Cross-domain file transfer method and system

Abstract

The embodiment of the present disclosure discloses a cross-network domain file transmission method and system, wherein the method comprises: when a sender transmits a file to another physical network domain through a physical network domain where the sender is located, performing file security detection in the physical network domain where the sender is located; if the result of the security detection indicates that the detection is passed, transmitting the file to the other physical network domain, wherein after the receiver of the other physical network domain receives the file, performing security detection on the received file, and performing file persistence in the network domain after the detection is passed. Through real-time synchronization of file transmission security detection strategies between multiple physical network domains in logic, security detection is performed on the cross-network domain transmitted file, the uniformity of the multiple-network domain security detection standards is realized, the file transmission failure caused by the inconsistency of the security detection standards between the physical network domains is avoided, and the logic uniformity between different physical network domains under each business field in the file interaction level is promoted.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of cross-domain, in particular to a cross-domain file transmission method and system. BACKGROUND

[0002] With the development of information technology, each business field has built its own informationization ecological system. These ecological systems rely on physical domains in a physical sense. For business fields with a high degree of informationization, there may be multiple physical domains in the ecological system, and even the degree of isolation between them is relatively high. In recent years, technologies such as big data and artificial intelligence have been increasingly applied to various business fields, and the problem of difficulty in data interaction between each physical domain in the ecological system of a business field has become particularly prominent. In order to deal with this situation, cross-domain data transmission has become the choice of many business fields, and cross-domain file transmission is a main direction in cross-domain data transmission.

[0003] The existing cross-domain file transmission is generally based on a certain physical domain, and a file transmission channel between it and other physical domains is built through software and hardware. This mode solves the basic demand of file transmission between each physical domain, but as a whole, each physical domain is still a file transmission island, and its transmission security policy is set by itself and has nothing to do with other physical domains. However, in the ecological system of a business field, files need to flow in multiple physical domains, and are subject to the transmission security policy of each physical domain. In the process of file flow, the transmission security policy of each domain needs to be negotiated in advance, otherwise the file flow process will be suspended as long as the security policy of one domain does not match. The transmission security policy of each domain needs to be adjusted manually, and the more the domains, the more complex the negotiation, and the higher the adjustment cost. SUMMARY

[0004] The main purpose of the present disclosure is to provide a cross-domain file transmission method and system to solve the problems in the related art.

[0005] In order to achieve the above purpose, according to the first aspect of the present disclosure, a cross-domain file transmission method is provided, which comprises: when a sender transmits a file to another physical domain through the physical domain where the sender is located, performing file security detection in the physical domain where the sender is located; if the result of the security detection indicates that the detection is passed, transmitting the file to another physical domain, wherein after the receiver of the other physical domain receives the file, the received file is subjected to security detection, and after the detection is passed, the file is persisted in the domain.

[0006] Optionally, the method for implementing file security detection includes: real-time synchronization of security detection strategies between physical network domains, wherein, when synchronizing the security detection strategies, the file type feature database, word similarity dictionary, sensitive word dictionary, virus feature database, and cross-network transmission strategy database of each physical network domain are synchronized; and file type legality detection, sensitive word detection, virus detection, and transmission legality detection are performed based on the security detection strategies.

[0007] Optionally, the real-time synchronization security detection strategy between physical network domains includes: when synchronizing file type feature databases, word similarity dictionaries, sensitive word dictionaries, and virus feature databases, monitoring the change data of the feature databases and dictionaries for any physical network domain; if a cross-network transmission policy exists in the current physical network domain, encapsulating the change data into a first change instruction; and broadcasting the first change instruction to other physical network domains reachable from the current physical network domain based on the cross-network domain transmission policy, so that local data in the other physical network domains can be operated on based on the first change instruction.

