Method and system for downloading and viewing document based on browser

Abstract

The invention discloses a method and a system for downloading and viewing documents based on a browser, and the method comprises the following steps: a team administrator sets a storage strategy for downloading and storing corresponding documents on each business website by each user through a special browser on a strategy server, and the strategy server issues the storage strategy to the special browser; when a user accesses a website through a special browser and downloads a document, the document is stored in a memory sandbox, a local memory or a cloud memory according to a storage strategy and encrypted; when the encrypted document is opened, finding and decrypting the document from the storage space, and then calling the document plug-in to open the decrypted document; and after exiting from the special browser, uniformly cleaning all locally downloaded encrypted documents at this time. According to the method and the device, basic data interaction authorization is realized by limiting the downloading behavior in the kernel layer of the browser, the security of enterprise data is enhanced, and the local equipment can check the downloaded document without installing corresponding software, so that the speed and the convenience of accessing the business website data are improved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method and system for downloading and viewing documents based on a browser. Background Art

[0002] With the accelerated evolution of enterprise digital transformation, IaaS infrastructure has become ubiquitous, and SaaS services are becoming more and more deeply integrated into enterprise business scenarios. The trend of cloud computing is firm and clear, and almost all new businesses tend to be accessed through browsers, which has pushed browsers to become the de facto entrance to enterprise business. However, many enterprises, especially small and medium-sized enterprises, generally use personal browsers for daily work. However, this common practice has brought many hidden dangers to enterprises and individuals: employees' use of personal browsers is outside the enterprise management system, lacks compliance insights, and has data leakage risks. The business model of personal browsers is mostly traffic and advertising. There is no doubt that it will widely collect and analyze users' browser usage behavior and access records. When enterprise employees use personal browsers to access enterprise business, access data will inevitably be collected and reported, shared or resold to uncertain third parties, causing data leakage.

[0003] In addition, because personal browsers rarely consider data security when using local cache to improve access efficiency, when enterprise employees visit business websites on untrusted devices, local cache will bring leakage risks. It is common for employees to download attachments when visiting business websites. Although employees of different roles have very different operations when consuming these attachments, for example, some only need to open the attachments in read-only mode (layout), while others need to edit the attachments (streaming), in most cases, the attachments will be downloaded in plain text to local temporary storage. The security of data depends on whether the device is "trustworthy". This is an open question. No one can guarantee that the device is "trustworthy" enough, and it is even difficult to reach a consensus on how to define "trustworthy". Therefore, personal browsers that are frequently used in enterprises cannot provide such security guarantees, which poses a great risk to the data security of enterprises. Summary of the invention

[0004] The purpose of the present invention is to overcome the above-mentioned shortcomings of the prior art and provide a method for downloading and viewing documents based on a browser, which can perform policy protection on documents when they are downloaded, and a system for implementing the method.

[0005] The present invention is achieved through the following technical solutions:

[0006] A method for downloading and viewing documents based on a browser comprises the following steps:

[0007] S1. Install a dedicated browser on the local device. The team administrator assigns accounts to each user in the team and sets a storage policy on the policy server for each user to download and store corresponding documents on each business website through the dedicated browser. The policy server sends the storage policy to the dedicated browser.

[0008] S2. When a user logs in to a dedicated browser through his account in the team to access a website, the dedicated browser determines whether the visited website is a protected website defined in the storage policy based on the URL of the visited website. If so, the dedicated browser performs a download protection operation based on the pre-acquired storage policy. When the user needs to download a document that needs to be encrypted from a protected business website, the dedicated browser stores the document in a memory sandbox, local storage or cloud storage based on the storage policy, and calls the encryption suite to encrypt the document stored in the memory sandbox and local storage.

[0009] S3. After the dedicated browser has downloaded the document, the user clicks to open the document immediately or at an appropriate time in the download manager interface of the dedicated browser; when opening an encrypted document, the dedicated browser first finds the encrypted document from the storage space (memory sandbox, local storage), then calls the decryption suite to decrypt the document, and then calls the document plug-in preset in the dedicated browser to open the decrypted document;

[0010] S4. After exiting the dedicated browser, the dedicated browser will clean up all encrypted documents downloaded locally after the browser is opened this time.

