File management method, system and device, storage medium and program product

Abstract

The invention discloses a file management method, system and device, a storage medium and a program product, and relates to the technical field of information security, and the method comprises the steps: receiving and safely processing a file viewing request of a user through an SASE system, forwarding the file viewing request to a cloud desktop system through a preset security protocol, and achieving fine-grained security control and efficient management. The processed file viewing request sent by the SASE system is received through the cloud desktop system, the processed file viewing request is responded through the virtual desktop infrastructure VDI client, the corresponding file is inquired, it is ensured that the file is only viewed in a production network and does not fall to an office network, and data security is improved. According to the scheme, SASE and cloud desktop technologies are fused, a zero-trust access strategy is executed, and the whole-process safety of file transmission and use is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a file management method, system, device, storage medium and program product. Background Art

[0002] In the banking industry, networks are usually divided into production networks (business networks) and office networks, and are strictly isolated and managed. The production network is the business production environment and the bank's service transaction system. The office network is the internal daily office system.

[0003] In the production network of a bank, a large number of key systems are generally running, which have extremely high requirements for data security. If the data of the production network is leaked, it will pose a great threat to the security operation.

[0004] At present, when the banking industry conducts various businesses, if it needs to extract data files from the production network, it usually uploads attachments on the production network when submitting an application, and the application form is exported to the office network after approval by the leader. When the leader approves the application form, it is mostly approved on the office network. If you need to view the file content during the approval process, you need to preview or download the file to view the relevant content. At this time, the file of the production network has been downloaded to the office network during the approval process, and there may be a situation where the approval is rejected midway during the application form approval process. In other words, the application has not been approved, but the file of the production network has been exported to the office network, which poses a risk of data leakage.

[0005] Therefore, a method is urgently needed to enable approval personnel to view production network files directly on the office network without having to export them to the office network, thereby resolving the risk of production network files being easily leaked. Summary of the invention

[0006] The main purpose of this application is to provide a file management method, system, device, storage medium and program product, aiming to solve the technical problem that production network files are easily leaked.

[0007] To achieve the above objectives, the present application proposes a file management method, which is applied to a secure access edge SASE system, and the method includes:

[0008] Receive a file viewing request sent by a user;

[0009] Performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request;

[0010] The processed file viewing request is sent to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request and responds to the processed file viewing request through the virtual desktop VDI client to query the corresponding file.

[0011] In one embodiment, the step of performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request includes:

[0012] Verify whether the user information corresponding to the file viewing request matches the preset whitelist;

[0013] If yes, then performing differentiated behavior recording and auditing on the user information corresponding to the file viewing request to obtain an audit result;

[0014] Through the preset security mechanism, analyze the audit results to see whether there is malicious threat information;

[0015] If so, terminate the request to view the file;

[0016] If it does not exist, the file viewing request is encrypted to obtain a processed file viewing request.

[0017] In addition, to achieve the above purpose, the present application also proposes a file management method, which is applied to a cloud desktop system and includes:

[0018] Receiving a processed file viewing request sent by a secure access edge (SASE) system, wherein the processed file viewing request is obtained based on identity authentication and information security processing performed by the SASE system on the file viewing request;

[0019] The virtual desktop VDI client responds to the processed file viewing request and queries the corresponding file.

[0020] In one embodiment, after the step of responding to the processed file viewing request and querying the corresponding file through the virtual desktop VDI client, the method further includes:

[0021] Receiving a secondary query file request sent by a user, and based on the secondary query file request, connecting the VDI client to a terminal using a preset communication protocol;

[0022] The file is transmitted to the terminal through the VDI client so that the user can download and browse the file through the terminal.

[0023] In one embodiment, after the step of receiving the secondary file query request sent by the user, the method further includes:

[0024] Sending a login authentication request to the user, so that the user can perform an account information login operation on the VDI client based on the login authentication request;

[0025] Receiving account information input by a user, and verifying whether the account information input by the user meets the access requirements based on a preset password policy;

[0026] If it is satisfied, then set the preset access time limit;

[0027] If the user does not operate the VDI client within the preset access time limit, the access session of the VDI client is terminated.

