A file transfer control method, apparatus, system, device, and storage medium

Abstract

This invention provides a file transfer control method, apparatus, system, device, and storage medium, relating to the field of network security technology. The file transfer control method includes: authenticating a first user accessing a network node server; and, if the first user is authenticated as a rule configuration administrator centrally configured by a central management server, responding to a file filtering rule configuration request initiated by the first user and configuring file filtering rules; authenticating a second user accessing the network node server; and, if the second user is authenticated as a file transfer administrator centrally configured by the central management server, responding to a file transfer request initiated by the second user and selecting whether to transfer a target file according to the file filtering rules. This invention enables secure file transfer between different networks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a file transfer control method, apparatus, system, device, and storage medium. Background Technology

[0002] Currently, most enterprises have both internal and external networks to meet their needs for internal office work and external connectivity. Given the confidentiality of important enterprise documents, file transfer controls are typically implemented at the boundary between these networks to prevent leaks. Existing file transfer control methods primarily rely on configuring blacklists and whitelists for enterprise files. These lists determine whether to allow the transfer of user-selected files between the internal and external networks. This allows any user to freely transfer files, making it easy for blacklists and whitelists to be maliciously modified. Furthermore, configuring blacklists and whitelists rigidly establishes file filtering rules, making it difficult to provide general file transfer control for the ever-increasing volume of important documents within an enterprise. Therefore, using existing file transfer control solutions for transferring files between internal and external networks still poses significant security risks. Summary of the Invention

[0003] The purpose of this invention is to provide a file transfer control method, apparatus, system, device, and storage medium to achieve the technical effect of securely transferring files between different networks.

[0004] In a first aspect, embodiments of the present invention provide a file transfer control method, comprising:

[0005] The system performs user authentication on the first user accessing the network node server, and responds to the file filtering rule configuration request initiated by the first user when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, and configures the file filtering rule.

[0006] User authentication is performed on the second user accessing the network node server. When the second user is authenticated as any file transfer administrator centrally configured by the central management server, the file transfer request initiated by the second user is responded to, and the target file is selected for transfer according to the file filtering rules.

[0007] In the above implementation process, by allowing only users who are authenticated as administrators of any rule configuration configured by the central management server to initiate file transfer processes, and by allowing only users who are authenticated as administrators of any file transfer process configured by the central management server to initiate file transfer processes, the system selects whether to transfer the target file based on the previously configured file filtering rules. This file transfer control method, which is centrally authorized by the central management server and decentralized by the network node servers, can prevent any user from maliciously tampering with the file filtering rules and arbitrarily initiating file transfer processes, making it impossible for a single user to complete file transfer on their own, thereby achieving secure file transfer between different networks.

[0008] Furthermore, the central management server is located at the network boundary.

[0009] In the above implementation process, by setting up the central management server at the network boundary, network node servers can quickly access the central management server and obtain all rule configuration administrators and all file transfer administrators centrally configured by the central management server, which is beneficial to improving the efficiency of file transfer control.

[0010] Furthermore, when authenticating the first user as any rule configuration administrator centrally configured by the central management server, responding to the file filtering rule configuration request initiated by the first user, the configuration file filtering rule also includes:

[0011] In response to the permission restriction scope division request initiated by the first user, the permission restriction scope of each of the file transfer administrators is divided;

[0012] In response to the target file encryption setting request initiated by the first user, the encryption of the target file is set.

[0013] In the above implementation process, by allowing only users who are authenticated as administrators of any rule configuration centrally configured by the central management server to divide the permission restriction scope of each file transfer administrator and set the encryption label of the target file, this file transfer control method, which is centrally authorized by the central management server and decentralized managed by the network node servers, can further restrict the file operation permissions of each file transfer administrator. This ensures that file transfer administrators cannot complete file transfer without file operation permissions for the target file, thereby better realizing secure file transfer between different networks.

