Method and electronic device for file protection

Abstract

The application provides a file protection method and an electronic device. The method comprises the following steps: detecting an operation of reading a first file and a second file, the first file comprising a first data tag, the first data tag being used to indicate that the first file is a confidential file, and the second file being a non-confidential file; delivering the first file to a key information asset (KIA) process of a target application program, and delivering the second file to a common process of the target application program, the permission of the KIA process being different from the permission of the common process. Based on the above scheme, the electronic device can manage protected files and common files in processes, which is beneficial to managing large-scale protected files and does not affect the normal use of common files, thereby improving the user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and more particularly, to a file protection method and an electronic device. BACKGROUND

[0002] With the rapid development of computer technology, more and more data information is saved in the form of electronic files on computers. Some of the files in the computer are confidential files, and the other part may be only ordinary files, and only the confidential files have the need for confidentiality.

[0003] Currently, a document encryption and decryption method can be used to prevent confidential files from being leaked, but this method is complex for user authentication process, and a complete user management server needs to be built, which is not conducive to the unified management and protection of large-scale confidential files. SUMMARY

[0004] The embodiments of the present application provide a file protection method, which can manage protected files and ordinary files in processes, which is conducive to managing large-scale protected files and does not affect the normal use of ordinary files, thereby improving the user experience.

[0005] In a first aspect, a file protection method is provided, comprising: detecting an operation of reading a first file and a second file, the first file comprising a first data tag, the first data tag being used to indicate that the first file is a confidential file, and the second file being a non-confidential file; delivering the first file to a key information asset (KIA) process of a target application program, and delivering the second file to an ordinary process of the target application program, the permission of the KIA process being different from the permission of the ordinary process.

[0006] It should be understood that the target application program is an application program that can operate on the first file and the second file, for example, the first file and the second file are both files with the extension.doc, and the target application program can be WPS or microsoft word. The ordinary process and the KIA process are two different types of processes created by the electronic device for the target application program, and both can be used for the code of the target application program to run.

[0007] It should be understood that the KIA process is different from the ordinary process, and the KIA process can include a KIA identifier for distinguishing from the ordinary process, so that the electronic device can manage the KIA process or the ordinary process separately, thereby managing the confidential files under the KIA process.

[0008] It should be noted that the permission of the KIA process is generally lower than that of the common process, for example, the KIA process is prohibited from sending a file to an untrusted network, and the KIA process can also be prohibited from performing operations such as printing, copying, exporting, etc. on the file, while the common process will not be limited in these operations.

[0009] In the embodiments of the present application, the KIA process is used to process confidential files, and the common process is used to process non-confidential files. When it is necessary to uniformly manage the confidential files, the permission of the KIA process can be directly modified, for example, when it is necessary to prevent the confidential files from being sent to an untrusted network, the operation of the KIA process for sending the file to the untrusted network can be prohibited. In this way, the confidential files can be uniformly managed, and the common files will not be affected, which is beneficial to improving the user experience.

[0010] With reference to the first aspect, in a possible implementation manner, the KIA process is prohibited from performing an operation of sending a file to an untrusted network.

[0011] In the embodiments of the present application, the confidential files are processed by the KIA process, and by prohibiting the KIA process from performing the operation of sending the file to the untrusted network, the confidential files can be effectively prevented from being leaked, which is beneficial to improving the security of the files.

[0012] With reference to the first aspect, in a possible implementation manner, the method further includes: intercepting a first request message from the KIA process, the first request message being used to request to send the first file to a destination address; if a network of the destination address is an untrusted network, ignoring the first request message; and if the network of the destination address is a trusted network, sending the first file to the destination address.

[0013] In the embodiments of the present application, the confidential files are processed by the KIA process, and by intercepting the operation of the KIA process for requesting to send the file to the untrusted network, the confidential files can be effectively prevented from being leaked, which is beneficial to improving the security of the files.

[0014] With reference to the first aspect, in a possible implementation manner, the KIA process is further prohibited from performing any one or more of the following operations on the file: printing, copying, screen capturing, editing, screen recording, and exporting.

[0015] In the embodiments of the present application, the confidential files are processed by the KIA process, and by prohibiting the KIA process from performing any one or more of the above operations on the file, the confidential files can be effectively prevented from being leaked, which is beneficial to improving the security of the files.

[0016] With reference to the first aspect, in a possible implementation manner, the process of delivering the first file to the key information asset (KIA) process of the target application includes: creating a KIA process for the target application, and delivering the first file to the KIA process.

