Offline file security control method

Abstract

The invention discloses an offline file security control method, and relates to the field of file security control. Comprising the following steps: S1, acquiring and identifying file data information and user access information, and storing in a database; s2, preprocessing the file data information and executing encryption operation; s3, respectively sending the encrypted ciphertext and the corresponding key to an access user according to the authority level, and performing access auditing on the access user; through combination of encryption modes of text data and picture data to form multi-level protection, fine authority management, real-time risk auditing and comprehensive behavior analysis, potential security risks can be identified and coped with more effectively, and security and integrity of data are guaranteed; meanwhile, the adaptability and the flexibility of the system are enhanced through dynamic permission adjustment and global monitoring, so that the safety management is more efficient.

Description

Technical Field

[0001] The present invention relates to the technical field of file security management and control, and in particular to an offline file security management and control method. Background Art

[0002] With the rapid development of information technology, data security has become an important issue that enterprises and individuals must face. Although traditional file security management methods, such as encryption and access control, protect the security of files to a certain extent, they are powerless in the face of increasingly complex network attacks and theft methods. Therefore, for offline files, especially those involving confidential and sensitive information, their security management is particularly important.

[0003] As attack techniques evolve, known encryption algorithms may be cracked. Therefore, encryption methods need to be updated to maintain high data security; and the encryption keys themselves also need to be protected, using secure key generation and key distribution, as well as secure storage of keys to avoid key leakage or malicious access. Summary of the invention

[0004] The purpose of the present invention is to solve the problems raised by the above-mentioned background technology and to propose an offline file security management method.

[0005] The purpose of the present invention can be achieved through the following technical solution: An offline file security management method comprises the following steps:

[0006] S1: Obtain and identify file data information and user access information and store them in the database; obtain characters and images in the file information; obtain the number of operations, operation duration, operation authority level and access IP address in the access information;

[0007] S2: Preprocess the file data information and perform encryption operations; the specific steps are:

[0008] Set each character to correspond to a unique numerical value, compare and match the characters in the file with all the set numerical values ​​to obtain the corresponding numerical values, and convert the characters in the file data information into numerical values ​​in order to obtain a text numerical sequence; identify the picture in the file data information, magnify the picture several times to form a pixel grid picture, establish a plane rectangular coordinate system for the pixel grid picture to obtain the coordinates of each pixel grid in each pixel grid picture; identify the color in the pixel grid picture, set each color to correspond to a unique color numerical value; compare and match the color of the pixel grid picture with the set color numerical value to obtain the corresponding color numerical value, and convert the pixel grid values ​​into pixel grid values ​​in order according to the pixel grid coordinates to obtain a picture numerical sequence, wherein all the pixel grid values ​​in the picture constitute a converted picture numerical sequence;

[0009] The text numerical sequence is converted, and an arbitrary point is taken as the origin. The first ray is drawn in the horizontal right direction, and the length value of the ray is equal to the first value in the text numerical sequence. The left end point of the ray is taken as the starting point, and several rays are evenly drawn in the clockwise direction; after all the rays corresponding to the text numerical sequence are drawn in sequence, the endpoints of adjacent rays are connected in sequence to obtain all the encrypted images of the text numerical sequence and form the encrypted ciphertext; the picture numerical sequence is converted, and an arbitrary point is taken as the origin, and a ray is drawn in the horizontal right direction. The length value of the ray is equal to the first value in the picture numerical sequence. The left end point of the ray is taken as the starting point, and several rays are evenly drawn in the clockwise direction; after all the rays corresponding to the picture numerical sequence are drawn in sequence, the endpoints of adjacent rays are connected in sequence to obtain all the encrypted images of the picture numerical sequence and form the encrypted ciphertext;

[0010] S3: The encrypted ciphertext and the corresponding key are sent to the access user according to the permission level, and the access is audited.

[0011] As a preferred implementation of the present invention, the user access information is obtained, and the specific steps are as follows:

[0012] Obtain the operation permission level in the user access information; set different operation permission levels to correspond to a company position, compare and match the operation permission level with all set operation permission levels to obtain the corresponding company position, and send the encrypted ciphertext and the corresponding key of the encrypted file data information of the permission level to the account of the access user of the corresponding company position, and encrypt the data of different access users;

[0013] Get the user's access IP address, retrieve the IP addresses of historical access users from the database and match them with the IP address of the access user. When the match is successful, the access user's IP address request is passed, and the access user is recorded as a pending user and an access audit operation is performed; when the match fails, it means that the IP address of the access user is abnormal, then the access user is recorded as an abnormal user's access right and the operation is locked, that is, the access user's account is locked, and the access user is not given the right to access data.

