Mail leakage prevention method, post-mail leakage tracing method and electronic equipment

Abstract

The invention relates to a mail leakage prevention method, a mail leakage tracing method and electronic equipment. The method comprises the following steps: constructing traceability information according to various mail information obtained by analyzing a to-be-delivered mail, and encrypting the traceability information to obtain a traceability information ciphertext; performing file content format analysis on the attachment in the to-be-delivered mail to obtain a file attribute structure and a file content structure of the attachment; respectively adding the source tracing information ciphertext into the file attribute structure and the file content structure; and reconstructing the various mail information and the attachment embedded with the traceability information to obtain a new mail, and delivering the new mail. The technical problems that an existing mail leakage prevention method cannot avoid leakage detection and the mail is difficult to trace once the mail is leaked are solved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method for preventing mail leakage, a method for tracing mail leakage, and an electronic device. Background Art

[0002] Email is a basic application for daily work in enterprises and institutions, and is used to send and receive various information and materials. Once sensitive information in emails is leaked, it will cause reputation and economic losses to enterprises and institutions. The traditional means of preventing the leakage of sensitive information in emails is to filter and intercept the content of outgoing emails, but it cannot avoid missed detections. After downloading, the attachments in the emails can be copied to USB flash drives or other communication methods and sent out. Once leaked, it is difficult to trace.

[0003] Currently, no effective solution has been proposed for the above technical problems. Summary of the invention

[0004] The embodiments of the present application provide a method for preventing mail leakage, a method for tracing mail after leakage, and an electronic device, which at least solve the problem that existing mail leakage prevention methods cannot avoid missed detection and mail is difficult to trace once leaked.

[0005] According to one aspect of an embodiment of the present application, a method for preventing leakage of emails is provided, including: constructing tracing information based on multiple email information obtained by parsing an email to be delivered, and encrypting the tracing information to obtain ciphertext of the tracing information; parsing the file content format of an attachment in the email to be delivered to obtain a file attribute structure and a file content structure of the attachment; adding the ciphertext of the tracing information to the file attribute structure and the file content structure respectively; reconstructing multiple email information and the attachment embedded with the tracing information to obtain a new email, and delivering the new email.

[0006] Optionally, performing file content format parsing on the attachment in the mail to be delivered to obtain a file attribute structure and a file content structure includes: determining a first type to which the attachment in the mail to be delivered belongs; and performing file content format parsing on the attachment according to a format specification corresponding to the first type.

[0007] Optionally, adding the traceability information ciphertext to the file attribute structure includes: determining the second type to which the attachment in the to-be-delivered email belongs; obtaining the file attribute structure corresponding to the second type; and setting the traceability information ciphertext in the file attribute structure corresponding to the second type.

[0008] Optionally, the traceability information ciphertext is set in the file attribute structure corresponding to the second type, including: if the second type to which the attachment belongs is a streaming file, the traceability information ciphertext is set as the attribute value in the Template attribute of the attachment; if the second type to which the attachment belongs is a layout file, the traceability information ciphertext is set as the attribute value in the Creator attribute of the attachment; if the second type to which the attachment belongs is a compressed file, the traceability information ciphertext is set as the attribute value in the Annotation attribute of the attachment.

[0009] Optionally, the traceability information ciphertext is added to the file content structure, including: if the second type to which the attachment belongs is a streaming file, constructing a text box in the file content structure of the attachment; setting the name of the text box to a preset name, and setting the visibility of the text box to invisible; setting the content of the text box to the traceability information ciphertext.

[0010] Optionally, the traceability information ciphertext is added to the file content structure, including: if the second type to which the attachment belongs is a layout file, constructing a layer in the file content structure of the attachment; setting the name of the layer to a preset name, and setting the visibility of the layer to invisible; setting the content of the layer to the traceability information ciphertext.

[0011] Optionally, the multiple email information includes at least: sender information, recipient information, sending time, email unique identifier, and email subject information; encrypting the traceability information includes: encrypting the traceability information using an SM4 algorithm.