[0017] With reference to the first aspect, in a possible implementation manner, the method further includes: detecting an operation of reading a third file, the third file including a second data tag, the second data tag being used to indicate that the third file is a confidential file; and delivering the third file to the KIA process.

[0018] In the embodiments of the present application, one KIA process can process multiple confidential files at the same time, thereby uniformly managing the multiple confidential files, which is beneficial to improving the security of the confidential files and improving the user experience.

[0019] With reference to the first aspect, in a possible implementation manner, the method further includes: before delivering the third file to the KIA process, determining that the permission of the third file is the same as the permission of the first file.

[0020] Optionally, the first data tag can also be used to indicate the security level or permission of the first file, and the second data tag can also be used to indicate the security level or permission of the second file.

[0021] In the embodiments of the present application, one KIA process can correspond to multiple confidential files of the same security level, which is beneficial to managing the multiple confidential files and improving the security of the confidential files.

[0022] With reference to the first aspect, in a possible implementation manner, the method further includes: periodically scanning files stored in the electronic device, determining that a fourth file stored in the electronic device is a confidential file; and inserting a third data tag in the fourth file, the third data tag being used to indicate that the fourth file is a confidential file.

[0023] The second aspect provides an electronic device, including one or more processors, one or more memories, and one or more computer programs stored in the one or more memories, the one or more computer programs including instructions that, when executed by the one or more processors, cause the method in any possible implementation manner of the first aspect to be performed.

[0024] The third aspect provides a chip, including a processor and a communication interface, the communication interface being used to receive a signal and transmit the signal to the processor, and the processor processing the signal, so that the method in any possible implementation manner of the first aspect is performed.

[0025] In a fourth aspect, a computer readable storage medium is provided, having stored therein computer instructions, which when executed on a computer cause the method according to any possible implementation of the first aspect to be performed.

[0026] In a fifth aspect, a computer program product is provided, having stored therein instructions, which when executed on a computer cause the computer to perform the method according to any possible implementation of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is a schematic flowchart of a method of file protection provided by an embodiment of the present application.

[0028] Figure 2 is a schematic flowchart of a method of file protection provided by an embodiment of the present application.

[0029] Figure 3 is a schematic flowchart of a method of file protection provided by an embodiment of the present application.

[0030] Figure 4 is a schematic flowchart of a method of file protection provided by an embodiment of the present application.

[0031] Figure 5 is a schematic diagram of setting a data tag of a file provided by an embodiment of the present application.

[0032] Figure 6 is a schematic diagram of a method of file protection provided by an embodiment of the present application.

[0033] Figure 7 is a schematic flowchart of a method of file protection provided by an embodiment of the present application.

[0034] Figure 8 is a schematic diagram of a hardware structure of an apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] The terminology used in the following description of the embodiments herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the embodiments and the appended claims herein, the singular forms "a", "an" and "the" are intended to include both singular and plural forms, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, objects, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, objects, and / or components thereof. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. Expressions such as "at least one of," when preceding the syllables of a list of elements, modify the entire list of elements and do not modify the elements individually.

[0036] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" or "in other embodiments" or "in still other embodiments" in various places throughout this specification are not necessarily all referring to the same embodiment, unless otherwise specifically stated. The terms "comprising," "including," "containing," and "having" and their variations, as used herein, mean "including but not limited to," unless otherwise specifically indicated.

[0037] Embodiments of electronic devices and methods for using such electronic devices are described below. In some embodiments, the electronic device can be a portable electronic device that also contains other functionality such as personal digital assistant and / or music player functionality, such as a mobile phone, a tablet computer, a wearable electronic device with wireless communication capabilities (e.g., a smart watch), etc. Exemplary embodiments of the portable electronic device include, but are not limited to, a portable electronic device running the iOS® operating system, the Android® operating system, the Windows® operating system, the Symbian® operating system, the Blackberry® operating system, the Palm® operating system, or other operating system. The portable electronic device can also be other portable electronic devices, such as a laptop computer, etc. It should also be understood that in other embodiments, the electronic device can not be a portable electronic device, but can be a desktop computer. The portable electronic device can also be other portable electronic devices, such as a laptop computer, etc. It should also be understood that in other embodiments, the electronic device can not be a portable electronic device, but can be a desktop computer.

[0038] A key information asset (KIA) file is an information resource that is owned or controlled by an enterprise and that can bring economic benefit to the enterprise, and the transmission control of the KIA file is an important part of the target of enterprise data leakage.