[0008] Optionally, the real-time synchronization security detection strategy between physical network domains further includes: when performing cross-network transmission policy synchronization, for any physical network domain, monitoring the change data of the cross-network transmission policy; if a cross-network transmission policy exists in the current physical network domain, reading all feature databases and dictionary data of the current physical network domain; encapsulating the change data of the cross-network transmission policy and all feature databases and dictionary data of the current physical network domain into a second change instruction; broadcasting the second change instruction to other physical network domains reachable from the current physical network domain, so that local data in other physical network domains can be operated on based on the second change instruction; taking the union of all feature databases and dictionary data of the current physical network domain indicated by the second change instruction and the feature databases and dictionary data in the original local data; if the data after the union is different from the original local data, encapsulating a new change instruction based on the changed data.

[0009] Optionally, when performing file type validity checks based on the security detection strategy, it is determined whether the file type is unique; if unique, the file extension is read, and the file type and the file type represented by the extension are compared. If the comparison matches, the file type is valid; if not unique, it is determined whether it belongs to the ZIP class. If it belongs to the ZIP class, the file type is determined after decompression; if it does not belong to the ZIP class, a new file type is added as a feature to the file type feature library.

[0010] Optionally, when performing sensitive word detection based on the security detection strategy, the text content is extracted from the file; after segmenting the text content into words, the segmentation is corrected based on a word similarity dictionary, and a set of similar words for each segment is determined; and the sensitive word dictionary and the set of similar words are used to determine whether the segment is a sensitive word.

[0011] Optionally, when performing virus detection based on the security detection strategy, the virus signature database features are compared with the file to determine whether the file contains virus signatures. If the virus signatures are not found, the security detection passes; otherwise, the security detection fails.

[0012] Optionally, when performing transmission legitimacy detection based on the security detection strategy, the source and destination ends of the file transmission are obtained, and a cross-network transmission strategy is determined based on the source and destination ends; it is determined whether the determined cross-network transmission strategy exists in the cross-network transmission strategy library; if it exists, the file type of the file is matched with the file type allowed by the cross-network transmission strategy; if the match is successful, the security level of the file is compared with the highest file security level allowed in the cross-network transmission strategy; if the security level of the file does not exceed the highest file security level, the detection passes; otherwise, the detection fails.

[0013] According to a second aspect of this disclosure, a cross-domain file transfer system is provided, comprising multiple physical domains. When a sender transfers a file from its own physical domain to another physical domain, a file security check is performed in the physical domain where the sender is located. If the security check results in a pass, the file is transferred to the other physical domain. Upon receiving the file, the receiver in the other physical domain performs a security check on the received file and persists the file within its own domain after the check passes.

[0014] Optionally, when implementing file security detection: security detection strategies are synchronized in real time between physical network domains, wherein, when synchronizing the security detection strategies, the file type feature database, word similarity dictionary, sensitive word dictionary, virus feature database, and cross-network transmission strategy database of each physical network domain are synchronized; and file type legality detection, sensitive word detection, virus detection, and transmission legality detection are performed based on the security detection strategies.

[0015] This embodiment presents a cross-domain file transfer method and system. The method includes performing a file security check within the sender's physical domain when transferring a file from its own physical domain to another physical domain. If the security check passes, the file is transferred to the other physical domain. Upon receiving the file, the receiver in the other physical domain performs a security check on the received file and persists the file within its own domain after the check passes. By using a real-time synchronized file transfer security check strategy across multiple logically unified physical domains, security checks are performed on files transferred across domains. This achieves a unified security check standard across multiple domains, avoiding file transfer failures caused by inconsistencies in security check standards between different physical domains, and promoting logical consistency in file interaction between different physical domains under various business areas.