[0014] Furthermore, the step of responding to the file transfer request initiated by the second user, and selecting whether to transfer the target file according to the file filtering rules, specifically includes:

[0015] In response to the file transfer request, extract the target file from the file transfer request, obtain the password label of the target file, and obtain the permission restriction range corresponding to the second user;

[0016] Based on the cryptographic label of the target file and the permission restriction range corresponding to the second user, verify whether the second user has the transmission permission for the target file;

[0017] When it is determined that the second user has the permission to transfer the target file, the system continues to select whether to transfer the target file according to the file filtering rules.

[0018] In the above implementation process, by verifying whether the second user has the permission to transfer the target file based on the target file's security label and the permission restriction range corresponding to the second user, permission verification of the second user can be performed before the target file is transferred. This prevents file transfer administrators without file operation permissions for the target file from transferring the target file, thereby better realizing secure file transfer between different networks.

[0019] Further, the step of verifying whether the second user has transmission permissions for the target file based on the target file's security tag and the permission restriction range corresponding to the second user specifically includes:

[0020] Based on the permission restriction scope corresponding to the second user, obtain the security level of the second user;

[0021] Determine whether the security label of the target file is less than or equal to the security level of the second user. If the security label of the target file is less than or equal to the security level of the second user, then determine that the second user has the right to transmit the target file; otherwise, determine that the second user does not have the right to transmit the target file.

[0022] In the above implementation process, by dividing the scope of permissions for each file transfer administrator according to the security level, the scope of permissions for each file transfer administrator can be flexibly divided, and the file operation permissions of each file transfer administrator can be further restricted. This ensures that file transfer administrators cannot complete file transfer even if they do not have file operation permissions for the target file, thereby better realizing secure file transfer between different networks.

[0023] Furthermore, before selecting whether to transmit the target file according to the file filtering rules, the method further includes:

[0024] Check if the file filtering rules are configured, and if it is found that no file filtering rules are configured, send a rule configuration prompt message.

[0025] In the above implementation process, by first checking whether there are configuration file filtering rules when responding to a file transfer request initiated by a second user, and then sending a rule configuration prompt message when it is determined that there are no configuration file filtering rules, and then continuing to select whether to transfer the target file according to the file filtering rules when it is determined that there are configuration file filtering rules, it is possible to ensure that file filtering is effectively performed before file transfer, and to prevent the target file from being transferred without file filtering processing, thereby better realizing secure file transfer between different networks.

[0026] Furthermore, the step of selecting whether to transmit the target file based on the file filtering rules specifically includes:

[0027] Determine whether the target file conforms to the file filtering rules. If the target file conforms to the file filtering rules, the transmission of the target file is allowed; otherwise, the transmission of the target file is rejected.

[0028] In the above implementation process, by allowing only user configuration file filtering rules that can be centrally configured by the central management server, the configuration file filtering rules can be flexibly configured, making the granularity of file transfer control both coarse and fine. Furthermore, the target file is filtered according to the file filtering rules before the target file is transferred, which can be accurate to any file without characteristics, thus helping to adapt to complex business needs.

[0029] In a second aspect, embodiments of the present invention provide a file transfer control device, comprising:

[0030] The file filtering rule configuration module is used to authenticate the first user accessing the network node server, and when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, it responds to the file filtering rule configuration request initiated by the first user and configures the file filtering rules.

[0031] The file transfer control module is used to authenticate the second user accessing the network node server, and when the second user is authenticated as any file transfer administrator centrally configured by the central management server, it responds to the file transfer request initiated by the second user and selects whether to transfer the target file according to the file filtering rules.

[0032] In the above implementation process, the file filtering rule configuration module allows only users who are authenticated as rule configuration administrators centrally configured by the central management server to configure file filtering rules, and the file transfer control module allows only users who are authenticated as file transfer administrators centrally configured by the central management server to initiate the file transfer process. Based on the previously configured file filtering rules, the system selects whether to transfer the target file. This file transfer control method, which is centrally authorized by the central management server and decentralized by the network node servers, can prevent any user from maliciously tampering with the file filtering rules and arbitrarily initiating the file transfer process, making it impossible for a single user to complete the file transfer on their own, thereby achieving secure file transfer between different networks.

[0033] Furthermore, the central management server is located at the network boundary.