[0039] With the rapid development of computer technology, more and more data is saved in the form of electronic files on the computer. Some electronic files may have confidentiality requirements, for example, key information asset (KIA) files, KIA files are information resources owned or controlled by an enterprise and can bring economic benefits to the enterprise, and the transmission control of KIA files is an important part of the enterprise data leakage prevention target. While some electronic files may be ordinary files, people need to ensure that confidential files are not leaked while not affecting the normal use of ordinary files. At present, the document encryption and decryption method can be used to prevent confidential files from being leaked, however, this method is complex for user authentication process, and a complete user management server needs to be built, which is not conducive to the unified management and protection of large-scale confidential files.

[0040] The present application provides a file protection method, which can manage protected files and ordinary files in processes, is conducive to managing large-scale protected files, and does not affect the normal use of ordinary files, thereby improving the user experience.

[0041] Figure 1 is a schematic flowchart of a file protection method provided by an embodiment of the present application. As shown in Figure 1 , the method 100 includes:

[0042] S101, detecting an operation of reading a first file.

[0043] In the embodiments of the present application, the user can trigger the operation of reading the first file in various ways. For example, when the user double-clicks to open the first file, the operation of reading the first file can be detected; for example, the user opens the first file in the target application program through the method of "file> open> desktop> first file", the operation of reading the first file can be detected; for example, the user drags the first file to the icon of the target application program, the operation of reading the first file can be detected; for example, the user receives the first file in an application program and selects another application program to open the first file, the operation of reading the first file can be detected; for example, the user sends the first file through the target application program, the operation of reading the first file can also be detected.

[0044] It should be understood that in addition to the above-mentioned operation of reading the first file triggered by the user, the operation of reading the first file can also be triggered by an application program, a piece of code or a process. The following will take an example to specifically explain how to detect the operation of reading the first file.

[0045] For example, when a user double-clicks to open a first file in a file manager, the file manager can pass an intent containing a uniform resource identifier (URI) of the first file to an activity manager service (AMS) in order to select a suitable application for opening the first file. When the intent related to the first file is received, it is considered that the operation of reading the first file is detected.

[0046] It should be understood that the operation of reading the first file can also be detected when other operations are performed on the first file.

[0047] S102, determining whether the first file is a protected file.

[0048] In the embodiments of the present application, the files stored in the electronic device can be divided into two types, one is a protected file, and the other is a normal file. The protected file is generally an internal file or a file with confidentiality requirements, which cannot be sent to an untrusted network; the normal file is a file without confidentiality requirements.

[0049] It should be noted that in the embodiments of the present application, the protected file can also be referred to as a confidential file, and the normal file can also be referred to as a non-confidential file.

[0050] In order to distinguish between protected files and normal files, a data tag can be inserted into the protected file. For example, a first data tag is inserted into the first file to indicate that the first file is a protected file. When determining whether the first file is a protected file, if the first file includes the first data tag, it is determined that the first file is a protected file; if the first file does not include the corresponding data tag, it is determined that the first file is a normal file.

[0051] In some embodiments, a tag of a normal file can also be inserted into the normal file to indicate that the file is a normal file.

[0052] In some embodiments, all files stored in the electronic device are periodically scanned, the protected files are identified, and the corresponding data tags are inserted into the protected files to indicate that the files are protected files.

[0053] In step S102, if the first file is a protected file, step S103 is performed; if the first file is a non-protected file or a normal file, step S104 is performed.

[0054] S103, passing the first file to a first key information asset (KIA) process of a target application.

[0055] In the embodiments of the present application, the target application program is an application program capable of operating on the first file. After detecting the operation of reading the first file, the electronic device can select the corresponding target application program according to the extension name of the first file, or can also pop up an application program selection dialog box to prompt the user to select the target application program, or can also select the application program that opened the first file last time as the target application program. For example, when the first file is a file with the extension name.doc, the target application program can be Microsoft word or WPS. If the default application program for opening the file with the extension name.doc is WPS, the target application program can be WPS. If the application program selection dialog box is popped up, the user can also select Microsoft word as the target application program.

[0056] In the embodiments of the present application, one application program can exist in two types of processes at the same time, one is a KIA process, which is only used for processing protected files, and the other is a normal process, which is only used for processing non-protected files (normal files). The KIA process can have a special identifier (for example, a KIA identifier) to distinguish from the normal process.

[0057] In a possible case, after the target application program is determined, if the target application program has been started and there is a KIA process (for example, a first KIA process), the first file can be delivered to the first KIA process so as to facilitate the target application program to perform subsequent operations on the first file. Or a second KIA process can be created for the target application program, and the first file is delivered to the second KIA process.

[0058] It should be understood that one KIA process can process one file or multiple files, which is not limited in the embodiments of the present application.