[0016] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a cross-domain file transfer method according to an embodiment of the present disclosure;

[0018] Figure 2 This is an application scenario diagram of the cross-domain file transfer method according to embodiments of this disclosure;

[0019] Figure 3 This is a schematic diagram of the security detection logic in an embodiment of this disclosure;

[0020] Figure 4 This is a schematic diagram illustrating a security detection strategy synchronization in one embodiment of this disclosure;

[0021] Figure 5 This is a schematic diagram illustrating another security detection strategy synchronization in this embodiment of the disclosure;

[0022] Figure 6 This is a schematic diagram of the file type legality detection logic in an embodiment of this disclosure;

[0023] Figure 7 This is a schematic diagram of the sensitive word detection logic in an embodiment of this disclosure;

[0024] Figure 8 This is a schematic diagram of the virus detection logic in an embodiment of this disclosure;

[0025] Figure 9 This is a schematic diagram of the transmission legality detection logic in an embodiment of this disclosure;

[0026] Figure 10 This is a schematic diagram of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0030] According to embodiments of this disclosure, a method for cross-domain file transfer is provided, such as... Figure 1 As shown, steps 101 to 103 are included below:

[0031] Step 101: When the sender transmits a file from its own physical network domain to another physical network domain, file security checks are performed in the physical network domain where the sender is located.

[0032] Step 102: If the security check result indicates that the check passed, the file is transferred to another physical network domain. When the receiver in the other physical network domain receives the file, it performs a security check on the received file and persists the file in its own network domain after the check passes.

[0033] refer to Figure 2 The diagram illustrates an application scenario for cross-domain file transfer. Within a unified logical domain, multiple independent physical domains exist. When a file is transferred from one physical domain to another, the sending domain performs a security check on the file according to a security detection policy. If the check passes, the file is transferred to the destination domain via a cross-domain file transfer component. Upon receiving the file, the destination domain performs a security check on the received file. If the check passes, the file is persisted within the domain; otherwise, it is discarded.

[0034] Provide a unified security detection standard for cross-domain file transfer, avoid file transfer failures caused by inconsistencies in security detection standards between different physical domains, and promote logical consistency in file interaction between different physical domains under various business areas.

[0035] As an optional implementation of this embodiment, the method for implementing file security detection includes: real-time synchronization of security detection strategies between physical network domains, wherein, when synchronizing the security detection strategies, the file type feature library, word similarity dictionary, sensitive word dictionary, virus feature library, and cross-network transmission strategy library of each physical network domain are synchronized; and file type legality detection, sensitive word detection, virus detection, and transmission legality detection are performed based on the security detection strategies.

[0036] In this optional implementation, security detection strategy synchronization includes file type feature library synchronization, word similarity dictionary synchronization, sensitive word dictionary synchronization, virus signature library synchronization, and cross-network transmission strategy synchronization. Security detection strategies such as file type feature libraries, sensitive word libraries, virus signature libraries, and cross-network transmission strategies are compared, transmitted, and updated between various physical network domains under a unified logical network domain.

[0037] The cross-network file transfer assistance system, which uses a security detection strategy based on a real-time synchronization mechanism to achieve unified standard security detection, enables real-time unification of file transfer security detection standards within a logically unified virtual network domain. This effectively avoids file transfer failures caused by inconsistent file transfer security detection standards across different physical network domains, as well as the difficulty of manually unifying standards. To a certain extent, it promotes the integration of file interaction at the file interaction level among various physical network domains under the business domain.

[0038] refer to Figure 3 The diagram illustrates the sequential execution of file type validity checks, sensitive word checks, virus checks, and cross-network transmission validity checks. Files can be transmitted across networks only if all checks pass; if any check fails, the file is discarded.

[0039] As an optional implementation of this embodiment, the real-time synchronization security detection strategy between physical network domains includes: when synchronizing the file type feature library, word similarity dictionary, sensitive word dictionary, and virus feature library, for any physical network domain, monitoring the change data of the feature library and dictionary; if there is a cross-network transmission policy in this physical network domain, then encapsulating the change data into a first change instruction; and broadcasting the first change instruction to other physical network domains reachable from this physical network domain based on the cross-network domain transmission policy, so that local data in the other physical network domains can be operated on based on the first change instruction.