[0014] As a preferred implementation of the present invention, user operation information is obtained and access audit is performed on it. The specific steps are as follows:

[0015] The number of operations per day of the pending user in the past month is retrieved; a two-dimensional rectangular coordinate system is constructed with time as the horizontal coordinate and the number of operations as the vertical coordinate, the number of operations per day of the pending user in the past month and the corresponding time points are input into the coordinate system, and line segments are used to connect them in chronological order to obtain a discount graph of the change in the number of operations of the pending user over time in the past month; all the operation times in the past month are summed up to obtain the total number of operations, and then the total number of operations and the total number of days in the past month are averaged to obtain the average frequency of the number of operations of the pending user, recorded as Take the day in the middle of the month in the past month as the midpoint time and record it as The coordinates of the number of operations in the discount graph of the change in the number of operations of the pending user over time are retrieved and recorded as (Qi, Wi), where i = 1, 2, 3 ... I, where I represents the number of days in the current month of the past month;

[0016] Substitute the values ​​of the average frequency, midpoint time, current time, and current frequency into the formula Calculate the sensitivity value Gi; set a sensitivity threshold interval, and compare the sensitivity value of each day in nearly a month with the set sensitivity threshold interval. When the sensitivity value is greater than the maximum value in the set sensitivity threshold interval, the potential risk of the visit on that day is very high, and the day is recorded as a high-risk visit day; when the sensitivity value is within the set sensitivity threshold interval, the potential risk of the visit on that day is relatively large, and the day is recorded as a medium-risk visit day; when the surface perception is less than the minimum value in the set sensitivity threshold interval, the day is recorded as a low-risk visit day; count the number of days corresponding to high-sensitivity visit days, medium-sensitivity visit days, and low-sensitivity visit days, and record them as L1, L2, and L3, respectively.

[0017] As a preferred implementation of the present invention, the operation duration of user access is obtained and analyzed, and the specific steps are as follows:

[0018] Retrieve the operation duration of each visit of the user to be reviewed; set an operation duration interval, compare the operation duration with the set duration interval, when the operation duration is greater than the maximum value in the set duration interval, record it as a serious timeout visit; when the operation duration is within the set duration interval, record it as a moderate timeout visit; when the operation duration is less than the minimum value in the set duration interval, record it as a slight timeout visit; count the number of serious timeout visits, moderate timeout visits and slight timeout visits of the user to be reviewed respectively, and record them as M1, M2 and M3 respectively.

[0019] As a preferred implementation of the present invention, by analyzing the number of high, medium and low sensitive days and the number of serious, moderate and slight overtime accesses, and performing access audits on them, the specific steps are as follows:

[0020] Substitute the values ​​of high-sensitivity access days L1, medium-sensitivity access days L2, low-sensitivity access days L3, serious overtime access number M1, moderate overtime access number M2, and slight overtime access number M3 into the formula The risk value LM is calculated, where a1, a2, a3, b1, b2 and b3 are respectively set weight factors; a risk threshold interval is set, and the risk value is compared with the set risk threshold interval. When the risk value is greater than the maximum value in the set risk threshold interval, the access user is recorded as a severe risk user, and the severe risk user is included in a specific list operation, and a warning signal is issued; when the risk value is within the set risk threshold interval, the access user is recorded as a moderate risk user, and the access user's operation authority is locked, that is, the IP address of the access user is locked, and the access user is not given the authority to operate data, and a warning signal is issued; when the risk value is less than the minimum value of the set risk threshold interval, it is recorded as a regular user and no operation is performed; the number of operation authority levels of all access users is counted and recorded as the number of locks. When the number of locks reaches the set lock threshold, the corresponding IP address of the access user is included in the specific list operation, and a warning signal is issued.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] 1. By converting data into images and encrypting them, data security can be effectively improved, making it more difficult for attackers to decrypt data through conventional means; using the generated radiographic images as ciphertext, it is difficult for unauthorized users to directly understand the content of the data, thereby enhancing concealment; by comparing the encrypted images, the integrity of the data can be verified. If any part of the encrypted image changes, the image will be distorted, indicating that the data has been tampered with; combining the encryption methods of text data and image data to form a multi-level protection strategy.