[0034] In the above implementation process, by setting up the central management server at the network boundary, network node servers can quickly access the central management server and obtain all rule configuration administrators and all file transfer administrators centrally configured by the central management server, which is beneficial to improving the efficiency of file transfer control.

[0035] Thirdly, embodiments of the present invention provide a file transfer control system, including a central management server and at least one network node server; each of the network node servers is communicatively connected to the central management server.

[0036] The central management server is used to centrally configure at least one rule configuration administrator and at least one file transfer administrator.

[0037] The network node server is used to execute the file transfer control method described above.

[0038] In the above implementation process, by applying a file transfer control system, at least one rule configuration administrator and at least one file transfer administrator are centrally configured by the central management server, and the file transfer control method described above is executed by the network node server, the same beneficial effect can be achieved.

[0039] Fourthly, embodiments of the present invention provide an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the file transfer control method as described above when executing the computer program.

[0040] In the above implementation process, by using electronic devices and executing computer programs through processors to implement the file transfer control method described above, the same beneficial effects can be achieved.

[0041] Fifthly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the file transfer control method described above.

[0042] In the above implementation process, the same beneficial effect can be achieved by controlling the computer-readable storage medium to execute the file transfer control method described above during the execution of the computer program. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A flowchart illustrating a file transfer control method provided in the first embodiment of the present invention;

[0045] Figure 2 A data flow diagram of a file transfer control method provided in the first embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of a file transfer control device provided in the second embodiment of the present invention;

[0047] Figure 4 This is a schematic diagram of a file transfer control system provided in the third embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the present invention will now be described with reference to the accompanying drawings in the embodiments of the present invention.

[0050] It should be noted that in the description of this invention, the terms "first," "second," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance. Furthermore, the step numbers in the text are only for the convenience of explaining the embodiments of this invention and are not intended to limit the order in which the steps are performed. The method provided in the embodiments of this invention can be executed by relevant terminal devices, and the following description uses a network node server as the execution entity.

[0051] Please refer to Figure 1 , Figure 1This is a flowchart illustrating a file transfer control method according to a first embodiment of the present invention. The first embodiment of the present invention provides a file transfer control method, including steps S1 to S2:

[0052] S1. Authenticate the first user accessing the network node server, and when the first user is authenticated as the administrator of any rule configuration centrally configured by the central management server, respond to the file filtering rule configuration request initiated by the first user and configure the file filtering rule.

[0053] S2. Authenticate the second user accessing the network node server, and when the second user is authenticated as any file transfer administrator centrally configured by the central management server, respond to the file transfer request initiated by the second user and select whether to transfer the target file according to the file filtering rules.

[0054] As an example, in step S1, after the central management server has centrally configured at least one rule configuration administrator and at least one file transfer administrator, and the client program is installed on the network node server, the user can initiate a client login request to the network node server through their user terminal.

[0055] The first user initiates a client login request to the network node server through their user terminal. Upon receiving the client login request from the first user, the network node server performs user authentication. The user authentication method can be account and password authentication, mobile phone verification code authentication, facial recognition authentication, or other user authentication methods.

[0056] When the first user is authenticated as an administrator for any rule configuration centrally configured by the central management server, it is considered that the first user has been granted rule configuration permissions by the central management server. The first user can configure filter rules through the client program. The network node server returns a successful user authentication response and waits to receive a file filter rule configuration request initiated by the first user. Upon receiving the file filter rule configuration request initiated by the first user, the server responds to the file filter rule configuration request and configures the filter rules. The file filter rules can include filter rules that include file type and file content keywords.

[0057] When the first user being authenticated is not an administrator of any rule configuration centrally configured by the central management server, it is considered that the first user has not yet been granted rule configuration permissions by the central management server. The first user cannot filter rules through the client program configuration file, and the network node server returns a user authentication failure response, refusing to respond to the rule configuration request initiated by the first user.

[0058] The second user initiates a client login request to the network node server through their user terminal. When the network node server receives the client login request from the second user, it performs user authentication on the second user.