[0011] Furthermore, the method for storing the document in the memory sandbox in step S2 is:

[0012] S2-11. When a user needs to download a document from a business website, the dedicated browser determines whether the file type returned by the business website is the document type specified in the storage policy. If not, the download operation is blocked; if yes, the storage location of the document is determined according to the storage policy;

[0013] S2-12. When it is determined that the document needs to be stored in the memory sandbox, the dedicated browser first generates a virtual path, then downloads the document to the memory sandbox and encrypts the document;

[0014] S2-13. The dedicated browser saves the virtual path, which is the entrance to access the document.

[0015] Furthermore, the method for the dedicated browser to generate a virtual path in step S2-12 is:

[0016] S2-121, the dedicated browser generates a random hash value and uses the value as the new file name, and the dedicated browser creates a mapping table between the original file name and the new file name in the memory;

[0017] S2-122, store the document in the sandbox directory and open it exclusively. The sandbox directory can only be accessed through a local WEB service, which is represented by a URL with the address 127.0.0.1, called the local file service URL;

[0018] S2-123. In the browser download manager, the original file name is displayed, but the access address of the document is a virtual address formed by concatenating the new name of the document to the local file service URL. This address is the virtual path displayed to the outside world.

[0019] Furthermore, the method for encrypting the document by using the encryption suite in step S2 is:

[0020] S2-21. The dedicated browser obtains the UserID and TeamID of the current user, and hashes the two together as the key; UserID is the user's ID, and TeamID is the ID of the team to which the user belongs;

[0021] S2-22. Use the SM4 encryption algorithm and the key in step S2-21 to encrypt the file.

[0022] Furthermore, in step S3, when the document is stored in the memory sandbox, the method for the dedicated browser to access the document in the memory sandbox is:

[0023] S3-11, the dedicated browser determines the type of the accessed object through the access path;

[0024] S3-12, when the access path is a local file service URL, the dedicated browser accesses the URL with parameters, and the parameters include a signed key;

[0025] S3-13, the file service module of the dedicated browser determines the identity of the visitor by verifying the key, and obtains the UserID and TeamID of the current user of the dedicated browser. The two IDs are hashed and used as the decryption key; UserID is the ID of the user, and TeamID is the ID of the team to which the user belongs;

[0026] S3-14. If the visitor is a dedicated browser and the decryption key is correct, the file service module decrypts the document in the memory sandbox and returns the document to the dedicated browser for opening; if the visitor is not a dedicated browser, or the decryption key is incorrect, the file service module denies access to the document.

[0027] Furthermore, in step S3, the method of calling the document plug-in preset in the dedicated browser to open the decrypted document is:

[0028] S3-21. The dedicated browser is pre-configured with a variety of document plug-ins; document plug-ins are extensions in the dedicated browser and are part of the dedicated browser, such as office extension plug-ins and pdf plug-ins;

[0029] S3-22, the dedicated browser registers the opening method of the specified type of document as the corresponding document plug-in;

[0030] S3-23. When the file service module in the dedicated browser returns a document of a specified type, the dedicated browser calls the corresponding document plug-in to open the document.

[0031] Furthermore, in step S1, the team administrator sets the storage policy through the policy configuration page. One policy configuration page corresponds to the storage policy of a business website. The scope of users in the team to which the storage policy applies is set on the policy configuration page.

[0032] Furthermore, the document is in doc, docx, ppt, pptx, xls, xlsx or pdf format, and the corresponding document plug-in is an office extension plug-in, a pdf plug-in, etc.

[0033] Furthermore, the storage policy includes the URL of the business website, the applicable user range, the document type, the document storage location, the document opening method and whether the document is deleted upon exit.

[0034] A system for downloading and viewing documents based on a browser, used to implement the above-mentioned method for downloading and viewing documents based on a browser, comprising a policy server and a dedicated browser;

[0035] The policy server is used by the team administrator to assign accounts to each user in the team, set storage policies for documents on each business website, and send the storage policies to the dedicated browser;

[0036] The dedicated browser includes a network module, a file download module, a file service module and a document viewing module. The network module is used to connect to a business website and a policy server; the file download module is used to download documents from the business website, and download the documents to a memory sandbox, a local storage device and a cloud storage device according to a storage policy; the file service module is used to encrypt and save the documents downloaded by the dedicated browser, and when an external program accesses the document, verify the visitor's identity, obtain a decryption key, decrypt the document and return the plaintext document; the document viewing module is used to receive and open the plaintext document decrypted by the file service module, and the document viewing module includes a document plug-in, and the document plug-in is used to view documents of corresponding types.

