File outbound control method, system, electronic device and storage medium

Abstract

The embodiments of the present invention provide a method, system, electronic device and storage medium for file outbound transmission control, which belongs to the field of file outbound transmission. The method includes: when the process of a third-party application starts running, a DLL file containing an API bypass function is injected into the process; when a user selects a file to attempt to outbound transmission, the API bypass function starts to execute and extracts the parameter information of the API function; the extracted parameter information of the API function is reported to the content recognition component, so that the content recognition component accesses the file to be outbound according to the file path information and determines whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being outbound. By tracking the path information of the outbound file in the file selection stage, the outbound file information can be obtained to the maximum extent, and by using whether the file contains sensitive content as the blocking standard for outbound files, the outbound transmission of the file is intercepted, which further ensures the file security.

Description

Technical Field

[0001] The present invention relates to the technical field of file outbound transmission, and in particular to a file outbound transmission control method, system, electronic device and storage medium. Background Art

[0002] With the continuous improvement of informatization, enterprises and organizations have generated a large number of sensitive files in their daily operations, and the security management of these files has become an urgent problem to be solved. Although traditional means of file outbound control, such as setting access permissions and intercepting specific network protocol data packets, can ensure file security to a certain extent, it is often difficult to fully cover all possible leakage channels, especially through the behavior of users actively selecting files and outbound.

[0003] Moreover, the solution of intercepting outgoing files by setting file access permissions is less flexible, as shown in the following aspects: 1. It is not possible to automatically intercept files based on the fact that the file content contains sensitive text; 2. In order to prevent the application from sending a certain file, the application's permission to read the file content is disabled, making the task granularity too large. The solution of intercepting outgoing files by intercepting network protocol packets has greater limitations, as shown in the following aspects: 1. It is not possible to intercept the way to send files using encrypted protocols; 2. The information obtained from the data packet is very limited, for example, it is difficult or even impossible to obtain the complete path. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method, system, electronic device and storage medium for controlling outbound file transmission, which are used to completely or at least partially solve the technical problems existing in the above-mentioned prior art.

[0005] In order to achieve the above object, an embodiment of the present invention provides a method for controlling file outbound transmission, including:

[0006] When the third-party application process starts running, the DLL file containing the API detour function is injected into the process using a message hook;

[0007] When the user selects a file to send out, the API bypass function starts to execute to extract parameter information of the API function, wherein the parameter information includes file path information;

[0008] The extracted parameter information of the API function is reported to the content identification component, so that the content identification component accesses the file to be sent out based on the file path information and determines whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out.

[0009] Optionally, the Windows operating system provides formally documented API functions for the three methods of copying and pasting, dragging, and file open dialog box in the file selection phase, and the API detour function is represented as a pseudo API function with the same signature as the API function.

[0010] Optionally, when a user selects a file to attempt to send out, before the API bypass function starts to execute to extract parameter information of the API function, the file sending control method further includes:

[0011] During the DLL file initialization phase, the DLL file modifies the bytes of the instructions dumped at the API entry point and writes the instructions to the API detour function so that the detour function is executed before the API function.

[0012] Optionally, after the DLL file is injected into the target process, the file outbound management and control method further includes: the construction process of the springboard function includes:

[0013] The DLL file finds the real address of the file selection API and allocates a memory block in the virtual address space. The hooking of the file selection API occurs after the DLL file is injected.

[0014] The instructions at the API function entry are stored in the memory, and an unconditional jump instruction is added at the end of the stored instructions to point back to the remaining bytes of the original API instructions. An executable protection attribute is added to this memory, and the write protection attribute is removed to obtain a springboard function, wherein the remaining bytes of the original API instructions are represented by the remaining bytes of the instructions that are not modified in the instructions transferred at the DLL file modification API entry.