[0059] When the second user is authenticated as any file transfer administrator centrally configured by the central management server, it is considered that the second user has been granted file transfer permissions by the central management server. The second user can initiate the file transfer process through the client program. The network node server returns a successful user authentication response and waits to receive file transfer requests initiated by the second user. Upon receiving the file transfer request, the server responds to the request and, based on file filtering rules, selects whether to transfer the target file. The target file is the file selected by the second user to be transferred through the network node where the network node server is located; it can be a single file or a batch of files.

[0060] When the second user is not a file transfer administrator centrally configured by the central management server, it is considered that the second user has not yet been granted file transfer permissions by the central management server. The second user cannot initiate the file transfer process through the client program, and the network node server returns a user authentication failure response, refusing to respond to the file transfer request initiated by the second user.

[0061] This invention, through user authentication by network node servers, allows only users authenticated as rule configuration administrators centrally configured by the central management server to configure file filtering rules and file transfer administrators centrally configured by the central management server to initiate file transfer processes. Based on previously configured file filtering rules, the system selects whether to transfer the target file. This file transfer control method, with centralized authorization by the central management server and decentralized management by network node servers, prevents any user from maliciously tampering with file filtering rules and arbitrarily initiating file transfer processes. It also prevents a single user from independently completing file transfers, effectively reducing the security risks of transferring target files between different networks and achieving the technical effect of secure file transfer between different networks.

[0062] In an optional embodiment, the central management server is located at the network boundary.

[0063] As an example, a network node server can be a network node server in any of the different networks. For instance, a network node server can be an internal network node server or an external network node server. When there is at least one internal network node server and at least one external network node server, a central management server is set up at the network boundary between all internal network node servers and all external network node servers. The central management server is responsible for centralized authorization and synchronous routing. Each internal network node server and each external network node server has a client program installed for user authentication, rule verification, incremental file discovery, file transfer, etc., so that each internal network node server and each external network node server can access the central management server and obtain all rule configuration administrators and all file transfer administrators centrally configured by the central management server.

[0064] By placing the central management server at the network boundary, this invention enables network node servers from different networks to quickly access the central management server and obtain all rule configuration administrators and all file transfer administrators centrally configured by the central management server, which helps improve file transfer control efficiency.

[0065] In an optional embodiment, when authenticating the first user as any rule configuration administrator centrally configured by the central management server, responding to the file filtering rule configuration request initiated by the first user and configuring the file filtering rules further includes: responding to the permission restriction scope division request initiated by the first user and dividing the permission restriction scope of each file transfer administrator; responding to the target file cipher setting request initiated by the first user and setting the cipher of the target file.

[0066] As an example, when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, it is considered that the first user has been granted rule configuration permissions by the central management server. The first user can also restrict the file operation permissions of each file transfer administrator through the client program. The network node server returns a successful user authentication response and waits to receive the permission restriction scope division request and target file encryption label setting request initiated by the first user. When the permission restriction scope division request initiated by the first user is received, the server responds to the permission restriction scope division request and divides the permission restriction scope of each file transfer administrator. When the target file encryption label setting request initiated by the first user is received, the server responds to the target file encryption label setting request and sets the encryption label of the target file.

[0067] The permission restriction scope can be divided according to the security labels of each file in the file list that each file transfer administrator can transfer, or it can be divided directly according to the highest security label level of the files that each file transfer administrator can transfer. This allows for flexible division of the permission restriction scope for each file transfer administrator. For example, when file transfer administrator manager1 can only transfer files with security labels M=1 and M=3, the permission restriction scope for file transfer administrator manager1 is set to {M=1, M=3}. However, when the highest security label level of files that file transfer administrator manager1 can transfer is 3, the permission restriction scope for file transfer administrator manager1 is set to {M≤3}. The file security labels can be set by adding key-value pairs in the file attributes through the system API (Application Programming Interface), such as topsec_security=M. The file security labels can also be read later through the system API interface.

[0068] This invention, through user authentication by network node servers, allows only users authenticated as rule configuration administrators centrally configured by the central management server to define the permission restrictions for each file transfer administrator and set the encryption label for the target file. This file transfer control method, with centralized authorization by the central management server and decentralized management by network node servers, further restricts the file operation permissions of each file transfer administrator. This prevents file transfer administrators from completing file transfers without the necessary permissions, effectively reducing the security risks of transferring target files between different networks and preventing all file transfer administrators from arbitrarily initiating file transfer processes for various target files. This ultimately achieves a better technical effect of secure file transfer between different networks.