[0040] In this optional implementation, refer to Figure 4This diagram illustrates a security detection strategy synchronization process. During the synchronization of file type feature databases, word similarity dictionaries, sensitive word dictionaries, and virus feature databases, the system monitors changes to the feature databases (file type feature database, virus feature database) and dictionaries (word similarity dictionary, sensitive word dictionary). When changes occur, the system acquires the changed data and its operation type; it reads the cross-network transmission policy of the local network domain. If no policy exists, the synchronization process terminates; if a policy exists, the changed data and its operation type are encapsulated into a change instruction, and the change instruction is signed. The change instruction is then broadcast to all other network domains reachable from the local network domain according to the cross-network transmission policy. Upon receiving the change instruction, other network domains verify its signature. If the signature verification fails, the change instruction is discarded; if the signature verification succeeds, the system checks the required operations and data. If the local data is inconsistent with the requirements of the change instruction (e.g., the change instruction requires an addition, but the local data does not exist, or the data exists but is inconsistent with the change instruction, or the change instruction requires deletion, and the local data exists), the system adds, modifies, or deletes the local data according to the change instruction's requirements. If the local data matches the requirements of the change instruction, no action is taken.

[0041] As an optional implementation of this embodiment, the real-time synchronization security detection strategy between physical network domains further includes: when performing cross-network transmission strategy synchronization, for any physical network domain, monitoring the change data of the cross-network transmission strategy; if a cross-network transmission strategy exists in the current physical network domain, reading all feature libraries and dictionary data of the current physical network domain; encapsulating the change data of the cross-network transmission strategy and all feature libraries and dictionary data of the current physical network domain into a second change instruction; broadcasting the second change instruction to other physical network domains reachable from the current physical network domain, so that the local data in the other physical network domains can be operated on based on the change instruction; taking the union of all feature libraries and dictionary data of the current physical network domain indicated by the second change instruction and the feature libraries and dictionary data in the original local data; if the data after the union is different from the original local data, encapsulating a new change instruction based on the changed data.

[0042] In this optional implementation, refer to Figure 5The system monitors changes to cross-network transmission policies. When a change occurs, it acquires the changed data and its operation type. It reads the cross-network transmission policies of the current network domain. If no policy exists, the synchronization process terminates. If a policy exists, it reads data from all feature libraries (file type feature library, virus feature library) and dictionaries (word similarity dictionary, sensitive word dictionary) of the current network domain. It encapsulates the cross-network transmission policy change data, its operation type, and all feature library and dictionary data into a change command and signs the change command. Following the cross-network transmission policy, it broadcasts the change command to all other network domains reachable from the current network domain. Upon receiving the change command, other network domains verify its signature. If the signature verification fails, the change command is discarded; if the signature verification succeeds, the verification of the change command is performed. The system handles cross-network transmission policy data and operations. If the local data is inconsistent with the requirements in the change instruction (the change instruction requires an addition, but the local data does not exist or exists but is inconsistent with the data in the change instruction, or the change instruction requires deletion and the local data exists, etc.), then the local cross-network transmission policy data is added, modified, or deleted according to the requirements of the change instruction. If the local cross-network transmission policy data is consistent with the requirements in the change instruction, no action is taken. The system performs a union operation between the feature library data and dictionary data in the change instruction and the local feature library data and dictionary data. If the local feature library data and dictionary data change after the union operation, then a new change instruction is generated and broadcast, referring to the aforementioned synchronization process for non-cross-network transmission policy security detection strategies.

[0043] As an optional implementation of this embodiment, when performing file type legality detection based on the security detection strategy, it is determined whether the file type is unique; if unique, the file extension is read and the file type and the file type represented by the extension are compared. If the comparison matches, the file type is legal; if not unique, it is determined whether it belongs to the ZIP class. If it belongs to the ZIP class, it is decompressed and the file type is determined; if it does not belong to the ZIP class, a new file type is added as a feature to the file type feature library.

[0044] In this optional implementation, file type validity detection involves checking the actual type of the file and comparing it with the file type represented by the file extension, thus preventing the file type transmission control in the transmission validity detection from being bypassed by modifying the file extension.