[0028] In one embodiment, the step of connecting the VDI client to the terminal using a preset communication protocol based on the secondary query file request includes:

[0029] Performing secondary identity authentication and encryption processing on the secondary query file request to obtain an encrypted secondary query file request;

[0030] If the encrypted secondary query file passes the identity authentication, the encrypted secondary query file that passes the identity authentication is transmitted to the VDI client through the SSL channel using a preset communication protocol.

[0031] In one embodiment, before the step of transferring the file to the terminal through the VDI client, the method further includes:

[0032] A terminal access security policy is set to identify whether the terminal satisfies the terminal access security policy. If so, the VDI client is allowed to transmit the watermarked file to the terminal.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a file management system, which includes a SASE system and a cloud desktop system; the SASE system includes:

[0034] A receiving module, used for receiving a file viewing request sent by a user;

[0035] A processing module, used for performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request;

[0036] A sending module, used to send the processed file viewing request to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request, and responds to the processed file viewing request through a virtual desktop VDI client to query the corresponding file;

[0037] The cloud desktop system includes:

[0038] A receiving module, configured to receive a processed file viewing request sent by a secure access edge SASE system, wherein the processed file viewing request is obtained based on identity authentication and information security processing performed by the SASE system on the file viewing request;

[0039] The query module is used to respond to the processed file viewing request through the virtual desktop VDI client and query the corresponding file.

[0040] In addition, to achieve the above objectives, the present application also proposes a file management device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the file management method described above.

[0041] In addition, to achieve the above objectives, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the file management method described above are implemented.

[0042] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the file management method described above are implemented.

[0043] The embodiments of the present application provide a file management method, system, device, storage medium and program product. The method receives and securely processes user file viewing requests through the SASE system, and forwards them to the cloud desktop system using a preset security protocol to achieve fine-grained security control and efficient management. The cloud desktop system receives the processed file viewing request sent by the secure access edge SASE system, and responds to the processed file viewing request through the virtual desktop infrastructure VDI client, queries the corresponding files, and ensures that the files are only viewed within the production network and not on the office network, thereby improving data security. This solution integrates SASE and cloud desktop technologies, implements a zero-trust access policy, and ensures the security of file transmission and use throughout the process. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0046] Figure 1 This is a schematic diagram of the production network DMZ area deployment involved in this application file management method;

[0047] Figure 2 A flowchart of the first embodiment of the application file management method is provided;

[0048] Figure 3 A flowchart of the second embodiment of the application file management method is provided;

[0049] Figure 4 A flowchart of the third embodiment of the application file management method is provided;

[0050] Figure 5 A flowchart of the fourth embodiment of the application file management method is provided;

[0051] Figure 6 A schematic diagram of setting session duration provided in Embodiment 4 of the present application;

[0052] Figure 7 A flowchart of the fifth embodiment of the application file management method is provided;

[0053] Figure 8 A schematic diagram of screen watermark settings provided in Embodiment 5 of the present application;

[0054] Fig. 9 A schematic diagram of the system deployment of the file management method provided in Embodiment 1 and Embodiment 2 of the present application;

[0055] Fig.10 This is a schematic diagram of the module structure of the file management system of the embodiment of the present application;

[0056] Fig.11 Schematic diagram of the device structure of the hardware operating environment involved in the file management method in the embodiment of the present application.

[0057] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0058] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0059] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0060] The main solution of the embodiment of the present application is: receiving a file viewing request sent by a user through a SASE system; performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request; sending the processed file viewing request to a cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request, and responds to the processed file viewing request through a virtual desktop VDI client to query the corresponding file. Receive the processed file viewing request sent by a secure access edge SASE system through a cloud desktop system, the processed file viewing request is obtained based on the identity authentication and information security processing performed by the SASE system on the file viewing request; respond to the processed file viewing request through a virtual desktop VDI client to query the corresponding file.

[0061] At present, when the banking industry conducts various businesses, if it needs to extract data files from the production network, it usually uploads attachments on the production network when submitting an application, and the application form is exported to the office network after approval by the leader. When the leader approves the application form, it is mostly approved on the office network. If you need to view the file content during the approval process, you need to preview or download the file to view the relevant content. At this time, the file of the business network has been downloaded to the office network during the approval process, and there may be a situation where the approval is rejected midway during the application form approval process. In other words, the application has not been approved, but the file of the business network has been exported to the office network, which poses a risk of data leakage.