[0023] 2. Through sophisticated permission management, real-time risk auditing and comprehensive behavior analysis, it is possible to more effectively identify and respond to potential security risks and ensure the security and integrity of data; at the same time, dynamic permission adjustment and global monitoring enhance the adaptability and flexibility of the system, making security management more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0025] Figure 1 is a flow chart of the method of the present invention;

[0026] Figure 2 It is a schematic diagram of the encrypted ciphertext of the present invention. DETAILED DESCRIPTION

[0027] The technical scheme of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] It should be understood that the terms “include” and “comprising” used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0029] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and claims, the singular forms of "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations.

[0030] Example 1: An offline file security management method, when applied to financial materials, confidentiality is of vital importance. These materials may contain sensitive information, such as financial statements, budget plans, investment strategies, etc., and leakage may lead to serious financial losses and reputation crisis. Therefore, strict confidentiality measures must be taken when transmitting these materials. Any leakage during the transmission process may cause irreparable damage to the organization.

[0031] include:

[0032] Taking advantage of the unpredictability of quantum keys and the high-level characteristics of national secret algorithms, electronic archives are constructed to uniformly manage the encryption of archives and the identity confirmation of both senders and receivers. After the financial materials are sent, the receiver needs to be able to use them offline and verify the identity of the receiver when they decrypt and open them. At the same time, the receiver also needs to confirm the identity of the sender to ensure its legitimacy and credibility. Even in the absence of a network connection, the receiver can safely use the materials and ensure the authenticity and legitimacy of his identity. To achieve this goal, a two-way trusted identity authentication quantum key offline encryption protocol is adopted to ensure that the receiver can safely use the financial materials and conduct effective identity authentication under any circumstances.

[0033] Encryption certificates are issued to institutions that need to send data, and reading certificates are issued to qualified data receivers. At the same time, encryption and reading verification keys are uniformly provided; all encryption and decryption algorithms use the national encryption algorithms SM2, SM4, and SM3; encryption institutions use encryption certificates to sign encrypted information for materials they encrypt, and readers use the built-in certificates in the reader to verify the signature of the received data, and then use the verified signature information to verify the encryption integrity of the data. Finally, the reader verifies whether the local identity meets the reader range specified by the data. This protocol solves the identity verification of both the sender and the receiver after a piece of data is transmitted, ensuring that the data is sent and read by the expected person.

[0034] The encryption of electronic files is as follows: generating quantum keys of true random numbers, all keys are used only once and destroyed immediately to ensure that they will not be reused; injecting quantum keys UKey, embedding the reader's identity information in UKey, and encrypting according to the corresponding key selected by the reader. This solves the confidentiality management of keys and ensures the security and confidentiality of data in the process of transmission through various channels.

[0035] See also Figure 1 As shown, based on Example 1, an offline file security management method further includes the following steps:

[0036] S1: Acquire and identify file data information and user access information and store them in the database; the file information includes: characters and pictures; the access information includes the number of operations, operation duration, operation authority level and access IP address; the files include financial electronic files or power financial offline electronic files, etc.

[0037] S2: Preprocess the file data information and perform encryption operations. The specific steps are as follows:

[0038] Set each character to correspond to a unique numerical value, compare and match the characters in the file with all the set numerical values ​​to obtain the corresponding numerical values, and convert the characters in the file data information into numerical values ​​in order to obtain a text numerical sequence; identify the picture in the file data information, magnify the picture several times to form a pixel grid picture, establish a plane rectangular coordinate system for the pixel grid picture to obtain the coordinates of each pixel grid in each pixel grid picture, where the coordinates include abscissas and ordinates; identify the colors in the pixel grid picture, set each color to correspond to a unique color numerical value, where the color numerical value and the character numerical value corresponding to the character are not repeated; compare and match the color of the pixel grid picture with the set color numerical value to obtain the corresponding color numerical value; sort the color values ​​of the pixel grids according to the coordinates of the pixel grids and convert them into pixel grid numerical values ​​to obtain a picture numerical sequence, where all the pixel grid values ​​in the picture constitute a converted picture numerical sequence;