[0012] According to another aspect of an embodiment of the present application, a tracing method after an email leak is also provided, and the email is processed using the above method, including: parsing the file content format of the attachment in the leaked email to obtain the file attribute structure and the file content structure of the attachment; respectively detecting whether there are attribute values ​​and content format components with preset names in the file attribute structure and the file content structure of the attachment, wherein the content format components include: text boxes and layers; if so, decrypting the content of the attribute value or the content in the content format component to obtain tracing information; parsing the tracing information to obtain the information of the person who leaked the email.

[0013] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a processor, and a memory storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes the above method.

[0014] According to another aspect of the embodiments of the present application, a non-transitory machine-readable medium storing computer instructions is also provided, where the computer instructions are used to enable a computer to execute the above method.

[0015] Beneficial effects of the embodiments of the present application: In an embodiment of the present application, the traceability information is constructed according to the various mail information obtained by parsing the mail to be delivered, and the traceability information is encrypted to obtain the ciphertext of the traceability information; the file content format of the attachment in the mail to be delivered is parsed to obtain the file attribute structure and the file content structure of the attachment; the ciphertext of the traceability information is added to the file attribute structure and the file content structure respectively; the various mail information and the attachment embedded with the traceability information are reconstructed to obtain a new mail, and the new mail is delivered. By deconstructing the mail to be delivered, embedding the attachment traceability information, and reconstructing the mail and then delivering it, it is possible to extract the traceability information when the mail is leaked and achieve the technical effect of tracing the leakage.

[0016] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0018] Figure 1 is a flow chart of a method for preventing email leakage according to an embodiment of the present application; Figure 2 is a flow chart of a method for tracing back email leaks according to an embodiment of the present application; Figure 3 Schematic diagram of the structure of the electronic device of this embodiment. DETAILED DESCRIPTION

[0019] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0020] In the related art, the traditional means of preventing leakage of sensitive information in emails is to filter and intercept the content of outgoing emails, but it cannot avoid the situation of missed detection, and after the attachments in the emails are downloaded, they can be copied to the USB flash drive or other communication means and sent out, which is difficult to trace once leaked. In order to solve this problem, the embodiments of the present application provide relevant solutions, which are described in detail below.

[0021] Figure 1 is a flow chart of a method for preventing leakage of emails according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps: Step S102, constructing source tracing information according to the various mail information obtained by parsing the mail to be delivered, and encrypting the source tracing information to obtain a ciphertext of the source tracing information.

[0022] According to an optional embodiment of the present application, the above-mentioned multiple email information at least includes: sender information, recipient information, sending time, email unique identifier, and email subject information.

[0023] When executing step S102, the mail to be delivered (eml format) is parsed in the mail system delivery service to extract the mail body, attachments, sender and receiver information, etc. Then, the traceability information is constructed in xml or json format according to the sender information, recipient information, sending time, mail unique identifier, subject and other information.

[0024] EML (Electronic Mail) is a file format used to save emails. This format is usually used by various email client software, such as Microsoft Outlook Express, Mozilla Thunderbird, etc. EML files contain all the information of the email, including the sender, recipient, subject, body, and attachments.

[0025] If there are multiple recipients of an email, the email delivery service will deliver the email to each recipient one by one. When constructing the traceability information, in addition to recording the information of all recipients of the email, the specific recipient of the current email to be delivered will be recorded separately, so that the traceability information can accurately record the specific email recipient.

[0026] As an optional embodiment of the present application, executing step S102 to encrypt the traceability information is achieved by the following method: using the SM4 algorithm to encrypt the traceability information.

[0027] In an embodiment of the present application, the traceability information is encrypted using the SM4 algorithm and converted into a hexadecimal string to obtain a ciphertext of the traceability information, so as to prevent direct tampering of the traceability information.

[0028] SM4 is a commercial cryptographic algorithm standard issued by the National Cryptography Administration. It is a symmetric encryption algorithm. It is mainly used for confidential communications in wireless LANs, but is also widely used in other scenarios that require data encryption. SM4 is a block cipher that uses a 128-bit key to encrypt and decrypt 128-bit data blocks.