[0062] The present application provides a solution, which includes receiving a file viewing request sent by a user through a SASE system; performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request; sending the processed file viewing request to a cloud desktop system through a preset security protocol channel, and realizing more detailed security control through SASE technology, thereby realizing higher security and higher management efficiency; receiving a processed file viewing request sent by a secure access edge SASE system through a cloud desktop system, wherein the processed file viewing request is obtained based on the identity authentication and information security processing performed by the SASE system on the file viewing request; responding to the processed file viewing request through a VDI client, querying corresponding files, ensuring that the files are only viewed in the production network and not in the office network, thereby improving data security; receiving a secondary query file request sent by a user, and based on the secondary query file request, connecting the VDI client to a terminal using a preset communication protocol; transmitting the files to the terminal through the VDI client, so that the user can download and browse the files through the terminal, and viewing the files through the cloud desktop, thereby ensuring that the business files in the production network are only viewed in the production network and are not in the office network, thereby improving the security and controllability of the production network data. The solution combines SASE technology with cloud desktops to ensure the security of files during transmission and use, and implement a zero-trust network access strategy.

[0063] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, etc. The following takes a personal computer as an example to illustrate this embodiment and the following embodiments.

[0064] In addition, it should be noted that in this embodiment, both the SASE system and the cloud desktop system are deployed in the DMZ (Demilitarized Zone) area of ​​the production network. Figure 1 As shown, Figure 1The following is a diagram of the deployment of the DMZ area of ​​the production network. The DMZ area of ​​the production network is a special network area located between the internal network and the external network. It realizes the separation of the internal and external networks and provides a restricted and controlled environment. Servers that are allowed to provide services to the outside are usually placed in this area, thereby protecting the security of the internal network to a certain extent. In addition, the production network usually has higher bandwidth, lower latency and a more stable network environment, which can ensure the efficient operation and high availability of the server. The systems in the DMZ of the production network usually only open necessary service ports, such as Web servers, mail servers, etc., and provide specific functions to the outside world. This can provide targeted protection and reduce the attack surface. The network traffic in the DMZ area of ​​the production network is easier to monitor, which is convenient for detecting abnormal behaviors and potential threats, and is convenient for rapid response and processing. The system in the DMZ of the production network can be updated and maintained independently of the production network, which will not affect the stability of the core business. The production network usually has a dedicated operation and maintenance team to monitor and maintain it 7*24 to ensure that problems are solved in a timely manner.

[0065] Based on this, the embodiment of the present application provides a file management method, which is applied to the SASE system. Figure 2 , Figure 2 This is a flowchart of the first embodiment of the file management method of this application.

[0066] In this embodiment, the file management method includes steps S10 to S30:

[0067] Step S10, receiving a file viewing request sent by a user;

[0068] Optionally, the SASE system first receives a file viewing request from a user terminal, where the file viewing request includes but is not limited to user identity information and other necessary access parameters.

[0069] Step S20, performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request;

[0070] Optionally, when the SASE system receives a request to view a file, it performs user authentication. This step ensures that only authorized users can access resources in the system. The authentication process does not assume that the internal network is secure, but rather verifies all network traffic and only allows authenticated and authorized communications. After authentication, the SASE system performs information security processing on the request to view the file, including but not limited to data encryption and the application of transmission security protocols to ensure the security of data during transmission and encrypt communications from users to the SASE system and the cloud desktop system.

[0071] In a feasible implementation, step S20 may include steps S21 to S25:

[0072] Step S21, verifying whether the user information corresponding to the file viewing request matches a preset whitelist;

[0073] Optionally, since the built-in firewall of the SASE system only whitelists designated users, the built-in firewall verification check checks the user information carried in the file request, such as user name, IP address, device ID, etc., to see if this information exists in the preset whitelist. In this step, the SASE system uses software-defined perimeters, a technology for implementing zero-trust network access, which transfers network perimeters from physical devices to software, dynamically creates and manages network perimeters, and only allows authenticated users and devices to access specific resources. Through micro-segmentation and the principle of least privilege, access to network resources is dynamically controlled.