[0059] In a possible case, if the target application program is not started, a new KIA process (for example, a first KIA process) is created for the target application program, and then the first file is delivered to the first KIA process so as to facilitate the target application program to operate on the first file.

[0060] It should be noted that delivering the first file to the first KIA process can be understood as delivering the URI of the first file or the storage path of the first file to the first KIA process so as to facilitate the target application program to read the data of the first file according to the URI of the first file or the storage path of the first file.

[0061] In some embodiments, the operation of the first KIA process for sending the first file to the untrusted network is intercepted.

[0062] In some embodiments, the following one or more operations of the first KIA process on the first file are intercepted: printing, copying, screenshot, editing, screen recording, and exporting.

[0063] In the embodiments of the present application, since the KIA process is only used to process the protected file, as long as the KIA process is set to prohibit sending the file to the untrusted network, all protected files can be uniformly managed to prevent the protected files from being leaked. Similarly, the KIA process can also be set to prohibit printing, copying, screenshot, editing, screen recording, and exporting the file, thereby preventing the protected files from being leaked.

[0064] It should be noted that the untrusted network can be a network in the pre-set black list, or the untrusted network can be a network other than the network in the pre-set white list. For example, relative to the intranet of an enterprise, the untrusted network can be the extranet; relative to a local area network, the untrusted network can be a network outside the local area network.

[0065] S104, the first file is passed to the normal process of the target application.

[0066] Since the normal process of the target application is only used to process the normal file, the scheme for the normal process to process the normal file is relatively mature in the prior art, and the related description of step S103 can be referred to, and thus will not be described here.

[0067] Figure 2 is a schematic flowchart of a file protection method provided by the embodiments of the present application. As shown in Figure 2 , the method 200 includes:

[0068] S201, detecting an operation of reading a first file.

[0069] Step S201 is similar to step S101, and the related description of step S101 can be referred to, and thus will not be described here.

[0070] S202, determining whether the first file is a protected file.

[0071] Step S202 is similar to step S102, and the related description of step S101 can be referred to, and thus will not be described here.

[0072] In step S202, if the first file is a protected file, step S203 and step S204 are executed; if the first file is a non-protected file or a normal file, step S205 and step S206 are executed.

[0073] S203, creating a first KIA process for a target application.

[0074] If the first file is a protected file and the target application does not have any KIA process, a first KIA process is created for the target application. Alternatively, in a possible case, if the target application has been started and has a KIA process (e.g., a second KIA process), a new KIA process (e.g., a first KIA process) can be created for the target application based on the settings.

[0075] When the first KIA process is created for the target application, the permissions of the first KIA process can be set. Since the first KIA process is only used to process the protected file, the first KIA process will be set to prohibit sending files to the untrusted network, i.e., the first KIA process does not have the permission to send files to the untrusted network.

[0076] Specifically, each KIA process has a unique process identifier (process ID, PID), which is marked as a KIA process when the KIA process is created. When a process sends a file to the untrusted network, it is identified whether the process is a KIA process, and if so, the operation will be intercepted. Alternatively, each KIA process has an identifier (e.g., a KIA identifier) that is distinguished from ordinary processes, and all processes with the identifier will have the operation of sending files to the untrusted network intercepted.

[0077] In embodiments of the present application, since different protected files can have different security levels, different protected files can have different permissions, for example, the first protected file is prohibited from being sent to the untrusted network, and the second protected file is prohibited from being printed, copied, screened, edited, recorded, and exported, etc. In addition to being prohibited from being sent to the untrusted network. When the first KIA process is created for the target application, the permissions of the first KIA process can be set to be the same as the permissions of the first file.

[0078] For example, when the first file is prohibited from being copied, screened, and recorded in addition to being prohibited from being sent to the untrusted network, the first KIA process will be set to prohibit sending files to the untrusted network and prohibited from being copied, screened, and recorded.

[0079] It should be understood that when the first file has read and print permissions, the first KIA process is set to have read and print permissions, and operations on the first file other than reading and printing will be intercepted.

[0080] In some embodiments, the first data tag of the first file can also indicate the security level of the first file or indicate the permissions of the first file. For example, the first data tag can indicate that the first file has print and edit permissions.

[0081] In one example, the security levels of files can be divided into a first level, a second level, and so on. For example, files of the first level are prohibited from being sent to an untrusted network, and files of the second level are prohibited from being sent to an untrusted network, prohibited from being printed, and prohibited from being edited. The first data tag can indicate whether the security level of the first file is the first level or the second level, thereby indicating the permissions of the first file.