[0029] Step S104, parsing the file content format of the attachment in the mail to be delivered to obtain the file attribute structure and file content structure of the attachment.

[0030] In this step, the file content format of each email attachment is parsed to obtain the file attribute structure and file content structure, which mainly includes the following steps: 1) Extract email attachments: Extract all attachments from emails.

[0031] 2) Determine the file type: Determine the file type based on the file extension or file signature.

[0032] 3) Parse file content: Use the corresponding library to parse the file content according to the file type.

[0033] 4) Get file attributes: Extract file metadata such as creator, modification date, etc.

[0034] 5) Analyze the file content structure: Analyze the specific content of the file, such as text, tables, pictures, etc.

[0035] Step S106, adding the ciphertext of the traceability information to the file attribute structure and the file content structure respectively.

[0036] In this step, the traceability information ciphertext is embedded into the file attribute structure and file content structure of each attachment file in the form of file-specific attribute values ​​and file content invisible format components.

[0037] Step S108, reconstructing the various email messages and the attachments embedded with the traceability information to obtain a new email, and delivering the new email.

[0038] The above method provided in the embodiment of the present application realizes the technical effect of extracting traceability information and tracing leakage when the email is leaked by deconstructing the email to be delivered, embedding the attachment traceability information, and reconstructing and re-delivering the email.

[0039] According to an optional embodiment of the present application, step S104 is executed to parse the file content format of the attachment in the email to be delivered to obtain a file attribute structure and a file content structure, including the following steps: determining the first type to which the attachment in the email to be delivered belongs; and parsing the file content format of the attachment according to the format specification corresponding to the first type.

[0040] In an embodiment of the present application, according to the type of the attachment file, the file content format is parsed according to the corresponding format specification to obtain the file attribute structure and the file content structure so that the subsequent process can embed traceability information in the file attribute structure and the file content structure.

[0041] According to the file type classification, there are mainly the following parsing methods: 1. Parse the content format of doc / xls / ppt / wps / et / dps type files according to the MS-CFB (Microsoft Compound File Binary File Format) specification.

[0042] The MS-CFB file format is a compound document format used to store multiple stream and storage objects. This format is widely used in early versions of Microsoft Office documents, such as .doc, .xls, and .ppt files. The MS-CFB format allows multiple independent data blocks to be organized and stored in one file, similar to the directory structure in a file system.

[0043] The basic structure of an MS-CFB file consists of the following main parts: File Header: Contains basic information of the file, such as signature, version number, flag, etc.

[0044] FAT (File Allocation Table): Used to manage space allocation in files, similar to the FAT table of a disk file system.

[0045] Mini-FAT (Mini Stream File Allocation Table): used to manage the space allocation of small streams (less than 4KB).

[0046] Directory Entry: describes each stream and storage object in the file, including name, type, size and other information.

[0047] Stream: The actual data content, which can be text, images, tables, etc.

[0048] Storage: Similar to a folder, it can contain multiple streams and other storage objects.

[0049] Parsing an MS-CFB file requires understanding its internal structure and reading and interpreting each section step by step. Here is a simplified step-by-step description: 1) Read the header file The file header is located at the beginning of the file and contains the following important information: Signature: Fixed value D0 CF 11 E0 A1 B1 1A E1, used to identify CFB files.

[0050] Version Number: Indicates the version of the file format.

[0051] Sector Size: Usually 512 bytes or 4096 bytes.

[0052] Mini Sector Size: Usually 64 bytes.

[0053] 2) Read FAT and Mini-FAT FAT: Used to record the usage of each sector and help locate various parts of the file.

[0054] Mini-FAT: Sector chains used to record small streams.

[0055] 3) Read directory entries The directory entry describes each object in the file, and each directory entry occupies 128 bytes. The directory entry contains the following information: Name: The name of the object, up to 32 characters.