[0045] refer to Figure 6 The schematic diagram illustrates the logic of file type validity detection. First, the file type feature library is loaded and the file stream is read. The file stream is then injected into the TiKa tool to obtain TiKa feature values. The TiKa feature values ​​are compared with those in the file type feature library. If the file type can be uniquely determined, the file type is recorded; otherwise, a magic number comparison is performed.

[0046] The magic number is read from the file. It is compared with the TiKa feature value and magic number in the file type feature library. If the file type can be uniquely determined, the file type is recorded; otherwise, it is determined whether the file belongs to the ZIP file category. If it does not belong to the ZIP file category, the file type cannot be determined, and a new file type feature needs to be added to the file type feature library and reloaded. If it belongs to the ZIP file category, the file is decompressed, and it is determined whether the decompressed file package conforms to the docx file characteristics. If it does, it is determined to be a docx file; if not, it is determined whether it conforms to the ofd file characteristics. If it does, it is determined to be an ofd file; if not, the file type cannot be determined, and a new file type feature needs to be added to the file type feature library and reloaded. For the determined file type, it is compared with the file type represented by the file extension. If they match, the file type validity check passes; otherwise, it fails.

[0047] As an optional implementation of this embodiment, when performing sensitive word detection based on the security detection strategy, the text content is extracted from the file; after segmenting the text content into words, the segmentation is corrected based on the word similarity dictionary, and the similar word set of each segmentation is determined; based on the sensitive word dictionary and the similar word set, it is determined whether the segmentation is a sensitive word.

[0048] In this optional implementation, sensitive word detection involves extracting text information from certain types of files to be transmitted (such as image files, PDF files, OFD files, OFFICE files, etc.) and detecting whether they contain sensitive words.

[0049] refer to Figure 7First, extract the text content from the file to be detected. If it is a text file, such as a Word file or a text file, the text content is read directly from the file. If it is an image file, such as a BMP file or a JPG file, the text content is read using OCR text recognition. The extracted text content is segmented into words, and the word similarity is determined based on a word similarity dictionary. If the determination result needs to be corrected, it is corrected, and the correction is fed back and used to train the word similarity dictionary, ultimately obtaining a set of segmented words for the text content and a set of similar words for each segment. The segmented words are compared with a sensitive word dictionary to determine if they are sensitive words. If a segmented word is not in the sensitive word dictionary, its similar word set is compared with the sensitive word dictionary to determine if a sensitive word exists in the similar word set. If a segmented word is a sensitive word or a sensitive word exists in the similar word set and the similarity between the similar word and the segmented word is 80% or higher, then the text content is determined to contain a sensitive word. If a segmented word is not a sensitive word but a sensitive word exists in the similar word set and the similarity between the similar word and the segmented word is between 50% and 80%, then the presence of a sensitive word is determined manually and the determination result is updated in the sensitive word dictionary. In other cases, the text content is determined not to contain sensitive words.

[0050] As an optional implementation of this embodiment, when performing virus detection based on the security detection strategy, the virus feature library features are compared with the file to determine whether the file contains virus features. If the virus does not exist, the security detection passes; otherwise, the security detection fails.

[0051] In this optional implementation, virus detection involves identifying virus signatures in the file to be transmitted to determine whether it contains a virus. (See reference) Figure 8 The diagram illustrates the process of loading a virus signature database and reading a file stream. The file stream is then compared with the virus signature database to determine if any virus signatures are present. If a signature is found, the detection fails; otherwise, the detection passes.

[0052] As an optional implementation of this embodiment, when performing transmission legality detection based on the security detection strategy, the source and destination ends of the file transmission are obtained, and a cross-network transmission strategy is determined based on the source and destination ends; it is determined whether a definite cross-network transmission strategy exists in the cross-network transmission strategy library; if it exists, the file type of the file is matched with the file type allowed by the cross-network transmission strategy; if the match is successful, the security level of the file is compared with the highest file security level allowed in the cross-network transmission strategy; if the security level of the file does not exceed the highest file security level, the detection passes; otherwise, the detection fails.