[0039] Convert text to numeric sequences, such as Figure 2 As shown, take any point as the origin, draw out the first ray in the horizontal right direction, the length value of the ray is equal to the first value in the text value sequence, take the left end point of the ray as the starting point, and draw out several rays evenly in the clockwise direction; after drawing out the rays corresponding to all the text value sequences in turn, connect the endpoints of adjacent rays in turn, obtain all the encrypted images of the text value sequence and form the encrypted ciphertext; convert the picture value sequence, take any point as the origin, draw out a ray in the horizontal right direction, the length value of the ray is equal to the first value in the picture value sequence, take the left end point of the ray as the starting point, and draw out several rays evenly in the clockwise direction; after drawing out the rays corresponding to all the picture value sequences in turn, connect the endpoints of adjacent rays in turn, obtain all the encrypted images of the picture value sequence and form the encrypted ciphertext;

[0040] By converting data into images and encrypting them, data security can be effectively improved, making it more difficult for attackers to decrypt data through conventional means; using the generated radiographic images as ciphertext, it is difficult for unauthorized users to directly understand the content of the data, thereby enhancing concealment; by comparing the encrypted images, the integrity of the data can be verified. If any part of the encrypted image changes, the image will be distorted, indicating that the data has been tampered with; combining the encryption methods of text data and image data to form a multi-level protection strategy.

[0041] S3: Send the encrypted ciphertext and the corresponding key to the access user according to the permission level, and conduct access audit on them; the specific steps are as follows:

[0042] Obtain the operation permission level in the user access information; it should be noted that the operation permission level is set according to the number of operation types, and there are three operation types set, namely read, modify and delete. Among them, only reading files is the first-level operation permission, reading and modifying is the second-level operation permission, and so on. The third-level operation permission can read, modify and delete; set different operation permission levels to correspond to a company position, compare and match the operation permission level with all the set operation permission levels to obtain the corresponding company position, and send the encrypted ciphertext and the corresponding key of the file data information of the permission level to the account of the access user of the corresponding company position, and encrypt data for different access users;

[0043] Obtain the user's access IP address, retrieve the IP addresses of historical access users in the database and match them with the IP address of the access user. If the match is successful, the request of the access user's IP address is passed, and the access user is recorded as a pending user and an access audit operation is performed; if the match fails, it means that the access user's IP address is abnormal, then the access user is recorded as an abnormal user's access right and the operation is locked, that is, the access user's account is locked, and the access user is not given the right to access data;

[0044] The specific steps for access audit are:

[0045] The number of operations of the pending user in the past month is retrieved, where the number of operations specifically refers to operations such as access, modification and deletion; a two-dimensional rectangular coordinate system is constructed with time as the horizontal axis and the number of operations as the vertical axis, the number of operations of the pending user in the past month and the corresponding time points are input into the coordinate system, and line segments are used to connect them in chronological order to obtain a discount graph of the change in the number of operations of the pending user over time in the past month; all the operation times in the past month are summed up to obtain the total number of operations, and then the total number of operations and the total number of days in the past month are averaged to obtain the average frequency of the number of operations of the pending user, recorded as Take the day in the middle of the month in the past month as the midpoint time and record it as The coordinates of the number of operations in the discount graph of the change in the number of operations of the pending user over time are retrieved and recorded as (Qi, Wi), where i = 1, 2, 3 ... I, where I represents the number of days in the current month of the past month;

[0046] The average frequency Midpoint Substitute the current time Qi and the current frequency Wi into the set formula Calculate the sensitivity value Gi; set a sensitivity threshold interval, compare the sensitivity value Gi of each day in nearly a month with the set sensitivity threshold interval. When the sensitivity value is greater than the maximum value in the set sensitivity threshold interval, it means that the number of operations corresponding to that day is much greater than the daily average number of operations, and the potential risk of access on that day is very high, then the day is recorded as a high-risk access day; when the sensitivity value is within the set sensitivity threshold interval, the potential risk of access on that day is relatively high, then the day is recorded as a medium-risk access day; when the face perception is less than the minimum value in the set sensitivity threshold interval, then the day is recorded as a low-risk access day; respectively count the number of days corresponding to high-sensitivity access days, medium-sensitivity access days, and low-sensitivity access days, and record them as L1, L2, and L3, respectively;