[0015] Optionally, reporting the extracted parameter information of the API function to the content identification component, so that the content identification component accesses whether the file to be sent out contains sensitive content according to the file path information, and if the file contains sensitive content, blocking the file selection behavior to prevent the file from being sent out, including:

[0016] The extracted parameter information of the API function is reported to the content identification component through RPC, and the content identification component determines the file format through feature matching;

[0017] If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function to block the file selection behavior via RPC.

[0018] If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are found, the springboard function is notified via RPC to block the file selection behavior.

[0019] If the file is a compressed file, it will be recursively decompressed to check the compressed file. If the compressed file is encrypted or in an unknown file format, the administrator will be notified.

[0020] On the other hand, the present invention also provides a file outbound management and control system, comprising:

[0021] The injection unit is used to inject the DLL file containing the API detour function into the process of the third-party application by using a message hook when the process starts running;

[0022] An extraction unit, used for, when a user selects a file to attempt to send out, the API bypass function starts to execute, so as to extract parameter information of the API function, wherein the parameter information includes file path information;

[0023] The identification unit is used to report the parameter information of the extracted API function to the content identification component, so that the content identification component can access the file to be sent out according to the file path information and determine whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out.

[0024] Optionally, the file outbound management system further includes a construction unit for constructing a springboard function:

[0025] The DLL file finds the real address of the file selection API and allocates a memory block in the virtual address space. The hooking of the file selection API occurs after the DLL file is injected.

[0026] The instructions at the API function entry are stored in the memory, and an unconditional jump instruction is added at the end of the stored instructions to point back to the remaining bytes of the original API instructions. An executable protection attribute is added to this memory, and the write protection attribute is removed to obtain a springboard function, wherein the remaining bytes of the original API instructions are represented by the remaining bytes of the instructions that are not modified in the instructions transferred at the DLL file modification API entry.

[0027] Optionally, the identification unit is specifically used for:

[0028] The extracted parameter information of the API function is reported to the content identification component through RPC, and the content identification component determines the file format through feature matching;

[0029] If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function to block the file selection behavior via RPC.

[0030] If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are found, the springboard function is notified via RPC to block the file selection behavior.

[0031] If the file is a compressed file, it will be recursively decompressed to check the compressed file. If the compressed file is encrypted or in an unknown file format, the administrator will be notified.

[0032] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned file outbound control method when executing the program.

[0033] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned file outbound control method are implemented.

[0034] Through the above technical solution, the path information of outgoing files can be tracked during the file selection stage, which can maximize the acquisition of outgoing file information. In addition, by using whether the file contains sensitive content as the outgoing file blocking standard, outgoing files can be intercepted and automatically intercepted, thereby further ensuring file security.

[0035] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0037] Figure 1 It is an implementation flow chart of a method for controlling outbound file transmission provided by an embodiment of the present invention;

[0038] Figure 2 These are the four stages that a file goes through before being sent to the Internet, as provided by an embodiment of the present invention;

[0039] Figure 3 It is a detailed implementation flow chart of a method for controlling outbound file transmission provided by an embodiment of the present invention;

[0040] Figure 4 It is a structural diagram of a file outbound management and control system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0042] See also Figure 1 As shown, it is a flowchart of an implementation method of a file outbound control method provided by an embodiment of the present invention, including the following execution steps:

[0043] Step 100: When the process of the third-party application starts running, a DLL file containing the API detour function is injected into the process by using a message hook.

[0044] In some embodiments, the Windows operating system provides formally documented API functions (as shown in Table 1) for the three methods of copying and pasting, dragging, and file open dialog box in the file selection phase, and the API detour function is characterized as a pseudo API function with a signature consistent with the API function.

[0045] Table 1 Officially documented APIs

[0046]

[0047] The IDropSource, IDropTarget, and IFileOpenDialog in the table are actually some COM interfaces, similar to classes in C++ language. The COM objects created by them contain a pointer to a virtual function table. Each item in the virtual function table points to a virtual function. These virtual functions are similar to traditional API functions, but they are not in the export table of the DLL module.