[0053] In this optional implementation, the transmission legality detection checks the security level, file type, transmission source, and destination of the file to be transmitted to prevent illegal transmission.

[0054] refer to Figure 9 The diagram illustrates the process: First, the cross-network transmission policy library is loaded. The source and destination ends of the file cross-network domain transmission are obtained, and cross-network transmission policies are filtered based on these ends. If no policy is found, file cross-network domain transmission from the source to the destination is prohibited, and the test fails. If a policy is found, the file type is read and compared with the allowed file types in the cross-network transmission policy. If they match, the file type is allowed for cross-network transmission, and the next step is file security level comparison. If they do not match, the file type is not allowed for cross-network transmission, and the test fails. The file security level is then read and compared with the highest allowed file security level in the cross-network transmission policy. If the file security level does not exceed the highest allowed level in the policy, the file with that security level is allowed for cross-network transmission, and the test passes; otherwise, the test fails.

[0055] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0056] According to embodiments of this disclosure, a cross-domain file transfer system is also provided, comprising multiple physical domains. When a sender transfers a file from its own physical domain to another physical domain, a file security check is performed in the physical domain where the sender is located. If the security check results in a pass, the file is transferred to the other physical domain. When the receiver in the other physical domain receives the file, it performs a security check on the received file and persists the file in its own domain after the check passes.

[0057] As an optional implementation of this embodiment, when implementing file security detection: security detection strategies are synchronized in real time between physical network domains, wherein, when synchronizing the security detection strategies, the file type feature library, word similarity dictionary, sensitive word dictionary, virus feature library and cross-network transmission strategy library of each physical network domain are synchronized; and file type legality detection, sensitive word detection, virus detection and transmission legality detection are performed based on the security detection strategies.

[0058] As an optional implementation of this embodiment, the file security detection includes: real-time synchronization of security detection strategies between physical network domains, wherein, when synchronizing the security detection strategies, the file type feature library, word similarity dictionary, sensitive word dictionary, virus feature library and cross-network transmission strategy library of each physical network domain are synchronized; and file type legality detection, sensitive word detection, virus detection and transmission legality detection are performed based on the security detection strategies.

[0059] As an optional implementation of this embodiment, the real-time synchronization security detection strategy between physical network domains includes: when synchronizing the file type feature library, word similarity dictionary, sensitive word dictionary, and virus feature library, for any physical network domain, monitoring the change data of the feature library and dictionary; if there is a cross-network transmission policy in this physical network domain, then encapsulating the change data into a first change instruction; and broadcasting the first change instruction to other physical network domains reachable from this physical network domain based on the cross-network domain transmission policy, so that in other physical network domains, local data in the other physical network domains can be operated based on the first change instruction.

[0060] As an optional implementation of this embodiment, the real-time synchronization security detection strategy between physical network domains further includes: when performing cross-network transmission strategy synchronization, for any physical network domain, monitoring the change data of the cross-network transmission strategy; if a cross-network transmission strategy exists in the current physical network domain, reading all feature libraries and dictionary data of the current physical network domain; encapsulating the change data of the cross-network transmission strategy and all feature libraries and dictionary data of the current physical network domain into a second change instruction; broadcasting the second change instruction to other physical network domains reachable from the current physical network domain, so that the original local data in the other physical network domains can be operated on based on the second change instruction; and taking the union of all feature libraries and dictionary data of the current physical network domain indicated by the second change instruction and the feature libraries and dictionary data in the original local data; if the data after the union is different from the original local data, encapsulating a new change instruction based on the changed data.

[0061] As an optional implementation of this embodiment, when performing file type legality detection based on the security detection strategy, it is determined whether the file type is unique; if unique, the file extension is read and the file type and the file type represented by the extension are compared. If the comparison matches, the file type is legal; if not unique, it is determined whether it belongs to the ZIP class. If it belongs to the ZIP class, it is decompressed and the file type is determined; if it does not belong to the ZIP class, a new file type is added to the file type feature library as a file type feature.