[0069] In an optional implementation of this embodiment, the step of responding to a file transfer request initiated by the second user and selecting whether to transfer the target file according to file filtering rules specifically includes: responding to the file transfer request, extracting the target file from the file transfer request, obtaining the password label of the target file, and obtaining the permission restriction range corresponding to the second user; verifying whether the second user has the permission to transfer the target file based on the password label of the target file and the permission restriction range corresponding to the second user; and when it is determined that the second user has the permission to transfer the target file, continuing to select whether to transfer the target file according to file filtering rules.

[0070] As an example, when the second user is authenticated as any file transfer administrator centrally configured by the central management server, the network node server waits to receive a file transfer request initiated by the second user, and upon receiving the file transfer request, responds to the file transfer request, extracts the target file from the file transfer request, obtains the password label of the target file, and obtains the permission restriction range corresponding to the second user.

[0071] Based on the target file's security tag and the second user's corresponding permission restrictions, the system verifies whether the second user has permission to transfer the target file. If the system determines that the second user has permission to transfer the target file, it continues to select whether to transfer the target file according to the file filtering rules. If the system determines that the second user does not have permission to transfer the target file, it sends a user permission verification failure message to notify the second user that they do not have permission to transfer the target file.

[0072] This invention, through a network node server verifying whether a second user has permission to transmit the target file based on the target file's security tag and the second user's corresponding permission restrictions, enables permission verification of the second user before transmitting the target file. This prevents file transfer administrators without the necessary permissions from transmitting the target file, thus better achieving the technical effect of secure file transmission between different networks. Furthermore, since the core permission verification and file filtering are performed through the client program, all illegal file transmission operations can be handled internally, preventing any influx or outflow of file traffic.

[0073] In an optional implementation of this embodiment, the step of verifying whether the second user has the right to transmit the target file based on the security label of the target file and the permission restriction range corresponding to the second user specifically includes: obtaining the security level of the second user based on the permission restriction range corresponding to the second user; determining whether the security label of the target file is less than or equal to the security level of the second user; if the security label of the target file is less than or equal to the security level of the second user, then determining that the second user has the right to transmit the target file; otherwise, determining that the second user does not have the right to transmit the target file.

[0074] As an example, when the permission restriction range of each file transfer administrator is divided by security level, the security level of the second user is obtained according to the permission restriction range corresponding to the second user. For example, the second user is authenticated as file transfer administrator manager1, the permission restriction range of file transfer administrator manager1 is {M≤3}, and the highest security level of the files it can transfer is 3. Then the security level of the second user is N=3.

[0075] Determine the password M of the target file 目标 Is the security level N of the second user less than or equal to the security level M of the target file? 目标If the security level N of the second user is less than or equal to that of the second user, then the second user is considered to have a higher level and can transmit the target file. This indicates that the second user has permission to transmit the target file. If the security level M of the target file is less than or equal to that of the second user, then the second user has the necessary permissions to transmit the target file. 目标 If the security level N is greater than that of the second user, then the second user is considered to have a low security level and cannot transmit the target file; therefore, the second user is determined not to have the permission to transmit the target file.

[0076] This invention, by classifying the permission restrictions of each file transfer administrator according to security level, can flexibly define the permission restrictions of each file transfer administrator, further restricting the file operation permissions of each file transfer administrator. This ensures that file transfer administrators cannot complete file transfer without file operation permissions for the target file, effectively reducing the security risks of transferring target files between different networks and preventing all file transfer administrators from arbitrarily initiating file transfer processes for various target files. This better achieves the technical effect of securely transferring files between different networks.

[0077] In an optional embodiment, before selecting whether to transmit the target file according to the file filtering rules, the method further includes: checking whether there are configuration file filtering rules, and sending a rule configuration prompt message when it is determined that there are no configuration file filtering rules.