[0082] In some embodiments, when the first KIA process is created for the target application, the permissions or the security level of the first file can be determined according to the first data tag of the first file, and the permissions of the first KIA process can be set according to the permissions or the security level of the first file.

[0083] In some embodiments, when the user opens the first file in the target application, the target application can initiate a request to create a normal process. In this case, the request to create the normal process needs to be intercepted, and the first KIA process is created for the target application.

[0084] S204, passing the first file to the first KIA process.

[0085] Step S204 is similar to step S103, and specific reference can be made to the related description of step S103, which will not be repeated here.

[0086] S205, creating a normal process for the target application.

[0087] As for the scheme of creating a normal process for an application, the prior art is relatively mature, and reference can be made to the related description of step S203, which will not be repeated here.

[0088] S206, passing the first file to the normal process.

[0089] As for the scheme of processing a normal file by a normal process, the prior art is relatively mature, and reference can be made to the related description of step S103, which will not be repeated here.

[0090] Figure 3 is a schematic flowchart of a file protection method provided by an embodiment of the present application. As shown in Figure 3 , the method 300 includes:

[0091] S301, detecting an operation of reading a second file.

[0092] S302, determining whether the second file is a protected file.

[0093] Steps S301 and S302 are similar to steps S101 and S102, and specific reference can be made to the related description of steps S101 and S102, which will not be repeated here.

[0094] If the second file is a protected file, step S303 is performed; if the second file is an unprotected file or a normal file, step S307 is performed.

[0095] S303, it is determined whether the permission of the second file is the same as the permission of the first KIA process (or the first file).

[0096] In the embodiment, it is assumed that the target application program already has the first KIA process for processing the first file, and the application program that opens the second file is also the target application program. At this time, a new KIA process can be created for the target application program to process the second file, or the original first KIA process can be reused to process the first file and the second file.

[0097] In consideration of the fact that different protected files can have different permissions, the same KIA process can be used to process files with the same permission, thereby facilitating the management of a large number of confidential files.

[0098] It should be understood that when the first KIA process is created, the permission of the first KIA process has been set to be the same as the permission of the first file.

[0099] Specifically, it is determined whether the permission of the second file is the same as the permission of the first KIA process. If so, step S304 is performed to pass the second file to the first KIA process. If not, steps S305 and S306 are performed to create a second KIA process for the target application program, and pass the second file to the second KIA process.

[0100] In some embodiments, it can also not be necessary to determine whether the permission of the second file is the same as the permission of the first KIA process (or the first file) before passing the second file to the first KIA process.

[0101] It should be noted that the embodiments of the present application can set one KIA process to correspond to one file, or set one KIA process to correspond to multiple files. The specific correspondence between the KIA process and the file can be implemented based on actual needs, and the embodiments of the present application do not limit this.

[0102] S304, the second file is passed to the first KIA process.

[0103] S305, a second KIA process is created for the target application program.

[0104] S306, the second file is passed to the second KIA process.

[0105] S307, the second file is passed to a normal process.

[0106] The following takes the flow of sending the first file as an example to illustrate how the method provided by the application protects the protected file.

[0107] Figure 4 is a schematic flowchart of the method for file protection provided by an embodiment of the application. As shown in Figure 4 the method 400 includes:

[0108] S401, receiving a first request message from a first process, the first request message requesting to send a first file to a destination address.

[0109] In the embodiment, the first process can be any application process in the electronic device, and the embodiment of the application does not limit this.

[0110] When the first file needs to be sent, the first process needs to send a request message to request a corresponding component in the electronic device to send the first file. When the component receives the request, the subsequent steps S402-S406 are executed.

[0111] In some embodiments, the first request message of the first process is intercepted. That is, when any application process in the electronic device sends a first request message, the first request message is first intercepted, and then it is judged whether the application process is a KIA process. If the application process is a KIA process and the destination address is an untrusted network, the first request message is ignored (for example, the first request message is refused to be forwarded to the corresponding component; or a response information refusing to send the first file is sent to the first process); if the application process is a KIA process and the destination address is a trusted network, the first request message is forwarded to the corresponding component to send the first file to the destination address; or if the application process is a normal process, the first request message is forwarded to the corresponding component to send the first file to the destination address.

[0112] Optionally, a second request message from the first process is received, the second request message being used to request to print the first file.

[0113] Similarly, other operations of the first process on the first file, such as exporting, copying, etc., can be referred to the above description, and will not be described here.

[0114] S402, determining whether the first process is a KIA process.

[0115] Specifically, when the first process includes a KIA identifier, it is determined that the first process is a KIA process, and step S403 is executed. Otherwise, it is determined that the first process is a normal process, and step S406 is executed.