[0062] As an optional implementation of this embodiment, when performing sensitive word detection based on the security detection strategy, the text content is extracted from the file; after segmenting the text content into words, the segmentation is corrected based on the word similarity dictionary, and the similar word set of each segmentation is determined; based on the sensitive word dictionary and the similar word set, it is determined whether the segmentation is a sensitive word.

[0063] As an optional implementation of this embodiment, when performing virus detection based on the security detection strategy, the virus feature library features are compared with the file to determine whether the file contains virus features. If the virus does not exist, the security detection passes; otherwise, the security detection fails.

[0064] As an optional implementation of this embodiment, when performing transmission legality detection based on the security detection strategy, the source and destination ends of the file transmission are obtained, and a cross-network transmission strategy is determined based on the source and destination ends; it is determined whether the determined cross-network transmission strategy exists in the cross-network transmission strategy library; if it exists, the file type of the file is matched with the file type allowed by the cross-network transmission strategy; if the match is successful, the security level of the file is compared with the highest file security level allowed in the cross-network transmission strategy; if the security level of the file does not exceed the highest file security level, the detection passes; otherwise, the detection fails.

[0065] This disclosure provides an electronic device, such as... Figure 10 As shown, the electronic device includes one or more processors 31 and a memory 32. Figure 10 Take a processor 31 as an example.

[0066] The controller may also include an input device 33 and an output device 34.

[0067] The processor 31, memory 32, input device 33, and output device 34 can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0068] Processor 31 can be a Central Processing Unit (CPU). Processor 31 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0069] The memory 32, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the control method in the embodiments of this disclosure. The processor 31 executes various functional applications and data processing of the server by running the non-transitory software programs, instructions, and modules stored in the memory 32, thereby implementing the email-based enterprise data exchange method of the above method embodiments.

[0070] The memory 32 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the use of the processing device operated by the server. Furthermore, the memory 32 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 32 may optionally include memory remotely located relative to the processor 31, and these remote memories can be connected to a network connection device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0071] Input device 33 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the server's processing device. Output device 34 may include display devices such as a display screen.

[0072] One or more modules are stored in memory 32, and when executed by one or more processors 31, they perform actions such as... Figure 1 The method shown.

[0073] Those skilled in the art will understand that implementing all or part of the processes in the methods of the above embodiments can be accomplished by a computer program instructing related hardware, and can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0074] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for cross-domain file transfer, characterized in that, include: When a sender transmits a file from its own physical network domain to another physical network domain, a file security check is performed in the physical network domain where the sender is located. If the security check result indicates that the check passed, the file is transferred to another physical network domain. When the receiver in the other physical network domain receives the file, it performs a file security check on the received file and persists the file in its own network domain after the check passes. Implementing file security checks includes: Real-time synchronization of security detection strategies across physical network domains, wherein, when synchronizing the security detection strategies, the file type feature database, word similarity dictionary, sensitive word dictionary, virus feature database, and cross-network transmission strategy database of each physical network domain are synchronized. And based on the aforementioned security detection strategy, file type legality detection, sensitive word detection, virus detection, and transmission legality detection are performed; Real-time synchronization of security detection strategies between physical network domains includes: When synchronizing the file type feature library, word similarity dictionary, sensitive word dictionary, and virus feature library, monitor the change data of the feature library and dictionary for any physical network domain. If there is a cross-network transmission policy in this physical network domain, the change data is encapsulated into the first change instruction. Based on the cross-domain transmission strategy, the first change instruction is broadcast to other physical domains reachable from this physical domain, so that local data in other physical domains can be operated on based on the first change instruction; Real-time synchronization of security detection strategies across physical network domains also includes: When performing cross-network transmission policy synchronization, for any physical network domain, monitor the change data of the cross-network transmission policy. If there is a cross-network transmission policy in this physical network domain, read all feature databases and dictionary data of this physical network domain. The change data of the cross-domain transmission strategy and all feature databases and dictionary data of the physical network domain are encapsulated into a second change instruction; The second change instruction is broadcast to other physical domains reachable from this physical domain, so that the original local data in the other physical domains can be operated on based on the second change instruction; and the union of all feature libraries and dictionary data in this physical domain indicated by the second change instruction, as well as the feature libraries and dictionary data in the original local data, is taken; if the data after the union is different from the original local data, a new change instruction is encapsulated based on the changed data.