[0047] Retrieve the operation duration of each access of the pending user, where the operation duration refers to the time from when the pending user opens a file data information to when the pending user closes the file data information; set an operation duration interval, compare the operation duration with the set duration interval, when the operation duration is greater than the maximum value in the set duration interval, it means that the operation duration is much greater than the duration of the usual access operation, and it is recorded as a serious timeout access; when the operation duration is within the set duration interval, it is recorded as a moderate timeout access; when the operation duration is less than the minimum value in the set duration interval, it is recorded as a slight timeout access; count the number of serious timeout access, moderate timeout access and slight timeout access of the pending user respectively, and record them as M1, M2 and M3 respectively;

[0048] Substitute the values ​​of high-sensitivity access days L1, medium-sensitivity access days L2, low-sensitivity access days L3, serious overtime access number M1, medium overtime access number M2, and slight overtime access number M3 into the set formula The risk value LM is calculated, where a1, a2, a3, b1, b2 and b3 are respectively the set weight factors; a risk threshold interval is set, and the risk value is compared with the set risk threshold interval. When the risk value is greater than the maximum value in the set risk threshold interval, it means that the number of access risk operations of the current access user in the past month is in a severe risk state, then the access user is recorded as a severe risk user, and the severe risk user is included in a specific list operation, and an early warning signal is issued; when the risk value is within the set risk threshold interval, it means that the current access user's cumulative access risk operations in the past month are in a moderate risk state, then the access user Record it as a medium-risk user, and lock the access user's operation permissions, that is, lock the IP address of the access user, do not give the access user permission to operate data, and issue a warning signal; when the risk value is less than the minimum value of the set risk threshold range, it means that all access risk operations of the access user in the past month are in a low-risk state, then the user is recorded as a regular user and no operation is performed; set an operation lock threshold, count the number of operation permission levels of all access users and record it as the number of locks, when the number of locks reaches the set lock threshold, the corresponding IP address of the access user is included in the specific list operation, and issue a warning signal.

[0049] Through sophisticated permission management, real-time risk auditing and comprehensive behavior analysis, potential security risks can be identified and responded to more effectively, ensuring the security and integrity of data; at the same time, dynamic permission adjustment and global monitoring enhance the adaptability and flexibility of the system, making security management more efficient.

[0050] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An offline file security management method, characterized in that: The following steps are involved: S1: Acquire and identify file data information and user access information and store them in the database; Obtain characters and images from file information; obtain operation times, operation duration, operation permission level, and access IP address from access information; S2: Preprocess the file data information and perform encryption operations; the specific steps are: Set each character to correspond to a unique numerical value, compare and match the characters in the file with all the set numerical values ​​to obtain the corresponding numerical values, and convert the characters in the file data information into numerical values ​​in order to obtain a text numerical sequence; identify the picture in the file data information, magnify the picture several times to form a pixel grid picture, establish a plane rectangular coordinate system for the pixel grid picture to obtain the coordinates of each pixel grid in each pixel grid picture; identify the color in the pixel grid picture, set each color to correspond to a unique color numerical value; compare and match the color of the pixel grid picture with the set color numerical value to obtain the corresponding color numerical value, and convert the pixel grid values ​​into pixel grid values ​​in order according to the pixel grid coordinates to obtain a picture numerical sequence, wherein all the pixel grid values ​​in the picture constitute a converted picture numerical sequence; Convert the text value sequence, take any point as the origin, draw the first ray horizontally to the right, the length of which is equal to the first value in the text value sequence, and draw several rays evenly in the clockwise direction from the left end point of the ray; After drawing out the rays corresponding to all the text numerical sequences in sequence, the endpoints of adjacent rays are connected in sequence to obtain all the encrypted images of the text numerical sequence and form the encrypted ciphertext; the image numerical sequence is converted, and a ray is drawn in the horizontal right direction at any point as the origin, and the length of the ray is equal to the first value in the image numerical sequence. With the left endpoint of the ray as the starting point, several rays are drawn evenly in the clockwise direction; After deriving the rays corresponding to all the image value sequences in turn, the endpoints of the adjacent rays are connected in turn to obtain all the encrypted images of the image value sequence and form the encrypted ciphertext; S3: The encrypted ciphertext and the corresponding key are sent to the access user according to the permission level, and the access is audited.