[0074] Step S22: If yes, then differentiated behavior records and audits are performed on the user information corresponding to the file viewing request to obtain audit results;

[0075] Optionally, the SASE system will record and audit the behavior of successful file viewing requests that match the whitelist. This includes login time, access frequency, and operation type, such as reading, modifying, and deleting files. This step facilitates subsequent security analysis and event tracking by providing detailed access logs. At the same time, auditing can help identify abnormal behavior and discover potential security threats in a timely manner.

[0076] In addition, the threat protection capabilities built into the SASE system can detect and prevent potential network threats in real time.

[0077] Step S23, analyzing the audit results to see if there is any malicious threat information through a preset security mechanism;

[0078] Optionally, SASE uses the IPS (Intrusion Prevention System) security mechanism to analyze the audit results to detect whether there is malicious threat intrusion information such as zombies and Trojans in the audit results, and respond in a certain way, including but not limited to blocking or discarding data packets, resetting TCP (Transmission Control Protocol) connections, changing filtering rules or security policies, etc., to terminate the intrusion behavior in real time and protect the system and network architecture from damage.

[0079] Step S24, if it exists, terminate the file viewing request;

[0080] If the audit results reveal malicious threat intrusion information, the SASE system will immediately block the request to view the file to prevent further data exposure or system damage.

[0081] Step S25: If it does not exist, encrypt the file viewing request to obtain a processed file viewing request.

[0082] Optionally, if the audit results do not contain any malicious threat intrusion information, SSL encryption is performed on the file viewing requests that pass all security checks. Among them, the SASE system has the ability to fully control SSL encrypted content, and supports the identification, control, and auditing of content encrypted by SSL, such as supporting keyword-based filtering of SSL (Secure Sockets Layer) / TLS (Transport Layer Security) encrypted search behavior auditing SSL encrypted content. Whether it is SSL full encryption or TLS semi-encryption, SASE can identify, filter, and audit it.

[0083] Through the above steps, the SASE system provides powerful capabilities in secure access control. It can not only effectively defend against external attacks, but also monitor and manage the behavior of internal users, and perform information security processing on file viewing requests, including but not limited to data encryption and the application of transmission security protocols, to ensure the security of data during transmission.

[0084] Step S30, sending the processed file viewing request to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request, and responds to the processed file viewing request through the virtual desktop VDI client to query the corresponding file.

[0085] Optionally, the processed file viewing request is sent to the cloud desktop system using https, and the cloud desktop system responds to the processed file viewing request to the user terminal through a VDI (Virtual Desktop Infrastructure) client. The VDI client is the interface between the user and the cloud desktop system, responsible for presenting the file content and managing the interaction between the user and the cloud desktop. After responding to the processed file viewing request, the cloud desktop system queries the corresponding file and sends the file content to the user terminal through the VDI client, and the user can view the corresponding file on his device.

[0086] Through the above steps, SASE moves security functions (such as firewalls, SSL / TLS termination, content filtering, etc.) to the edge of the network, close to users and cloud services. This is especially important in cloud environments because data traffic no longer passes directly through the central data center, but through the secure edge, reducing latency and improving performance.

[0087] To summarize, in the above embodiment method, a file viewing request sent by a user is received through the SASE system; identity authentication and information security processing are performed on the file viewing request to obtain a processed file viewing request; the processed file viewing request is sent to the cloud desktop system through a preset security protocol channel, and more detailed security control is achieved through SASE technology, thereby achieving higher security and higher management efficiency.

[0088] Based on this, the embodiment of the present application also provides a file management method, which is applied to the cloud desktop system, referring to Figure 3 , Figure 3 This is a flowchart of the second embodiment of the file management method of this application.

[0089] In this embodiment, the file management method includes steps S40 to S50:

[0090] Step S40, receiving a processed file viewing request sent by a secure access edge SASE system, wherein the processed file viewing request is obtained based on identity authentication and information security processing performed by the SASE system on the file viewing request;

[0091] Optionally, the cloud desktop system receives a query file request from the SASE system. This query file request is formed after the SASE system performs a series of identity authentication and security checks, including user identity authentication, behavior auditing, and necessary encryption processing.

[0092] Step S50, responding to the processed file viewing request through the virtual desktop VDI client to query the corresponding file.

[0093] It should be noted that VDI (Virtual Desktop Infrastructure Client) is used to access and interact with the virtual desktop environment located on a remote server, allowing users to connect to the remote virtual desktop through the network and provide a user experience similar to that of using a local computer, including access to applications, files and resources.