[0048] It should be understood that a typical Windows application goes through four stages before sending a file to the Internet. Figure 2 As shown:

[0049] ① File selection stage: In this stage, the user needs to let the application "understand" which file or files (folders) to send. There are generally three ways: copy and paste, drag and drop, and file open dialog box. Information about the file path can be obtained through "API interception" technology.

[0050] ② File opening stage: When an application attempts to open a file object, the operating system requires the application to indicate the "expected access rights". The access rights identifiers for the file object include: read data, read attributes, write data, write attributes, synchronization, etc., but there is no "outgoing" permission identifier. By setting file access rights, interception can be performed at this stage (with the help of the operating system's security reference monitor).

[0051] ③File reading stage: The application will read the file content into the memory and may encrypt it.

[0052] ④ Packet encapsulation stage: The application may choose (or not use) an application layer protocol (FTP / FTPS, HTTP / HTTPS, etc.) for file transfer. The protocol may or may not support plain text transmission. In addition to transmitting the file content, the file name and other information are generally transmitted, but the local path of the file is usually not transmitted (because it is meaningless to the receiving end). The solution of intercepting outgoing files by "intercepting network protocol packets" is implemented at this stage.

[0053] Step 101: When a user selects a file to send out, the API bypass function starts to execute to extract parameter information of the API function, wherein the parameter information includes file path information.

[0054] In some implementations, before executing step 101, the following steps are further executed: During the DLL file initialization phase, the DLL file modifies the bytes of the instructions dumped at the API entry to write instructions that jump to the API detour function, so that the detour function is executed before the API function.

[0055] The detour function and the API function have the same function front-end. The reason for this is that the detour function can access the parameters of the API function just like accessing its own parameters, without having to waste energy to prevent the thread stack from being damaged. In addition, these parameters must contain file path information.

[0056] In some implementations, after the DLL file is injected into the target process, the file outbound management method further performs the following steps: The construction process of the springboard function includes the following steps:

[0057] S1: Hooking the file selection API occurs after the DLL file is injected. The DLL file first finds the real address of the file selection API and then allocates a piece of memory in the virtual address space.

[0058] S2: Store the instruction at the API function entry into the memory, and add an unconditional jump instruction at the end of the stored instruction to point back to the remaining bytes of the original API instruction, add an executable protection attribute to this memory, and remove the write protection attribute to obtain the springboard function, wherein the remaining bytes of the original API instruction are represented by the remaining bytes of the instruction that are not modified in the instruction transferred at the DLL file modification API entry.

[0059] In some implementations, the total length of the instructions at the entry of the overwritten API function only needs to be enough to accommodate an unconditional jump instruction (5 bytes). The instructions at the entry of the API function are usually used to save some register values ​​on the stack to facilitate restoring the register content after the function is executed. For example, on a certain version of Windows system, the instructions at the entry of the GetClipboardData function (taking 64-bit user32.dll as an example) are as follows: mov [rsp-38h+40h], rbx; push rbp; push rsi; push rdi.

[0060] Step 102: Report the extracted parameter information of the API function to the content identification component, so that the content identification component accesses the file to be sent out based on the file path information and determines whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out.

[0061] Specifically, when executing step 102, the following steps may be specifically performed:

[0062] S1020: Report the extracted parameter information of the API function to the content recognition component through RPC, and the content recognition component determines the file format through feature matching.

[0063] S1021: If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function in RPC to block the file selection behavior.

[0064] S1022: If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are hit, the springboard function is notified in an RPC manner to block the file selection behavior.

[0065] S1023: If the file is a compressed file, recursively decompress and check the compressed file. If the compressed file is encrypted or in an unknown file format, notify the administrator.