[0056] Type: The type of the object, which can be a stream, storage, or root storage.

[0057] Start Sector: The location of the first sector of the object.

[0058] Size: The size of the object (for streams).

[0059] 4) Read stream and store Based on the information in the directory entry, each stream and storage object can be located and read. For large streams, FAT is used to track the sector chain; for small streams, Mini-FAT is used to track the sector chain.

[0060] 2. Parse the content format of docx / xlsx / pptx files according to the OOXML (Office Open XML) specification.

[0061] OOXML is an XML-based file format standard for Microsoft Office documents, including Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) files. OOXML files are actually ZIP compressed files that contain multiple XML files and other resource files, which are organized in a specific directory structure.

[0062] 3. Parse the content format of PDF files according to the Portable Document Format specification.

[0063] 4. Parse the content format of OFD type files according to the Open Fixed-layout Document specification.

[0064] 5. Parse the format of Zip / RAR files according to ZIP format specifications.

[0065] According to an optional embodiment of the present application, executing step S106 to add the traceability information ciphertext to the file attribute structure includes the following steps: determining the second type to which the attachment in the email to be delivered belongs; obtaining the file attribute structure corresponding to the second type; and setting the traceability information ciphertext in the file attribute structure corresponding to the second type.

[0066] The second type mentioned above includes three types: streaming files, layout files and compressed files.

[0067] The characteristic of streaming files is that the content can flow freely and the layout can be automatically adjusted according to the screen size and resolution of the reading device. This type of file is mainly used for reading long documents, such as e-books, reports, papers, etc.

[0068] The characteristic of layout files is that the content layout is fixed. No matter what device it is viewed on, its page layout and typesetting remain unchanged. This type of file is mainly used in scenarios where precise control of layout and typesetting is required, such as magazines, newspapers, professional reports, etc.

[0069] A compressed file is a format that packages and compresses one or more files and directories into a single file. The main purpose of compressing files is to reduce storage space and improve transmission efficiency.

[0070] In this embodiment, the file attribute structure used to set the ciphertext of the traceability information is different for different file types, which is described in detail below.

[0071] As an optional embodiment of the present application, the traceability information ciphertext is set in the file attribute structure corresponding to the second type, and it is achieved by the following method: if the second type to which the attachment belongs is a streaming file, the traceability information ciphertext is set as an attribute value in the Template attribute of the attachment; if the second type to which the attachment belongs is a layout file, the traceability information ciphertext is set as an attribute value in the Creator attribute of the attachment; if the second type to which the attachment belongs is a compressed file, the traceability information ciphertext is set as an attribute value in the Annotation attribute of the attachment.

[0072] There are three main cases for adding tracing information ciphertext to the file attribute structure: 1. For Office / WPS streaming files, take the Template property of the file and set the property value (tracing information ciphertext).

[0073] The Template property is used to record the template information of the document. Setting and getting the Template property can help record the source information of the document, which is very useful for document management and traceability.

[0074] 2. For PDF / OFD format files, take the Creator attribute of this type of file to set the attribute value (tracing information ciphertext).

[0075] In PDF and OFD files, the Creator property is used to record the creator information of the document. Setting and getting the Creator property can help record the source information of the document, which is very useful for document management and traceability.

[0076] 3. For Zip / RAR compressed files, take the "Comment" attribute of the file and set the attribute value (tracing information ciphertext).

[0077] In Zip and RAR compressed files, the "Comment" attribute is used to record additional information about the compressed file, such as source, creator, purpose, etc. This comment information can help users better manage and understand the file content.

[0078] According to another optional embodiment of the present application, adding tracing information ciphertext to the file content structure includes the following steps: if the second type to which the attachment belongs is a streaming file, constructing a text box in the file content structure of the attachment; setting the name of the text box to a preset name, and setting the visibility of the text box to invisible; setting the content of the text box to the tracing information ciphertext.

[0079] If the traceability information is only embedded in the file attribute structure, some application software can tamper with or remove the traceability information by viewing, modifying, and removing the file attribute values, resulting in the inability to trace. To increase the reliability of traceability, the traceability information is added to both the file attribute structure and the file content structure.