[0094] Optionally, according to the file ID or path contained in the processed file viewing request, the cloud desktop system searches for a corresponding file in the backend storage, and the file is transmitted to the terminal through the VDI client for the user to browse and download.

[0095] Through the above-mentioned embodiment method, specifically, the processed file viewing request sent by the secure access edge SASE system is received through the cloud desktop system, and the processed file viewing request is responded to through the virtual desktop infrastructure VDI client, and the corresponding file is queried to ensure that the file is only viewed in the production network and not on the office network, thereby improving data security.

[0096] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above-mentioned second embodiment can refer to the above introduction, and will not be repeated in the following. Figure 4 After step S50, the file management method further includes steps S60 to S70:

[0097] Step S60, receiving a secondary query file request sent by a user, and based on the secondary query file request, connecting the VDI client to a terminal using a preset communication protocol;

[0098] It should be noted that in order to prevent attackers from obtaining communication data between the terminal and the cloud desktop through network sniffing, the cloud desktop uses HTTPS to encrypt and protect the account information of terminal access, and users can also use the HTTPS protocol to log in to the cloud desktop platform. The HTTPS protocol is used by default to log in to the cloud desktop platform.

[0099] Optionally, after finding the corresponding file, the cloud desktop system will check the user's access rights again by connecting the VDI client to the terminal to ensure that the user has the right to access the requested file. The VDI client and the terminal use the VDC (Virtual Delivery Controller) proxy mode for data transmission, including sending a secondary query file request and receiving the login information returned by the user.

[0100] In a feasible implementation, step S60 may include steps S61 to S62:

[0101] Step S61, performing secondary identity authentication and encryption processing on the secondary query file request to obtain an encrypted secondary query file request;

[0102] When the user initiates a secondary query file request, the cloud desktop system will ask the user to provide identity authentication information again. Once the identity authentication is successful, the cloud desktop system will SSL encrypt the secondary query file request to protect the details of the request and subsequent data transmission.

[0103] Step S62: If the encrypted secondary query file passes identity authentication, the encrypted secondary query file that passes identity authentication is transmitted to the VDI client through the SSL channel using a preset communication protocol.

[0104] Optionally, if the encrypted secondary query file request passes the secondary identity verification, the system will use a preset communication protocol to securely transmit the encrypted secondary query file request to the VDI client through the SSL channel. SSL provides encrypted communication to ensure that data will not be eavesdropped or tampered with during transmission.

[0105] Step S70: transmitting the file to the terminal through the VDI client so that the user can download and browse the file through the terminal.

[0106] Optionally, since the data of the cloud desktop system is transmitted through the SSL channel, the VDI client transmits the corresponding files to the terminal through the SSL channel, and the user can view and download the corresponding files through the terminal. The files downloaded to the terminal are stored in the user's personal independent directory. The system automatically cleans up the files in this directory at regular intervals every day.

[0107] In addition, users can also view the logs of the cloud desktop system, including the operating status, operation records, and security access records of the cloud desktop system, for troubleshooting, and auditing the behavior of administrators and users. Among them, logs can only be viewed, not deleted. And the logs are divided into system logs, management logs, and security logs. The system log records the operation process and related status of the system, such as recording illegal user login requests, platform authentication status, platform system module operation failures, etc., which are used by administrators to preliminarily analyze user operation security and platform security. The management log records the process of administrators updating configurations, which is used to audit what operations the administrator has performed on the VDC, such as modifying the administrator's modification of user passwords, changing user policies, binding user resources, etc. The management log can be used to standardize and trace the administrator's security operation behavior. The security log records the process of users accessing key businesses, such as logging into a virtual machine and restarting a virtual machine, etc., which is used to audit the user's security behavior.

[0108] Through the above-mentioned embodiment method, the secondary query file request sent by the user is received by the cloud desktop system, and based on the secondary query file request, the VDI client is connected to the terminal using a preset communication protocol; the file is transmitted to the terminal through the VDI client, so that the user can download and browse the file through the terminal, and view the file in the cloud desktop to ensure that the business files in the production network are only viewed in the production network and are not located in the office network, thereby improving the security and controllability of the production network data.

