the document's expiration date; if it is within the expiration date, the document can be opened.

[0044] 9) After all the verifications in the above steps have passed, you can open the document.

[0045] Document authorization types are divided into organization, role, and user. You can select an organization department to authorize all personnel under that department, or you can group relevant personnel into roles and then authorize those roles, or you can specify a specific user for authorization. The order of permissions is user > organization > role.

[0046] This specifies the permissions a user has for an opened document, including viewing, editing, copying, offline access, printing, decryption, authorization, number of uses, and usage period.

[0047] Documents are classified into four security levels: Top Secret, Confidential, Secret, and Normal. To prevent high-security documents from being leaked to lower-security users, only users with a security level of 1 or higher are allowed to open and operate on them.

[0048] The present invention also includes a document review step, wherein all key operations performed by a user after opening the document are logged, and user behavior that attempts to open an encrypted document without user permission is also recorded. These log records are used for daily operation statistics and for tracing back in case of leakage issues.

[0049] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0050] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for controlling the flow of a file based on a security document, characterized in that, Comprising the following steps: 1) Check if the client is logged in, if not, do not allow opening of the security document; 2) Read the list of permissions hidden in the document, check if the current user has the operation permission; 3) Check the legality of the user account from the server, including: lock information, user information update information and password reset information, if the information changes, it will be forced to exit, not allowed to open the security document; 4) Check the current state of the document from the server, if the document is sent out, the author finds that the content has abnormal situation or the sender should not have the right, then it will be withdrawn or locked according to the degree of harm, so that the document will not continue to circulate and stop loss in time; 5) Check the user's secret level, low secret level user is not allowed to access high secret level document; 6) Check the opening password of the document, if correct, you can open the document; 7) Real-time acquisition of the number of online opening of the document, if the remaining number is less than or equal to 0 or does not exist, the document cannot be opened; 8) Check the use period of the document, if it is within the use period, the document can be opened; 9) After the above steps are passed, the document can be opened.

2. The method according to claim 1, wherein, The authorization type of the document is divided into organization, role and user: By checking the organization department, all personnel under the department are authorized; or, the relevant personnel are summarized as a role, and then the role is authorized; or, specify the user to authorize, the size of the three permissions is user > organization > role.

3. The method of claim 1, wherein, The operation permission of a user for the opened document includes viewing, editing, copying, offline, printing, decryption, authorization, use times and use period.

4. The method of claim 1, wherein, The secret level of the document is divided into: top secret, secret, secret, ordinary, in order to prevent high density low flow situation, only users greater than or equal to the secret level can open the document for operation.

5. The method of claim 1, wherein, It also includes the review step of the document, the review of the document is that all key operations after the user opens the document will have log record, and the behavior of the user who tries to open the encrypted document without user permission will also be recorded, the log record will be used as daily operation statistics and if the leakage problem occurs, it will be traced back.

Images