[0080] For streaming files, the above attribute values ​​(tracing information ciphertext) can be embedded in an invisible content format component (Shape component of streaming files, with a customizable name, such as Trace). The specific examples are as follows: In the file content structure of the streaming file, a text box (TextBox) with the specified name "Trace" is constructed, and its visibility is set to invisible (hidden), and the content of the text box is set to the tracing information ciphertext.

[0081] According to another optional embodiment of the present application, adding the traceability information ciphertext to the file content structure also includes the following steps: if the second type to which the attachment belongs is a layout file, constructing a layer in the file content structure of the attachment; setting the name of the layer to a preset name, and setting the visibility of the layer to invisible; setting the content of the layer to the traceability information ciphertext.

[0082] For layout files, the above attribute values ​​(tracing information ciphertext) can be embedded in an invisible content format component (Layer component of layout files, with customizable names, such as Trace). The specific examples are as follows: In the file content structure of the layout file, construct a layer (Layer) with the specified name "Trace", set its visibility to invisible (false), and set the content of the layer to the ciphertext of the traceability information.

[0083] Through the above scheme, an invisible content format component is added to the file content structure, and the content of the component is set as the traceability information ciphertext, so that the traceability information is integrated with the file content, which is more concealed and reliable, and the application software cannot directly view, modify or remove it.

[0084] The present application also provides a method for tracing after an email leak. Figure 1 The method in the embodiment shown in the figure is used for processing. Figure 2 As shown, the method comprises the following steps: Step S202: parsing the file content format of the attachment in the leaked email to obtain the file attribute structure and file content structure of the attachment.

[0085] When an email is delivered to a recipient of an external email system or an internal email system, the recipient receives and downloads the email attachment. When an email attachment is leaked, the leaked file can be traced. First, parse the file content format of the attachment in the email to obtain the file attribute structure and file content structure. The parsing method is described in the above section. Figure 1 Description of the illustrated embodiment.

[0086] Step S204, respectively detecting whether there are attribute values ​​and content format components with preset names in the file attribute structure and the file content structure of the attachment, wherein the content format components include: text boxes and layers.

[0087] In this step, the file attributes and file content format of the leaked file are checked through the traceability information extraction tool to detect whether there is a file attribute or content format component with a specified name (mentioned above, constructing a text box or layer with a specified name of "Trace").

[0088] Step S206: If it exists, decrypt the content of the attribute value or the content in the content format component to obtain the traceability information.

[0089] If it exists, read the attribute value of the above-mentioned name attribute or the content in the content format component (i.e. the traceability information ciphertext), perform byte transcoding and SM4 decryption on the attribute value or the content in the content format component to obtain the traceability information in XML or JSON format.

[0090] Step S208, parsing the source tracing information to obtain the information of the person who leaked the email.

[0091] Use the traceability information extraction tool to parse the traceability information and display it on the interface, so as to know who sent the file, the sending time, the sending subject, the specific recipient and other information, so as to trace the possible leaker (specific recipient).

[0092] It should be noted that Figure 2 The preferred implementation of the illustrated embodiment can be found in Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0093] The embodiment of the present application also provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program executable by the at least one processor, and the computer program is used to enable the electronic device to perform the method of the embodiment of the present application when executed by the at least one processor.

[0094] An embodiment of the present application also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0095] The embodiment of the present application also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present application.

[0096] refer to Figure 3, the structural block diagram of the electronic device that can be used as the server or client of the embodiment of the present application will now be described, which is an example of the hardware device that can be applied to various aspects of the present application. The electronic device is intended to represent various forms of digital electronic computer equipment, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present application described and / or required herein.