[0116] It should be noted that when the KIA process is created, the KIA identifier can be assigned to distinguish it from a normal process.

[0117] S403, determining whether the network of the destination address is an untrusted network.

[0118] In the embodiments of the present application, the IP addresses of the untrusted networks can be stored in a preset blacklist, or the IP addresses of the trusted networks can be stored in a preset whitelist.

[0119] If the destination address is in the blacklist or not in the whitelist, it is determined that the network of the destination address is an untrusted network, and step S404 is performed. Otherwise, it is determined that the network of the destination address is a trusted network, and step S405 is performed.

[0120] Optionally, after intercepting or receiving the second request message, it is determined whether the first process has a printing permission. If the first process has the printing permission, the first file is printed; otherwise, the first file is refused to be printed, or the second request message is ignored.

[0121] Optionally, if the first process requests a first operation on the first file, after intercepting or receiving a corresponding request message, it is determined whether the first operation is within the permission range of the first process. If the first operation is within the permission range of the first process, the first operation is allowed; otherwise, the first operation is refused or the request is ignored.

[0122] S404, refusing to send the first file to the destination address.

[0123] S405, sending the first file to the destination address.

[0124] S406, sending the first file to the destination address.

[0125] Figure 5 is a schematic diagram of setting a data tag of a file provided by the embodiments of the present application. The asset management process can be used to manage the protected files stored in the electronic device, including requesting a document classification management service to scan the file system, obtaining a file scanning record; identifying the protected files in the file system and delivering them to the document classification management service. The document classification management service can scan the files in the file system, deliver the file scanning record to the asset management process; and set a data tag for the protected files.

[0126] For example, many file systems support creating extended attributes, which can be used to store metadata information of the files, such as tags, descriptions, file permissions, etc. The document classification management service can set a data tag for the files based on the attribute attribute of the file system.

[0127] For example, the document classification management service can insert a data tag in a document format reserved field. For example, 0xAABBCCDD is inserted in the document format reserved field every 16 bytes to indicate that the file is a protected file.

[0128] In some embodiments, the asset management process can periodically request to scan the file system and identify the protected files in the file system. The document classification management service can set the data tag in the protected files in the file system based on the request and the identification result of the asset management process.

[0129] It should be noted that the asset management process can identify whether a file has a confidentiality requirement according to the content of the file. For example, the content of a file includes some pre-set fields, and the file is a protected file. Alternatively, the asset management process can train its ability to identify protected files through machine learning, so as to more accurately identify protected files.

[0130] In some embodiments, the protected files in the file system can also be manually identified by user tagging, and the corresponding data tag can be inserted in the protected files.

[0131] In some embodiments, the document classification management service can also set the permissions of the protected files. For example, printing, copying, editing, screen capture, screen recording, and exporting operations are prohibited.

[0132] It should be noted that information related to the permissions of the protected files can also be set in the data tag.

[0133] It should be noted that at least part of the data tags inserted in different protected files is the same. The same at least part can be used to indicate that the files are protected files, and the remaining different parts can be used to indicate the permissions or confidentiality level of each file. For example, a first file includes a first data tag, a first part of the first data tag is used to indicate that the first file is a protected file, and a second part of the first data tag is used to indicate the permissions or confidentiality level of the first file. A third file includes a second data tag, a first part of the second data tag is used to indicate that the second file is a protected file, and a second part of the second data tag is used to indicate the permissions or confidentiality level of the second file. The first part of the first data tag and the first part of the second data tag can be the same.

[0134] Figure 6 is a schematic diagram of a file protection method provided by an embodiment of the present application. As shown in Figure 6As shown, when the file manager sends a URI of a file to the AMS, the AMS can obtain a data tag of the file from the file system, and if the data tag indicates that the file is a normal file, the file is sent to the normal process of the target application; if the data tag indicates that the file is a protected file, the file is sent to the KIA process of the target application.

[0135] When the network subsystem receives a request to send a file, it can determine which process sends the request, and if the request is sent by the KIA process, the network subsystem needs to determine whether the destination address is an untrusted network. If the destination address is an untrusted network, the KIA process's request to send the file is rejected; if the destination address is a secure network, the KIA process can normally send the file.

[0136] Figure 7 is a schematic flowchart of a method for file protection provided by an embodiment of the present application. As shown, the method 700 includes: Figure 7

[0137] S710, detecting an operation of reading a first file and a second file, the first file including a first data tag.