[0109] Based on the third embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the third embodiment can be referred to the above description, and will not be described in detail later. Figure 5After step S60, the file management method further includes steps S601 to S604:

[0110] Step S601, sending a login authentication request to the user, so that the user can perform an account information login operation on the VDI client based on the login authentication request;

[0111] Optionally, when a user starts a VDI client and attempts to access a virtual desktop, the cloud desktop system is triggered to send a login authentication request to the user terminal, ensuring that only authenticated users can access virtual desktop resources. The login authentication request can be presented in a pop-up window, form, or other interactive interface, requiring the user to provide account information.

[0112] Step S602, receiving the account information input by the user, and verifying whether the account information input by the user meets the access requirements based on the preset password policy;

[0113] Optionally, the VDI client collects account information provided by the user, including a user name and password, and then the cloud desktop system verifies whether the information meets the access requirements according to a preset password policy.

[0114] Among them, in this embodiment, the preset password policy controls the policy related to username and password authentication. The preset password policy includes password security policy, username policy and anti-brute force cracking policy, specifically:

[0115] Password security policy: mainly about password security-related policies, such as password length, complexity, and password change interval.

[0116] Username policy: mainly whether the username is case sensitive.

[0117] Anti-brute force cracking strategy: It is also mainly related to security behavior, mainly to prevent brute force cracking of accounts. There are mainly the following settings, among which the number and time can be dynamically configured:

[0118] If you have logged in incorrectly three times in a row, enable the graphic verification code.

[0119] If a user with the same name makes five consecutive login errors, the user will be locked out and will return to normal after 600 seconds.

[0120] Through this step, the implementation of password policy increases the security of accounts and prevents the risk of account theft caused by weak passwords.

[0121] Step S603, if satisfied, set a preset access time limit;

[0122] Optionally, once a user passes the login authentication, the system will automatically set a preset access time limit, which is used to limit the duration of the user's session without any operation. Figure 6 , Figure 6 A diagram for setting the session duration.

[0123] This step helps improve security by setting access time limits and prevents unauthorized access caused by users forgetting to log off or leaving their workstations.

[0124] Step S604: If the user does not operate the VDI client within the preset access time limit, the access session of the VDI client is terminated.

[0125] Optionally, if the system does not detect any user operation on the VDI client (such as keyboard input, mouse movement) within the preset access time limit, it will automatically log out the current access session to prevent long-term unattended sessions from being maliciously exploited, immediately cut off inactive sessions, and reduce potential security vulnerabilities.

[0126] Through the above steps, the cloud desktop system can effectively manage user access and ensure the security of virtual desktop resources while providing a user-friendly login and session management experience.

[0127] Based on the third embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the third embodiment can be referred to the above description, and will not be described in detail later. Figure 7 Before step S70, the file management method further includes step S701:

[0128] Step S701, setting a terminal access security policy to identify whether the terminal satisfies the terminal access security policy, and if so, allowing the VDI client to transmit the watermarked file to the terminal.

[0129] Optionally, before transferring files to a terminal through a VDI client, it is also necessary to verify whether the terminal meets the conditions for transfer. Therefore, in this embodiment, a terminal access security policy is set to identify whether the terminal meets the conditions for transfer. When a terminal accesses files transferred by a VDI client, it must meet the following preset terminal access security policy requirements to be used normally:

[0130] Operating system rule: You can select the PC terminal system type and specify that only certain versions of the operating system are allowed to access.

[0131] File rule: A PC is allowed to log in only when a certain file exists or does not exist on the PC terminal.

[0132] Process rule: A PC terminal is allowed to log in only when it is already running or not running a certain process.

[0133] Registry rule: The PC is allowed to log in only when a certain key value exists or does not exist in the registry of the PC terminal.

[0134] Login IP rule: The PC terminal's IP address must be within a certain IP terminal before the PC is allowed to log in.

[0135] Login time rule: The PC terminal must log in within the time period specified by the rule.

[0136] Terminal identification rule: restricts users to log in only on a terminal specified by the rule.

[0137] In addition, the VDI client needs to use layer overlay to add watermarks to the files to be transferred. Figure 8 As shown, Figure 8 Set up a schematic for the screen watermark.

[0138] In summary, by implementing terminal access security policies, we can not only control which terminals can access the network, but also ensure that only verified users can access sensitive data. At the same time, data protection is further enhanced through technical means such as clear watermarks, which helps to build a more secure and controllable network environment, especially suitable for remote work scenarios in VDI environments.