[0066] See also Figure 3 As shown, it is a detailed implementation flow chart of a method for controlling outbound file transmission provided by an embodiment of the present invention, including:

[0067] S1: Hook file selection API;

[0068] S2: The user selects a file and attempts to send it out;

[0069] S3: API detour function starts execution;

[0070] S4: extract file path information;

[0071] S5: Determine whether the query content identification component needs to be blocked, if not, execute step S6, then execute S7, if yes, execute step S7;

[0072] S6: Call the actual file selection API;

[0073] S7: API detour function ends execution;

[0074] S8: Determine whether the detour function returns successfully, if so, execute step S9, otherwise, execute step S10;

[0075] S9: read the file content and send it;

[0076] S10: Determine whether a DLL uninstallation notification is received, if so, execute step S11, otherwise, execute S2 in a loop;

[0077] S11: Unhook the API.

[0078] In some embodiments, Figure 3 The real file selection API described in the description is the springboard function. Next, the DLL will modify the instructions that are transferred at the API entry point, so that it will immediately jump to the pseudo API function address prepared in the DLL and with the same signature as the API function. Then the real API instructions can be executed through the springboard function (if the behavior needs to be intercepted, the springboard function can also be not executed). This looks like letting the original API take a detour, so these pseudo API functions are figuratively called detour functions. In this way, when the user tries to select a file, the original program flow (that is, the thread) of the application will be executed to the entry point of the API function according to the original process. At this time, the detour function will be executed before the API function, and there will be a chance to collect information before the file is sent out.

[0079] When a user sends a file through an application, the first thing to do is to select the file to be sent. This allows the user to obtain maximum information about the file and implement interception based on various criteria. As the process progresses, less and less information can be extracted. Once the file content is read into the memory, it will be difficult to associate it with the disk file. Even if sensitive content is identified and the outbound request is rejected, it will be difficult to report "which file" the application is trying to send. In addition, when the data stream is encrypted (the encryption operation may be implemented by the application itself or the network protocol), it will no longer be possible to implement interception of file outbound transmission based on file content.

[0080] See also Figure 4 FIG. 1 is a schematic diagram of a structure of a file outbound control system provided by an embodiment of the present invention, including:

[0081] The injection unit 40 is used to inject the DLL file containing the API detour function into the process of the third-party application by using a message hook when the process starts to run;

[0082] The extraction unit 41 is used for, when the user selects a file to be sent out, the API bypass function starts to execute, so as to extract parameter information of the API function, wherein the parameter information includes file path information;

[0083] The identification unit 42 is used to report the extracted parameter information of the API function to the content identification component, so that the content identification component accesses the file to be sent out according to the file path information and determines whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out.

[0084] In some implementations, the file outbound management system further includes a construction unit for constructing a springboard function:

[0085] The DLL file finds the real address of the file selection API and allocates a memory block in the virtual address space. The hooking of the file selection API occurs after the DLL file is injected.

[0086] The instructions at the API function entry are stored in the memory, and an unconditional jump instruction is added at the end of the stored instructions to point back to the remaining bytes of the original API instructions. An executable protection attribute is added to this memory, and the write protection attribute is removed to obtain a springboard function, wherein the remaining bytes of the original API instructions are represented by the remaining bytes of the instructions that are not modified in the instructions transferred at the DLL file modification API entry.

[0087] Specifically, the identification unit is specifically used for:

[0088] The extracted parameter information of the API function is reported to the content identification component through RPC, and the content identification component determines the file format through feature matching;

[0089] If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function to block the file selection behavior via RPC.

[0090] If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are found, the springboard function is notified via RPC to block the file selection behavior.

[0091] If the file is a compressed file, it will be recursively decompressed to check the compressed file. If the compressed file is encrypted or in an unknown file format, the administrator will be notified.

[0092] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the file outbound control method described in any one of the above embodiments when executing the program.