2. According to the method of claim 1, the offline file security management method is characterized in that: Get user access information. The specific steps are: Obtain the operation permission level in the user access information; set different operation permission levels to correspond to a company position, compare and match the operation permission level with all set operation permission levels to obtain the corresponding company position, and send the encrypted ciphertext and the corresponding key of the encrypted file data information of the permission level to the account of the access user of the corresponding company position, and encrypt the data of different access users; Get the user's access IP address, retrieve the IP addresses of historical access users from the database and match them with the IP address of the access user. When the match is successful, the access user's IP address request is passed, and the access user is recorded as a pending user and an access audit operation is performed; when the match fails, it means that the IP address of the access user is abnormal, then the access user is recorded as an abnormal user's access right and the operation is locked, that is, the access user's account is locked, and the access user is not given the right to access data.

3. According to the offline file security management method of claim 1, it is characterized in that: Obtain the number of user operations for analysis and conduct access audit. The specific steps are as follows: The number of operations performed by the user to be reviewed every day in the past month is retrieved; a two-dimensional rectangular coordinate system is constructed with time as the horizontal coordinate and the number of operations as the vertical coordinate, the number of operations performed by the user to be reviewed every day in the past month and the corresponding time points are input into the coordinate system, and line segments are used to connect them in chronological order to obtain a discount graph of the relationship between the number of operations performed by the user to be reviewed and time in the past month; all the number of operations in the past month are summed up to obtain the total number of operations, and then the total number of operations and the total number of days in the past month are averaged to obtain the average frequency of the number of operations performed by the user to be reviewed, and a day in the middle of the month in the past month is taken as the midpoint; the coordinates of the number of operations in the discount graph of the relationship between the number of operations performed by the user to be reviewed and time are retrieved; The values ​​of average frequency, midpoint time, current time and current frequency are normalized to obtain the sensitivity value; Set a sensitivity threshold interval and compare the sensitivity value of each day in the past month with the set sensitivity threshold interval. When the sensitivity value is greater than the maximum value in the set sensitivity threshold interval, the potential risk of the visit on that day is very high, and the day is recorded as a high-risk visit day. When the sensitivity value is within the set sensitivity threshold range, the potential risk of the visit on that day is relatively high, and the day will be recorded as a medium-risk visit day; when the surface perception is less than the minimum value in the set sensitivity threshold range, the day will be recorded as a low-risk visit day; the number of days corresponding to high-sensitivity visit days, medium-sensitive visit days and low-sensitivity visit days are counted separately.

4. According to the offline file security management method of claim 1, it is characterized in that: Obtain and analyze the operation duration of user access. The specific steps are as follows: Retrieve the operation duration of each visit of the pending user; set an operation duration interval, compare the operation duration with the set duration interval, when the operation duration is greater than the maximum value in the set duration interval, record it as a severe timeout visit; when the operation duration is within the set duration interval, record it as a moderate timeout visit; when the operation duration is less than the minimum value in the set duration interval, record it as a slight timeout visit; count the number of severe timeout visits, moderate timeout visits and slight timeout visits of the pending user respectively.

5. The offline file security management method according to claim 1, characterized in that: By analyzing the number of high, medium and low sensitive days and the number of serious, moderate and minor overtime visits, and conducting access audits, the specific steps are as follows: The values ​​of highly sensitive access days, medium sensitive access days, low sensitive access days, serious overtime access days, medium overtime access days and slight overtime access days are normalized to obtain the risk value; Set a risk threshold interval, compare the risk value with the set risk threshold interval, and when the risk value is greater than the maximum value in the set risk threshold interval, the access user is recorded as a severe risk user, and the severe risk user is put into a specific list operation, and a warning signal is issued; When the risk value is within the set risk threshold range, the access user is recorded as a medium-risk user, and the access user's operation authority is locked, that is, the IP address of the access user is locked, the access user is not given the authority to operate data, and an early warning signal is issued; When the risk value is less than the minimum value of the set risk threshold range, it will be recorded as a regular user and no operation will be performed; the number of operation permission levels of all access users will be counted and recorded as the number of locks. When the number of locks reaches the set lock threshold, the IP address of the corresponding access user will be included in the specific list operation and an early warning signal will be issued.

Images