2. The cross-domain file transfer method according to claim 1, characterized in that, When performing file type validity checks based on the aforementioned security detection strategy, it is determined whether the file type is unique. If the file is unique, read the file extension and compare the file type with the file type represented by the extension. If they match, the file type is valid. If it is not unique, then determine whether it belongs to the ZIP class. If it belongs to the ZIP class, then decompress it and determine the file type. If it does not belong to the ZIP class, then add the new file type as a file type feature in the file type feature library.

3. The cross-domain file transfer method according to claim 1, characterized in that, When performing sensitive word detection based on the aforementioned security detection strategy, text content is extracted from the file; After segmenting the text content into words, the segmentation is corrected based on a word similarity dictionary, and a set of similar words for each segment is determined. The determination of whether a word segment is a sensitive word is based on a sensitive word dictionary and a similar word set.

4. The cross-domain file transfer method according to claim 1, characterized in that, When performing virus detection based on the security detection strategy, the virus signature database features are compared with the file to determine whether the file contains virus signatures. If the virus signatures are not found, the security detection passes; otherwise, the security detection fails.

5. The cross-domain file transfer method according to claim 1, characterized in that, When performing transmission legitimacy detection based on the security detection strategy, the source and destination ends of the file transmission are obtained, and the cross-network transmission strategy is determined based on the source and destination ends. Determine whether the determined cross-network transmission policy exists in the cross-network transmission policy library. If it exists, match the file type of the file with the file types allowed by the cross-network transmission policy. If a match is found, the file's security level is compared with the highest allowed file security level in the cross-network transmission policy; if the file's security level does not exceed the highest allowed file security level, the detection passes; otherwise, the detection fails.

6. A cross-domain file transfer system, characterized in that, It includes multiple physical network domains. When a sender transmits a file from its own physical network domain to another physical network domain, file security detection is performed in the physical network domain where the sender is located. If the security check result indicates that the check passed, the file is transferred to another physical network domain. When the receiver in the other physical network domain receives the file, it performs a security check on the received file and persists the file in its own network domain after the check passes. Implementing file security checks includes: Real-time synchronization of security detection strategies across physical network domains, wherein, when synchronizing the security detection strategies, the file type feature database, word similarity dictionary, sensitive word dictionary, virus feature database, and cross-network transmission strategy database of each physical network domain are synchronized. And based on the aforementioned security detection strategy, file type legality detection, sensitive word detection, virus detection, and transmission legality detection are performed; Real-time synchronization of security detection strategies between physical network domains includes: When synchronizing the file type feature library, word similarity dictionary, sensitive word dictionary, and virus feature library, monitor the change data of the feature library and dictionary for any physical network domain. If there is a cross-network transmission policy in this physical network domain, the change data is encapsulated into the first change instruction. Based on the cross-domain transmission strategy, the first change instruction is broadcast to other physical domains reachable from this physical domain, so that local data in other physical domains can be operated on based on the first change instruction; Real-time synchronization of security detection strategies across physical network domains also includes: When performing cross-network transmission policy synchronization, for any physical network domain, monitor the change data of the cross-network transmission policy. If there is a cross-network transmission policy in this physical network domain, read all feature databases and dictionary data of this physical network domain. The change data of the cross-domain transmission strategy and all feature databases and dictionary data of the physical network domain are encapsulated into a second change instruction; The second change instruction is broadcast to other physical domains reachable from this physical domain, so that the original local data in the other physical domains can be operated on based on the second change instruction; and the union of all feature libraries and dictionary data in this physical domain indicated by the second change instruction, as well as the feature libraries and dictionary data in the original local data, is taken; if the data after the union is different from the original local data, a new change instruction is encapsulated based on the changed data.

Images