[0093] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned file outbound control methods are implemented.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0098] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0099] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for controlling outbound file transmission, characterized in that: include: When the third-party application process starts running, the DLL file containing the API detour function is injected into the process using a message hook; When the user selects a file to send out, the API bypass function starts to execute to extract parameter information of the API function, wherein the parameter information includes file path information; Reporting the extracted parameter information of the API function to the content identification component, so that the content identification component accesses the file to be sent out according to the file path information and determines whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out; Wherein, the API detour function is characterized as a pseudo API function consistent with the API function signature; After the DLL file is injected into the target process, the file outbound management and control method further includes: a springboard function construction process, including: The DLL file finds the real address of the file selection API and allocates a memory block in the virtual address space. The hooking of the file selection API occurs after the DLL file is injected. The instructions at the API function entry are stored in the memory, and an unconditional jump instruction is added at the end of the stored instructions to point back to the remaining bytes of the original API instructions. An executable protection attribute is added to this memory, and the write protection attribute is removed to obtain a springboard function, wherein the remaining bytes of the original API instructions are represented by the remaining bytes of the instructions that are not modified in the instructions transferred at the DLL file modification API entry.

2. The method for controlling outbound file transmission according to claim 1, characterized in that: The Windows operating system provides formally documented API functions for the three methods of copying and pasting, dragging and dropping, and the file open dialog box in the file selection stage.

3. The file outbound control method according to claim 1 is characterized in that: When the user selects a file to be sent out, the API bypass function starts to execute to extract parameter information of the API function. The file sending control method further includes: During the DLL file initialization phase, the DLL file modifies the bytes of the instructions dumped at the API entry point and writes instructions to jump to the API detour function so that the detour function is executed before the API function.

4. The method for controlling outbound file transmission according to claim 1, characterized in that: Reporting the extracted parameter information of the API function to the content identification component, so that the content identification component can access the file to be sent out based on the file path information to determine whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out, including: The extracted parameter information of the API function is reported to the content identification component through RPC, and the content identification component determines the file format through feature matching; If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function to block the file selection behavior via RPC. If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are found, the springboard function is notified via RPC to block the file selection behavior. If the file is a compressed file, it will be recursively decompressed to check the compressed file. If the compressed file is encrypted or in an unknown file format, the administrator will be notified.

5. A file outbound control system, characterized in that: include: The injection unit is used to inject the DLL file containing the API detour function into the process of the third-party application by using a message hook when the process starts running; An extraction unit, used for, when a user selects a file to attempt to send out, the API bypass function starts to execute, so as to extract parameter information of the API function, wherein the parameter information includes file path information; The identification unit is used to report the extracted parameter information of the API function to the content identification component, so that the content identification component can access the file to be sent out according to the file path information and determine whether it contains sensitive content. If it contains sensitive content, the file selection behavior is blocked to prevent the file from being sent out; Wherein, the API detour function is characterized as a pseudo API function consistent with the API function signature; The file outbound management system further includes a construction unit for constructing a springboard function: The DLL file finds the real address of the file selection API and allocates a memory block in the virtual address space. The hooking of the file selection API occurs after the DLL file is injected. The instructions at the API function entry are stored in the memory, and an unconditional jump instruction is added at the end of the stored instructions to point back to the remaining bytes of the original API instructions. An executable protection attribute is added to this memory, and the write protection attribute is removed to obtain a springboard function, wherein the remaining bytes of the original API instructions are represented by the remaining bytes of the instructions that are not modified in the instructions transferred at the DLL file modification API entry.

6. The file outbound control system according to claim 5, characterized in that: The identification unit is specifically used for: The extracted parameter information of the API function is reported to the content identification component through RPC, and the content identification component determines the file format through feature matching; If the file is a text file, search for sensitive words in the text content. If a sensitive word is found, notify the springboard function to block the file selection behavior via RPC. If the file is an image file, the text information in the image is extracted using OCR technology, and sensitive words are searched. If sensitive words are found, the springboard function is notified via RPC to block the file selection behavior. If the file is a compressed file, it will be recursively decompressed to check the compressed file. If the compressed file is encrypted or in an unknown file format, the administrator will be notified.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the file outbound control method as described in any one of claims 1 to 4 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the file outbound control method as described in any one of claims 1 to 4 are implemented.

Images