[0078] As an example, when a second user is authenticated as any file transfer administrator centrally configured by the central management server, the network node server waits to receive a file transfer request initiated by the second user. Upon receiving the file transfer request, the server responds to the file transfer request by first checking whether there are configuration file filtering rules. If no configuration file filtering rules are found, a rule configuration prompt message is sent to remind the rule configuration administrator to log in to the client to configure the configuration filtering rules. If configuration file filtering rules are found, the server then selects whether to transfer the target file according to the file filtering rules.

[0079] In this embodiment of the invention, when a network node server responds to a file transfer request initiated by a second user, it first checks whether there are configuration file filtering rules. If no configuration file filtering rules are found, it sends a rule configuration prompt. If configuration file filtering rules are found, it continues to select whether to transfer the target file according to the file filtering rules. This ensures that file filtering is effectively performed before file transfer, preventing the target file from being transferred without file filtering processing, thereby better achieving the technical effect of secure file transfer between different networks.

[0080] Please refer to Figure 2 , Figure 2This is a data flow diagram of a file transfer control method provided in the first embodiment of the present invention. In an optional implementation of this embodiment, the step of selecting whether to transfer the target file according to the file filtering rules specifically includes: determining whether the target file conforms to the file filtering rules; if the target file conforms to the file filtering rules, then the transfer of the target file is allowed; otherwise, the transfer of the target file is rejected.

[0081] As an example, the file filtering rule can be a filtering rule that includes file type and file content keywords. For example, the file filtering rule could be: Do not transmit files whose file content keywords contain the word "confidential". The file content of the target file is traversed, and file content keywords are extracted. The keyword "confidential" is searched for among all file content keywords. If it is found, the target file is determined not to meet the file filtering rule, and the transmission of the target file is rejected. If it is not found, the target file is determined to meet the file filtering rule, and the transmission of the target file is triggered.

[0082] This invention, through user authentication by a network node server, allows only users authenticated as administrators of any rule configured centrally by the central management server to configure configuration file filtering rules. This enables flexible configuration file filtering rules, allowing for coarse-to-fine granularity of file transfer control. Furthermore, by filtering the target file according to the file filtering rules before transmission, the filtering can be precise down to any file without any characteristics, which is beneficial for adapting to complex business needs.

[0083] Please refer to Figure 3 , Figure 3 This is a schematic diagram of a file transfer control device according to a second embodiment of the present invention. The second embodiment of the present invention provides a file transfer control device, including: a file filtering rule configuration module 21, used to authenticate a first user accessing a network node server, and when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, responding to a file filtering rule configuration request initiated by the first user and configuring file filtering rules; and a file transfer control module 22, used to authenticate a second user accessing the network node server, and when the second user is authenticated as any file transfer administrator centrally configured by the central management server, responding to a file transfer request initiated by the second user and selecting whether to transfer a target file according to the file filtering rules.

[0084] In an optional embodiment, the central management server is located at the network boundary.

[0085] In an optional embodiment, when authenticating the first user as any rule configuration administrator centrally configured by the central management server, responding to the file filtering rule configuration request initiated by the first user and configuring the file filtering rules further includes: responding to the permission restriction scope division request initiated by the first user and dividing the permission restriction scope of each file transfer administrator; responding to the target file cipher setting request initiated by the first user and setting the cipher of the target file.

[0086] In an optional implementation of this embodiment, the step of responding to a file transfer request initiated by the second user and selecting whether to transfer the target file according to file filtering rules specifically includes: responding to the file transfer request, extracting the target file from the file transfer request, obtaining the password label of the target file, and obtaining the permission restriction range corresponding to the second user; verifying whether the second user has the permission to transfer the target file based on the password label of the target file and the permission restriction range corresponding to the second user; and when it is determined that the second user has the permission to transfer the target file, continuing to select whether to transfer the target file according to file filtering rules.

[0087] In an optional implementation of this embodiment, the step of verifying whether the second user has the right to transmit the target file based on the security label of the target file and the permission restriction range corresponding to the second user specifically includes: obtaining the security level of the second user based on the permission restriction range corresponding to the second user; determining whether the security label of the target file is less than or equal to the security level of the second user; if the security label of the target file is less than or equal to the security level of the second user, then determining that the second user has the right to transmit the target file; otherwise, determining that the second user does not have the right to transmit the target file.