[0037] The present invention constrains the downloading behavior of files in the form of policy services, realizes basic data interaction authorization by limiting the upload and download behaviors at the browser kernel layer, realizes disk encryption of common format documents through configurable policies, and the encrypted documents will be automatically deleted after consumption, and the documents can be stored in a suitable location such as a memory sandbox, local storage or cloud according to the policy configuration, which greatly enhances the security of enterprise data and fully respects the personal habits of users; the files stored in the memory sandbox need to be accessed by visitors through a virtual path, and only by logging in to a dedicated browser and adapting to the corresponding user and team, and passing the dual authentication of the access program and the decryption key, can the documents in the sandbox be accessed, thereby ensuring the security of the documents; the dedicated browser can open and edit various types of documents through document plug-ins, and does not rely on the huge document processing software installed in the local device, such as the office suite, and the local device can open and edit downloaded documents without installing the corresponding software, thereby improving the speed and convenience of accessing business website data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention.

[0039] Figure 2 It is a structural block diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0040] A browser-based method for downloading and viewing documents, such as Figure 1 As shown, the following steps are included:

[0041] S1. Install a dedicated browser on the local device. The team administrator assigns accounts to each user in the team and sets storage policies on the policy server for each user to download and store corresponding documents on each business website through the dedicated browser. The policy server sends the storage policy to the dedicated browser.

[0042] The team administrator sets the storage policy through the policy configuration page. One policy configuration page corresponds to the storage policy of a business website. The scope of users in the team to which the storage policy applies is set on the policy configuration page. It can be all members of the team, or part or a certain component. The storage policy includes the URL of the business website, the applicable user scope, the document type, the document storage location, the document opening method, and whether the document is deleted upon exit.

[0043] For enterprises, in order to regulate the document downloading behavior of enterprise employees when logging into certain business websites of the enterprise, when setting storage policies, it is necessary to enter the URL of the corresponding business website on the storage policy configuration page, set the types of documents that can be downloaded from the business website, and set the location where each type of document can be stored on the browser side. The storage strategy for document download is configured according to the document type. The document type can be classified according to the document format type. For documents of certain formats, such as seven document types, namely doc, docx, xls, xlsx, ppt, pptx, and pdf, these seven document types can only be stored in the memory sandbox and encrypted, or in the cloud storage space when downloaded. For "other" types other than these seven document types, files are allowed to be downloaded to the local disk, stored in the user-specified area, or prohibited from downloading. They can also be classified according to the specific content of the document. The team administrator classifies these documents in advance according to the content, which files need to be stored in the sandbox, which need to be stored in the cloud storage space, which can be downloaded to the local disk or other storage space as specified by the user, which have a high confidentiality level, which have a general confidentiality level, and which do not need to be confidential. For example, some less important documents can be saved on local devices (such as hard disks, USB flash drives, etc.), of course, they can also be stored in memory sandboxes and cloud storage. For some important documents that are not suitable for widespread dissemination, they can be set to be stored only in memory sandboxes or cloud storage spaces, and prohibited from being stored on local storage devices. Similarly, the document exit deletion method can also be set according to the document type. For some important documents, users need to delete them when they exit the browser or log out. This can be set according to the actual situation. These policies and rules are set by the team administrator on the storage policy configuration page, and only the administrator can set relevant permissions.

[0044] S2. When a user logs in to a dedicated browser through his account in the team to access a website, the dedicated browser determines whether the visited website is a protected website defined in the storage policy based on the URL of the visited website. If so, the download protection operation is performed according to the pre-acquired storage policy; when the user needs to download a document that needs to be encrypted from a protected business website, the dedicated browser stores the document in the memory sandbox, local storage or cloud storage according to the storage policy, and calls the encryption suite to encrypt the document stored in the memory sandbox and local storage. For documents stored in the cloud storage, since the corresponding account needs to be verified when accessing the cloud storage, a layer of encryption is actually performed, which can also ensure the security of the document.