[0138] S720, passing the first file to the KIA process of the target application, and passing the second file to the normal process of the target application. The first data tag can indicate that the first file is a confidential file; the second file does not include a corresponding data tag to indicate that it is a confidential file, and the second file is a non-confidential file.

[0139] It should be understood that the target application is an application that can operate on the first file and the second file, for example, the first file and the second file are both files with the.doc extension, and the target application can be WPS or microsoft word. The normal process and the KIA process are two different types of processes created by the electronic device for the target application, and both can be used by the code of the target application when running.

[0140] It should be understood that the KIA process is different from the normal process, and the KIA process can include a KIA identifier for distinguishing from the normal process, so that the electronic device can manage the KIA process or the normal process separately, thereby managing the confidential files under the KIA process.

[0141] It should be noted that the permissions of the KIA process are usually lower than those of the normal process, for example, the KIA process is prohibited from sending files to untrusted networks, and the KIA process can also be prohibited from printing, copying, exporting, etc. operations on files, while the normal process is not limited in these operations.

[0142] ​In the embodiments of the present application, the KIA process is used to process confidential files, and the common process is used to process non-confidential files. When it is necessary to uniformly manage the confidential files, the permission of the KIA process can be directly modified. For example, when it is necessary to prevent the confidential files from being sent to an untrusted network, the operation of the KIA process for sending the files to the untrusted network can be prohibited. In this way, the confidential files can be uniformly managed, and the common files will not be affected, which is beneficial to improving the user experience.

[0143] Optionally, the KIA process is prohibited from sending files to an untrusted network.

[0144] Optionally, a first request message from the KIA process is intercepted, the first request message is used to request to send the first file to a destination address, if a network of the destination address is an untrusted network, the first request message is ignored, and if the network of the destination address is a trusted network, the first file is sent to the destination address.

[0145] Optionally, the KIA process is further prohibited from performing any one or more of the following operations on the file: printing, copying, screen capturing, editing, screen recording, and exporting.

[0146] Optionally, the KIA process that delivers the first file to the target application includes: creating a KIA process for the target application, and delivering the first file to the KIA process.

[0147] Optionally, it is detected that an operation of reading a third file is performed, the third file includes a second data tag, and the second data tag is used to indicate that the third file is a confidential file; and the third file is delivered to the KIA process.

[0148] Optionally, before the second file is delivered to the KIA process, it is determined that the permission of the third file is the same as the permission of the first file. Alternatively, it is determined that the security level of the third file is the same as the security level of the first file.

[0149] Optionally, the first data tag is further used to indicate the permission of the first file, and the second data tag is further used to indicate the permission of the third file.

[0150] Figure 8 FIG. 8 is a hardware structure schematic diagram of an apparatus 800 provided in the embodiments of the present application. Figure 8 The apparatus 800 (which can be an electronic device) shown includes a memory 810, a processor 820, a communication interface 830, and a bus 840. The memory 810, the processor 820, and the communication interface 830 are in communication connection with each other through the bus 840.

[0151] The memory 810 can be a ROM, a static storage device, a dynamic storage device, or a RAM. The memory 810 can store a program that, when executed by the processor 820, causes the processor 820 to perform the various steps of the file protection method of the embodiments of the present application.

[0152] The processor 820 can be a general purpose CPU, a microprocessor, an ASIC, a GPU, or one or more integrated circuits that are configured to perform a program to implement the functions required by the units in the apparatus 800 of the embodiments of the present application, or to perform the file protection method of the method embodiments of the present application.

[0153] The processor 820 can also be an integrated circuit chip with a processing capability of signals. In the implementation process, the various steps of the file protection method of the present application can be completed by the integrated logic circuit of hardware in the processor 820 or the instructions in the form of software. The processor 820 described above can also be a general purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware code processor to execute, or a combination of hardware and software modules in the code processor to execute. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, or other mature storage media in the art. The storage medium is located in the memory 810, and the processor 820 reads the information in the memory 810, and combines the hardware to complete the functions required by the units included in the apparatus 800 of the embodiments of the present application, or to perform the file protection method of the method embodiments of the present application.

[0154] The communication interface 830 uses a transceiver such as but not limited to a transceiver to implement the communication between the apparatus 800 and other devices or communication networks.

[0155] The bus 840 can include a path for transmitting information between the various components (e.g., the memory 810, the processor 820, the communication interface 830) of the apparatus 800.