[0088] In an optional embodiment, the file transfer control module 22 is further configured to check whether there are configuration file filtering rules before selecting whether to transfer the target file according to the file filtering rules, and send a rule configuration prompt message when it is determined that there are no configuration file filtering rules.

[0089] In an optional implementation of this embodiment, the step of selecting whether to transmit the target file according to the file filtering rules specifically includes: determining whether the target file conforms to the file filtering rules; if the target file conforms to the file filtering rules, then the transmission of the target file is allowed; otherwise, the transmission of the target file is rejected.

[0090] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0091] Please see Figure 4 , Figure 4This is a schematic diagram of a file transfer control system provided in the third embodiment of the present invention. The third embodiment of the present invention provides a file transfer control system including a central management server 31 and at least one network node server 32; each network node server 32 is communicatively connected to the central management server 31; the central management server 31 is used to pre-configure at least one rule configuration administrator and at least one file transfer administrator; the network node servers 32 are used to execute the file transfer control method as described in the first embodiment.

[0092] The implementation process of the functions and roles of the network node server 32 in the above system is detailed in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0093] Please refer to Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device according to a fourth embodiment of the present invention. The fourth embodiment of the present invention provides an electronic device 40, including a processor 41, a memory 42, and a computer program stored in the memory 42 and configured to be executed by the processor 41; the memory 42 is coupled to the processor 41, and when the processor 41 executes the computer program, it implements the file transfer control method as described in the first embodiment of the present invention, and achieves the same beneficial effects.

[0094] When the processor 41 reads a computer program from the memory 42 via the bus 43 and executes the computer program, it can implement any of the methods included in the file transfer control method described in the first embodiment of the present invention.

[0095] Processor 41 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 41 may be a microprocessor.

[0096] The memory 42 can be used to store instructions executed by the processor 41 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this invention. The processor 41 of this disclosure embodiment can be used to execute instructions in the memory 42 to implement the file transfer control method as described in the first embodiment of this invention. The memory 42 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0097] The fifth embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the file transfer control method as described in the first embodiment of the present invention, and can achieve the same beneficial effects.

[0098] In summary, this invention provides a file transfer control method, comprising: authenticating a first user accessing a network node server, and, if the first user is authenticated as any rule configuration administrator centrally configured by a central management server, responding to a file filtering rule configuration request initiated by the first user and configuring file filtering rules; authenticating a second user accessing the network node server, and, if the second user is authenticated as any file transfer administrator centrally configured by the central management server, responding to a file transfer request initiated by the second user and selecting whether to transfer a target file according to the file filtering rules. This invention, by having the network node server authenticate users, allowing only users authenticated as any rule configuration administrator centrally configured by the central management server to configure file filtering rules, and only allowing users authenticated as any file transfer administrator centrally configured by the central management server to initiate the file transfer process, and selecting whether to transfer a target file according to the previously configured file filtering rules, adopts this file transfer control method of centralized authorization by the central management server and decentralized management by the network node servers. This avoids any user maliciously tampering with file filtering rules and arbitrarily initiating the file transfer process, making it impossible for a single user to complete file transfer independently, effectively reducing the security risks of transferring target files between different networks, thereby achieving the technical effect of secure file transfer between different networks.

[0099] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0100] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0101] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A file transfer control method, characterized in that, include: The system performs user authentication on the first user accessing the network node server, and responds to the file filtering rule configuration request initiated by the first user when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, and configures the file filtering rule. User authentication is performed on the second user accessing the network node server. When the second user is authenticated as any file transfer administrator centrally configured by the central management server, the file transfer request initiated by the second user is responded to, and the target file is selected for transfer according to the file filtering rules. The central management server is set up at the network boundary, and the network node server is the network node server of any network in different networks. When there is at least one internal network node server and at least one external network node server, the central management server is set up at the network boundary between all internal network node servers and all external network node servers. The central management server is responsible for centralized authorization and synchronous routing. Each internal network node server and each external network node server has a client program installed for user authentication, rule verification, incremental file discovery and file transfer. Wherein, when authenticating the first user as any rule configuration administrator centrally configured by the central management server, responding to the file filtering rule configuration request initiated by the first user, the configuration file filtering rule also includes: In response to the permission restriction scope division request initiated by the first user, the permission restriction scope of each of the file transfer administrators is divided; In response to the target file encryption setting request initiated by the first user, the encryption of the target file is set. Setting the encryption of the target file includes adding key-value pairs to the attributes of the target file through the system API, where the value is the encryption.