[0045] The method for storing documents in the memory sandbox is:

[0046] S2-11. When a user needs to download a document from a business website, the dedicated browser determines whether the file type returned by the business website is the document type specified in the storage policy. If not, the download operation is blocked; if so, the storage location of the document is determined according to the storage policy.

[0047] S2-12. When it is determined that the document needs to be stored in the memory sandbox, the dedicated browser first generates a virtual path, then downloads the document to the memory sandbox and encrypts the document;

[0048] S2-13. The dedicated browser saves the virtual path, which is the entrance to access the document.

[0049] Among them, the method for the dedicated browser to generate a virtual path is:

[0050] S2-121, the dedicated browser generates a random hash value and uses the value as the new file name, and the dedicated browser creates a mapping table between the original file name and the new file name in the memory;

[0051] S2-122, store the document in the sandbox directory and open it exclusively. The sandbox directory can only be accessed through a local WEB service, which is represented by a URL with the address 127.0.0.1, called the local file service URL;

[0052] S2-123. In the browser download manager, the original file name is displayed, but the access address of the document is a virtual address formed by concatenating the new name of the document to the local file service URL. This address is the virtual path displayed to the outside world.

[0053] Among them, the method of encrypting a document by using an encryption suite is:

[0054] S2-21. The dedicated browser obtains the UserID and TeamID of the current user, and hashes the two together as the key; UserID is the user's ID, and TeamID is the ID of the team to which the user belongs;

[0055] S2-22. Use the SM4 encryption algorithm and the key in step S2-21 to encrypt the file.

[0056] S3. After the dedicated browser downloads the document, the user clicks to open the document immediately or at an appropriate time in the download manager interface of the dedicated browser; when opening an encrypted document, the dedicated browser first finds the encrypted document from the storage space (memory sandbox, local storage), then calls the decryption suite to decrypt the document, and then calls the document plug-in pre-installed in the dedicated browser to open the decrypted document.

[0057] When a document is stored in a memory sandbox, the method for a dedicated browser to access the document in the memory sandbox is:

[0058] S3-11. The dedicated browser determines the type of the accessed object through the access path.

[0059] S3-12. When the access path is a local file service URL, the dedicated browser accesses the URL with parameters, which include a signed key; this key is used by the local file service module to verify whether the visitor is a dedicated browser program, and other programs cannot access it.

[0060] S3-13. The file service module of the dedicated browser determines the identity of the visitor by verifying the key, and obtains the UserID and TeamID of the current user of the dedicated browser. These two IDs are hashed and used as the decryption key; UserID is the user's ID, and TeamID is the ID of the team to which the user belongs.

[0061] S3-14. If the visitor is a dedicated browser and the decryption key is correct, the file service module decrypts the document in the memory sandbox and returns the document to the dedicated browser for opening; if the visitor is not a dedicated browser, or the decryption key is incorrect, the file service module denies access to the document.

[0062] The security of document access can be guaranteed by double authentication of access programs and decryption keys. The user ID and team ID information are embedded in the above document encryption and decryption keys, making the downloaded documents strongly dependent on users and teams. Only user accounts in the corresponding team can access the documents. Team administrators can authorize and restrict users' document access behavior.

[0063] The method in which the dedicated browser calls the document plug-in preset in the dedicated browser to open the decrypted document is:

[0064] S3-21. The dedicated browser is pre-configured with a variety of document plug-ins; the document plug-in is an extension in the dedicated browser and is a part of the dedicated browser. The document can be in the format of doc, docx, ppt, pptx, xls, xlsx or pdf. Accordingly, the document plug-in can be an office extension plug-in, a pdf plug-in, etc.

[0065] S3-22, the dedicated browser registers the opening method of the specified type of document as the corresponding document plug-in;

[0066] S3-23. When the file service module in the dedicated browser returns a document of a specified type, the dedicated browser calls the corresponding document plug-in to open the document.