[0156] It should be noted that although Figure 8The apparatus 800 shown only shows the memory, the processor, the communication interface, but in the specific implementation process, those skilled in the art should understand that the apparatus 800 also includes other devices necessary for normal operation. At the same time, according to the specific needs, those skilled in the art should understand that the apparatus 800 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the apparatus 800 can also only include devices necessary for the implementation of the embodiments of the present application, and does not necessarily include all the devices shown in the apparatus 800. Figure 8 The apparatus 800 shown only shows the memory, the processor, the communication interface, but in the specific implementation process, those skilled in the art should understand that the apparatus 800 also includes other devices necessary for normal operation. At the same time, according to the specific needs, those skilled in the art should understand that the apparatus 800 can also include hardware devices for realizing other additional functions. In addition, those skilled in the art should understand that the apparatus 800 can also only include devices necessary for the implementation of the embodiments of the present application, and does not necessarily include all the devices shown in the apparatus 800.

[0157] The embodiments of the present application also provide a chip, which comprises a processor and a communication interface, the communication interface is used for receiving a signal and transmitting the signal to the processor, and the processor processes the signal, so that the method for protecting the file in any possible implementation manner is executed.

[0158] The embodiments of the present application also provide a computer readable storage medium, which stores computer instructions, when the computer instructions run on an electronic device, the electronic device executes the related method steps to realize the method for protecting the file in the above embodiments.

[0159] The embodiments of the present application also provide a computer program product, when the computer program product runs on a computer, the computer executes the related steps to realize the method for protecting the file in the above embodiments.

[0160] In addition, the embodiments of the present application also provide an apparatus, which can be a chip, a component or a module, and the apparatus can comprise a processor and a memory connected to each other; wherein the memory is used for storing computer execution instructions, and when the apparatus runs, the processor can execute the computer execution instructions stored in the memory to make the chip execute the method for protecting the file in the above method embodiments.

[0161] In the above embodiments, according to the context, the term "when" or "after" can be interpreted as meaning "if" or "after" or "in response to determining" or "in response to detecting". Similarly, according to the context, the phrase "after determining" or "if detecting (the stated condition or event)" can be interpreted as meaning "if determining" or "in response to determining" or "after detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)".

[0162] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0163] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0164] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0165] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0166] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0167] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of file protection, characterized by, The method comprises: detecting an operation of reading a first file and a second file, the first file comprising a first data tag, the first data tag being used to indicate that the first file is a confidential file, and the second file being a non-confidential file; delivering the first file to a key information asset (KIA) process of a target application, and delivering the second file to a common process of the target application, the KIA process having different permissions from the common process.

2. The method of claim 1, wherein, The KIA process is prohibited from sending a file to an untrusted network.

3. The method according to claim 1 or 2, characterized in that, The method further comprises: intercepting a first request message from the KIA process, the first request message being used to request sending the first file to a destination address; if a network of the destination address is an untrusted network, ignoring the first request message; if the network of the destination address is a trusted network, sending the first file to the destination address.

4. The method according to claim 1 or 2, characterized in that, The KIA process is further prohibited from performing any one or more of the following operations on a file: printing, copying, screen capturing, editing, screen recording, and exporting.

5. The method according to claim 1 or 2, characterized in that, The delivering the first file to a key information asset (KIA) process of a target application comprises: creating a KIA process for the target application, and delivering the first file to the KIA process.

6. The method of claim 1 or 2, wherein, The method further comprises: detecting an operation of reading a third file, the third file comprising a second data tag, the second data tag being used to indicate that the third file is a confidential file; delivering the third file to the KIA process.

7. The method of claim 6, wherein, The method further comprises: determining, before delivering the third file to the KIA process, that the third file has the same permissions as the first file.

8. The method of any one of claims 1 or 2, 6, wherein, The method further comprises: periodically scanning files stored in an electronic device, and determining that a fourth file stored in the electronic device is a confidential file; inserting a third data tag into the fourth file, the third data tag being used to indicate that the fourth file is a confidential file.

9. An electronic device, comprising: The chip comprises one or more processors; one or more memories; the one or more memories store one or more computer programs, the one or more computer programs comprise instructions, when the instructions are executed by the one or more processors, the method as claimed in any one of claims 1 to 8 is executed.

10. A chip, characterized by The chip comprises a processor and a communication interface, the communication interface is used to receive a signal and transmit the signal to the processor, the processor processes the signal, so that the method as claimed in any one of claims 1 to 8 is executed.

11. A computer readable storage medium characterized by, The computer readable storage medium stores computer instructions, when the computer instructions are run on a computer, the method as claimed in any one of claims 1 to 8 is executed.

12. A computer program product comprising instructions, characterized in that, When the computer program product is run on a computer, the computer executes the method as claimed in any one of claims 1 to 8.

Images