[0097] like Figure 3 As shown, the electronic device includes a computing unit 301, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 302 or a computer program loaded from a storage unit 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device can also be stored. The computing unit 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0098] Multiple components in the electronic device are connected to the I / O interface 305, including: an input unit 306, an output unit 307, a storage unit 308, and a communication unit 309. The input unit 306 can be any type of device that can input information to the electronic device, and the input unit 306 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 307 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 308 can include but is not limited to a disk, an optical disk. The communication unit 309 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0099] The computing unit 301 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 301 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 301 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present application may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 308. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via a ROM 302 and / or a communication unit 309. In some embodiments, the computing unit 301 may be configured to perform the above method in any other appropriate manner (e.g., by means of firmware).

[0100] The computer program for implementing the method of the embodiment of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0101] In the context of the embodiments of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, or infrared system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] It should be noted that the term "including" and its variations used in the embodiments of the present application are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present application are illustrative and not restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0103] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0104] The various steps described in the method implementation methods provided in the embodiments of the present application can be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present application is not limited in this respect.

[0105] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0106] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for preventing email leakage, characterized in that: include: Constructing tracing information according to the multiple mail information obtained by parsing the mail to be delivered, and encrypting the tracing information to obtain ciphertext of the tracing information; Parsing the file content format of the attachment in the to-be-delivered email to obtain the file attribute structure and file content structure of the attachment; Adding the tracing information ciphertext to the file attribute structure and the file content structure respectively; The multiple email information and the attachments embedded with the traceability information are reconstructed to obtain a new email, and the new email is delivered.

2. The method according to claim 1, characterized in that: Parsing the file content format of the attachment in the mail to be delivered to obtain a file attribute structure and a file content structure, including: Determine a first type to which the attachment in the to-be-delivered email belongs; The file content format of the attachment is parsed according to the format specification corresponding to the first type.

3. The method according to claim 1, characterized in that Adding the tracing information ciphertext to the file attribute structure includes: Determine the second type to which the attachment in the to-be-delivered mail belongs; Obtaining a file attribute structure corresponding to the second type; The tracing information ciphertext is set in a file attribute structure corresponding to the second type.

4. The method according to claim 3, characterized in that Setting the tracing information ciphertext in the file attribute structure corresponding to the second type includes: If the second type to which the attachment belongs is a streaming file, setting the tracing information ciphertext as an attribute value in the Template attribute of the attachment; If the second type to which the attachment belongs is a layout file, setting the tracing information ciphertext as an attribute value into the Creator attribute of the attachment; If the second type to which the attachment belongs is a compressed file, the ciphertext of the traceability information is set as an attribute value in the annotation attribute of the attachment.

5. The method according to claim 3, characterized in that: Adding the tracing information ciphertext to the file content structure includes: If the second type to which the attachment belongs is a streaming file, constructing a text box in the file content structure of the attachment; Setting the name of the text box to a preset name, and setting the visibility of the text box to invisible; The content of the text box is set as the ciphertext of the traceability information.

6. The method according to claim 3, characterized in that Adding the tracing information ciphertext to the file content structure includes: If the second type to which the attachment belongs is a layout file, constructing a layer in the file content structure of the attachment; Setting the name of the layer to a preset name and setting the visibility of the layer to invisible; The content of the layer is set as the tracing information ciphertext.

7. The method according to any one of claims 1 to 6, characterized in that The multiple types of email information include at least: sender information, recipient information, sending time, email unique identifier, and email subject information; Encrypting the traceability information includes: encrypting the traceability information using an SM4 algorithm.

8. A method for tracing after an email leak, characterized in that: The mail is processed using the method described in any one of claims 1 to 7, the method comprising: Parsing the file content format of the attachment in the leaked email to obtain the file attribute structure and file content structure of the attachment; Respectively detecting whether there are attribute values ​​and content format components with preset names in the file attribute structure and the file content structure of the attachment, wherein the content format components include: a text box and a layer; If it exists, decrypt the content of the attribute value or the content in the content format component to obtain the traceability information; The source tracing information is parsed to obtain information about the person who leaked the email.

9. An electronic device, comprising: A processor and a memory storing a program, wherein the program comprises instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 8.

10. A non-transitory machine-readable medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 8.

Images