2. The file transfer control method according to claim 1, characterized in that, The step of responding to the file transfer request initiated by the second user, and selecting whether to transfer the target file according to the file filtering rules, specifically includes: In response to the file transfer request, extract the target file from the file transfer request, obtain the password label of the target file, and obtain the permission restriction range corresponding to the second user; Based on the cryptographic label of the target file and the permission restriction range corresponding to the second user, verify whether the second user has the transmission permission for the target file; When it is determined that the second user has the permission to transfer the target file, the system continues to select whether to transfer the target file according to the file filtering rules.

3. The file transfer control method according to claim 2, characterized in that, The step of verifying whether the second user has the right to transmit the target file based on the password of the target file and the permission restriction range corresponding to the second user specifically includes: Based on the permission restriction scope corresponding to the second user, obtain the security level of the second user; Determine whether the security label of the target file is less than or equal to the security level of the second user. If the security label of the target file is less than or equal to the security level of the second user, then determine that the second user has the right to transmit the target file; otherwise, determine that the second user does not have the right to transmit the target file.

4. The file transfer control method according to claim 1 or 2, characterized in that, Before selecting whether to transfer the target file according to the file filtering rules, the method further includes: Check if the file filtering rules are configured, and if it is found that no file filtering rules are configured, send a rule configuration prompt message.

5. The file transfer control method according to claim 1 or 2, characterized in that, The step of selecting whether to transmit the target file based on the file filtering rules specifically includes: Determine whether the target file conforms to the file filtering rules. If the target file conforms to the file filtering rules, the transmission of the target file is allowed; otherwise, the transmission of the target file is rejected.

6. A file transfer control device, characterized in that, include: The file filtering rule configuration module is used to authenticate the first user accessing the network node server, and when the first user is authenticated as any rule configuration administrator centrally configured by the central management server, it responds to the file filtering rule configuration request initiated by the first user and configures the file filtering rules. The file transfer control module is used to authenticate the second user accessing the network node server, and when the second user is authenticated as any file transfer administrator centrally configured by the central management server, it responds to the file transfer request initiated by the second user and selects whether to transfer the target file according to the file filtering rules. The central management server is set up at the network boundary, and the network node server is the network node server of any network in different networks. When there is at least one internal network node server and at least one external network node server, the central management server is set up at the network boundary between all internal network node servers and all external network node servers. The central management server is responsible for centralized authorization and synchronous routing. Each internal network node server and each external network node server has a client program installed for user authentication, rule verification, incremental file discovery and file transfer. The file filtering rule configuration module is further configured to respond to the permission restriction range division request initiated by the first user, and to divide the permission restriction range of each file transfer administrator; and to respond to the target file password setting request initiated by the first user, and to set the password of the target file, wherein setting the password of the target file includes: adding key-value pairs to the attributes of the target file through the system API, wherein the value is the password.

7. A file transfer control system, characterized in that, It includes a central management server and at least one network node server; each of the network node servers is communicatively connected to the central management server. The central management server is used to centrally configure at least one rule configuration administrator and at least one file transfer administrator. The network node server is used to execute the file transfer control method according to any one of claims 1 to 5; The central management server is set up at the network boundary, and the network node server is the network node server of any network in different networks. When there is at least one internal network node server and at least one external network node server, the central management server is set up at the network boundary between all internal network node servers and all external network node servers. The central management server is responsible for centralized authorization and synchronous routing. Each internal network node server and each external network node server has a client program installed for user authentication, rule verification, incremental file discovery and file transfer.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor, when executing the computer program, implements the file transfer control method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the file transfer control method according to any one of claims 1 to 5.

Images