[0139] For example, to help understand the implementation process of the file management method obtained by combining the first embodiment and the second embodiment, please refer to Fig. 9 , Fig. 9 A system deployment diagram of a file management method is provided, specifically:

[0140] It should be noted that the SASE (Secure Access Service Edge) system is deployed on the production network server in cluster mode, two of which deploy the authentication service of the SASE system, and the other two deploy the tunnel service of the SASE system, which is a dual-active mode to ensure the availability of the system. There is a corresponding load balancer in front of the server to load the traffic transmitted to the server. There is a virtual VIP on the front end of the load balancer to forward the traffic from the office network through the firewall.

[0141] The cloud desktop system is deployed on four servers in the production network. All four servers are configured with the same hardware specifications and dedicated network switches. VMware vSphere virtualization platform is installed on each server, a cluster is created in the virtualization management platform, and resource pools are configured, including computing, storage, and network resources. Then cluster management software is installed to monitor and manage the entire cluster, and virtual desktop templates are created and configured. The templates contain operating systems, applications, and necessary configurations. Finally, a load balancer is deployed in front of the four servers to distribute user traffic to each server.

[0142] Based on the above, the operation process of a file viewing method proposed in this application can be:

[0143] When a user is approving an application form on an office network computer, if he needs to view a file uploaded from the production network, he can click Enable SASE client permissions on the application form page.

[0144] The user opens the SASE client on the computer desktop, and after authentication (user name and password, scan code login, mobile phone SMS login, etc.), logs in to the SASE system through the https security protocol channel. After successfully logging in to the SASE system, click the cloud desktop application on SASE, and the VDI client will pop up. The VDI client also needs to log in again with the user password, etc. After a successful login, you can use the RDP protocol to connect to the virtual desktop of the production network.

[0145] In the virtual desktop, the user opens the browser and enters the application system URL (only specific URLs can be opened), and previews or downloads the files to be viewed in the application system. After viewing the files, the user manually exits the cloud desktop and SASE client.

[0146] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the file management method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0147] This application also provides a file management system, please refer to Fig.10 , the system includes a SASE system and a cloud desktop system; the SASE system includes:

[0148] The receiving module 10 is used to receive a file viewing request sent by a user;

[0149] A processing module 20, configured to perform identity authentication and information security processing on the file viewing request to obtain a processed file viewing request;

[0150] The sending module 30 is used to send the processed file viewing request to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request and responds to the processed file viewing request through the virtual desktop VDI client to query the corresponding file;

[0151] The cloud desktop system includes:

[0152] A receiving module 10, configured to receive a processed file viewing request sent by a secure access edge SASE system;

[0153] The query module 40 is used to respond to the processed file viewing request through the virtual desktop VDI client and query the corresponding file.

[0154] The file management system provided by the present application adopts the file management method in the above embodiment, which can solve the technical problem that the production network files are easily leaked. Compared with the prior art, the beneficial effects of the file management system provided by the present application are the same as the beneficial effects of the file management method provided by the above embodiment, and the other technical features in the file management system are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0155] The present application provides a file management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the file management method in the above-mentioned embodiment 1.

[0156] Reference below Fig.11 , which shows a schematic diagram of the structure of a file management device suitable for implementing an embodiment of the present application. The file management device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.11 The file management device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0157] like Fig.11As shown, the file management device may include a processing system 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage system 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the file management device are also stored. The processing system 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input system 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output system 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage system 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication system 1009. Communication system 1009 can allow the file management device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a file management device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0158] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication system, or installed from a storage system 1003, or installed from a ROM 1002. When the computer program is executed by the processing system 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0159] The file management device provided by the present application adopts the file management method in the above embodiment, which can solve the technical problem that the files on the production network are easily leaked. Compared with the prior art, the beneficial effects of the file management device provided by the present application are the same as the beneficial effects of the file management method provided by the above embodiment, and the other technical features in the file management device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0160] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0161] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0162] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the file management method in the above-mentioned embodiment.

[0163] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0164] The computer-readable storage medium may be included in the file management device; or may exist independently without being assembled into the file management device.