[0067] S4. After exiting the dedicated browser, the dedicated browser will clean up all encrypted documents downloaded locally after the browser is opened this time.

[0068] The present invention authorizes and manages the document storage behavior of users in the team in units of teams. An enterprise may have multiple teams according to different business types, and the document storage permissions of each team may be different. Different members in the same team may also have different storage permissions, which can ensure document security while taking flexibility into account. Each team administrator sets the user range applicable to each storage policy in the setting interface, and can select all or part of the team members according to actual conditions. Only users with permissions can log in to the corresponding business website to download documents and store them in the specified storage space. When a user is removed from the team (login account is deleted), he or she will not have the permission to download documents on the corresponding website, and even the originally downloaded and stored files cannot be accessed because of the inconsistency of the decryption key, or the document can no longer be accessed because the browser is set to clear the downloaded documents after exiting.

[0069] A system for downloading and viewing documents based on a browser, used to implement the above-mentioned method for downloading and viewing documents based on a browser, such as Figure 2 As shown, it includes a policy server and a dedicated browser.

[0070] The policy server is used by the team administrator to assign accounts to each user in the team, set storage policies for documents on each business website, and send the storage policies to the dedicated browser; the policy server is generally located in the dedicated browser server.

[0071] The dedicated browser includes a network module, a file download module, a file service module and a document viewing module, wherein the network module is used to connect to a business website and a policy server. The file download module is used to download documents from the business website, and download the documents to a memory sandbox, a local storage device and a cloud storage device according to a storage policy. The file service module is used to encrypt and save the documents downloaded by the dedicated browser, and when an external program accesses the document, verify the visitor's identity, obtain a decryption key, decrypt the document and return the plaintext document. In the present invention, only when the visitor is a dedicated browser program and the decryption key obtained by the user's ID and the ID of the team to which the user belongs matches, can the document be accessed and decrypted and transmitted to the dedicated browser.

[0072] The document viewing module is used to receive and open the plaintext document decrypted by the file service module. The document viewing module includes a document plug-in, and the document plug-in is used to view documents of corresponding types.

[0073] When downloading files from the enterprise business website, the dedicated browser can establish a reliable middle layer between the enterprise business system and the local device. When the user connects to the browser server through the dedicated browser, the document protection policy set by the team administrator is obtained from the server in the form of a policy. The team administrator can grant corresponding permissions to the members of the team to download documents, which can be flexible and managed according to individual needs. For files with a higher confidentiality level, they can be directly set to be stored only in the memory sandbox and encrypted. When accessing, the dedicated browser and user account need to be verified, and they can be cleared after the access, leaving no access traces on the local device.

[0074] The above detailed description is a specific description of a feasible embodiment of the present invention. The embodiment is not intended to limit the patent scope of the present invention. Any equivalent implementation or modification that does not deviate from the present invention should be included in the patent scope of this case.

Claims

1. A method for downloading and viewing documents based on a browser, characterized in that: The steps include: S1. Install a dedicated browser on the local device. The team administrator assigns accounts to each user in the team and sets a storage policy on the policy server for each user to download and store corresponding documents on each business website through the dedicated browser. The policy server sends the storage policy to the dedicated browser. S2. When a user logs in to a dedicated browser through his account in the team to access a website, the dedicated browser determines whether the visited website is a protected website defined in the storage policy based on the URL of the visited website. If so, the dedicated browser performs a download protection operation based on the pre-acquired storage policy. When the user needs to download a document that needs to be encrypted from a protected business website, the dedicated browser stores the document in a memory sandbox, local storage or cloud storage based on the storage policy, and calls the encryption suite to encrypt the document stored in the memory sandbox and local storage. S3. After the dedicated browser downloads the document, the user clicks to open the document immediately or at an appropriate time in the download manager interface of the dedicated browser; when opening the encrypted document, the dedicated browser first finds the encrypted document from the memory sandbox or local storage, then calls the decryption suite to decrypt the document, and then calls the document plug-in preset in the dedicated browser to open the decrypted document; S4. After exiting the dedicated browser, the dedicated browser will clean up all encrypted documents downloaded locally after the browser is opened this time.

2. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: The method for storing the document in the memory sandbox in step S2 is: S2-11. When a user needs to download a document from a business website, the dedicated browser determines whether the file type returned by the business website is the document type specified in the storage policy. If not, the download operation is blocked; if yes, the storage location of the document is determined according to the storage policy; S2-12. When it is determined that the document needs to be stored in the memory sandbox, the dedicated browser first generates a virtual path, then downloads the document to the memory sandbox and encrypts the document; S2-13. The dedicated browser saves the virtual path, which is the entrance to access the document.

3. A method for downloading and viewing documents based on a browser according to claim 2, characterized in that: The method for generating a virtual path by the dedicated browser in step S2-12 is: S2-121, the dedicated browser generates a random hash value and uses the value as the new file name, and the dedicated browser creates a mapping table between the original file name and the new file name in the memory; S2-122, store the document in a sandbox directory and open it exclusively. The sandbox directory can only be accessed through a local web service, which is represented by a URL with the address 127.0.0.1, called the local file service URL; S2-123. In the browser download manager, the original file name is displayed, but the access address of the document is a virtual address formed by concatenating the new name of the document to the local file service URL. This address is the virtual path displayed to the outside world.

4. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: The method for encrypting the document by using the encryption suite in step S2 is: S2-21. The dedicated browser obtains the UserID and TeamID of the current user, and hashes the two together as a key; UserID is the user's ID, and TeamID is the ID of the team to which the user belongs; S2-22. Use the SM4 encryption algorithm and the key in step S2-21 to encrypt the file.

5. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: In step S3, the user opens the downloaded document immediately or at an appropriate time. When the document is stored in the memory sandbox, the method for the dedicated browser to access the document in the memory sandbox is: S3-11, the dedicated browser determines the type of the accessed object through the access path; S3-12, when the access path is a local file service URL, the dedicated browser accesses the URL with parameters, and the parameters include a signed key; S3-13, the file service module of the dedicated browser determines the identity of the visitor by verifying the key, and obtains the UserID and TeamID of the current user of the dedicated browser. The two IDs are hashed and used as the decryption key; UserID is the ID of the user, and TeamID is the ID of the team to which the user belongs; S3-14. If the visitor is a dedicated browser and the decryption key is correct, the file service module decrypts the document in the memory sandbox and returns the document to the dedicated browser for opening; if the visitor is not a dedicated browser, or the decryption key is incorrect, the file service module denies access to the document.

6. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: The method for calling the preset document plug-in in the dedicated browser to open the decrypted document in step S3 is: S3-21, the dedicated browser is pre-configured with a variety of document plug-ins; S3-22, the dedicated browser registers the opening method of the specified type of document as the corresponding document plug-in; S3-23. When the file service module in the dedicated browser returns a document of a specified type, the dedicated browser calls the corresponding document plug-in to open the document.

7. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: In step S1, the team administrator sets the storage policy through the policy configuration page. One policy configuration page corresponds to the storage policy of a business website. The scope of users in the team to which the storage policy applies is set on the policy configuration page.

8. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: The document is in doc, docx, ppt, pptx, xls, xlsx or pdf format.

9. A method for downloading and viewing documents based on a browser according to claim 1, characterized in that: The storage policy includes the URL of the business website, applicable user scope, document type, document storage location, document opening method, and whether the document is deleted upon exit.

10. A system for downloading and viewing documents based on a browser, used to implement the method for downloading and viewing documents based on a browser as claimed in any one of claims 1 to 9, characterized in that: Includes a policy server and a dedicated browser; The policy server is used by the team administrator to assign accounts to each user in the team, set storage policies for documents on each business website, and send the storage policies to the dedicated browser; The dedicated browser includes a network module, a file download module, a file service module and a document viewing module. The network module is used to connect to the business website and the policy server; the file download module is used to download documents from the business website and download the documents to the memory sandbox, local storage and cloud storage according to the storage policy; The file service module is used to encrypt and save the documents downloaded by the dedicated browser, and when an external program accesses the document, it verifies the visitor's identity, obtains the decryption key, decrypts the document and returns the plaintext document; the document viewing module is used to receive and open the plaintext document decrypted by the file service module, and the document viewing module includes a document plug-in, which is used to view documents of the corresponding type.

Images