[0165] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the file management device, the file management device: receives a file viewing request sent by a user through the SASE system; performs identity authentication and information security processing on the file viewing request to obtain a processed file viewing request; sends the processed file viewing request to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request, and responds to the processed file viewing request through a virtual desktop VDI client to query the corresponding file. The processed file viewing request sent by the secure access edge SASE system is received through the cloud desktop system, and the processed file viewing request is obtained based on the identity authentication and information security processing performed by the SASE system on the file viewing request; responds to the processed file viewing request through a virtual desktop VDI client to query the corresponding file.

[0166] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0167] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0168] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0169] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned file management method, and can solve the technical problem that production network files are easily leaked. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the file management method provided by the above-mentioned embodiment, and will not be repeated here.

[0170] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned file management method when executed by a processor.

[0171] The computer program product provided by this application can solve the technical problem that files on the production network are easily leaked. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as those of the file management method provided by the above embodiment, which will not be repeated here.

[0172] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A file management method, characterized in that: The method is applied to a secure access edge SASE system, and the method includes: Receive a file viewing request sent by a user; Performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request; The processed file viewing request is sent to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request and responds to the processed file viewing request through the virtual desktop VDI client to query the corresponding file.

2. The method according to claim 1, characterized in that The step of performing identity authentication and information security processing on the file viewing request to obtain the processed file viewing request comprises: Verify whether the user information corresponding to the file viewing request matches the preset whitelist; If yes, then performing differentiated behavior recording and auditing on the user information corresponding to the file viewing request to obtain an audit result; Through the preset security mechanism, analyze the audit results to see whether there is malicious threat information; If so, terminate the request to view the file; If it does not exist, the file viewing request is encrypted to obtain a processed file viewing request.

3. A file management method, characterized in that: The method is applied to a cloud desktop system, and the method includes: Receiving a processed file viewing request sent by a secure access edge (SASE) system, wherein the processed file viewing request is obtained based on identity authentication and information security processing performed by the SASE system on the file viewing request; The virtual desktop infrastructure VDI client responds to the processed file viewing request and queries the corresponding file.

4. The method according to claim 3, characterized in that After the step of responding to the processed file viewing request and querying the corresponding file through the virtual desktop infrastructure VDI client, the method further includes: Receiving a secondary query file request sent by a user, and based on the secondary query file request, connecting the VDI client to a terminal using a preset communication protocol; The file is transmitted to the terminal through the VDI client so that the user can download and browse the file through the terminal.

5. The method according to claim 4, characterized in that After the step of receiving the secondary query file request sent by the user, the method further includes: Sending a login authentication request to the user, so that the user can perform an account information login operation on the VDI client based on the login authentication request; Receiving account information input by a user, and verifying whether the account information input by the user meets the access requirements based on a preset password policy; If it is satisfied, then set the preset access time limit; If the user does not operate the VDI client within the preset access time limit, the access session of the VDI client is terminated.

6. The method according to claim 4, characterized in that The step of connecting the VDI client to the terminal using a preset communication protocol based on the secondary query file request includes: Performing secondary identity authentication and encryption processing on the secondary query file request to obtain an encrypted secondary query file request; If the encrypted secondary query file passes the identity authentication, the encrypted secondary query file that passes the identity authentication is transmitted to the VDI client through the SSL channel using a preset communication protocol.

7. The method according to claim 4, characterized in that Before the step of transmitting the file to the terminal through the VDI client, the step further includes: A terminal access security policy is set to identify whether the terminal satisfies the terminal access security policy. If so, the VDI client is allowed to transmit the watermarked file to the terminal.

8. A file management system, characterized in that: The system includes a SASE system and a cloud desktop system; the SASE system includes: A receiving module, used for receiving a file viewing request sent by a user; A processing module, used for performing identity authentication and information security processing on the file viewing request to obtain a processed file viewing request; A sending module, used to send the processed file viewing request to the cloud desktop system through a preset security protocol channel, so that the cloud desktop system receives the processed file viewing request, and responds to the processed file viewing request through a virtual desktop VDI client to query the corresponding file; The cloud desktop system includes: A receiving module, configured to receive a processed file viewing request sent by a secure access edge SASE system; The query module is used to respond to the processed file viewing request through the virtual desktop VDI client and query the corresponding file.

9. A file management device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the file management method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the file management method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the file management method according to any one of claims 1 to 7 are implemented.

Images