File tracing method and system, computer equipment and storage medium

Abstract

The invention discloses a file tracing method and system, computer equipment and a storage medium. The method comprises the following steps: receiving a file downloading request sent by a business system through an object storage system; according to the file downloading request, file traceability information is generated, and user permission is verified; if the user permission is verified to be correct, obtaining a target file matched with the file downloading request; backing up the target file to obtain a backup file; calling a PDF signature function to put the file traceability information into the backup file to obtain a target backup file containing the traceability information; and when the target backup file is leaked, determining a risk operator according to the file traceability information in the target backup file. According to the method and the device, the traceability information is added to the file in the file downloading stage in allusion to the insurance policy file leakage condition, and the first person in charge of information leakage is confirmed through the traceability information when the file leakage occurs, so that the traceability accuracy is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of insurance document traceability management, and in particular to a document traceability method, system, computer equipment and storage medium. Background Art

[0002] The rapid development of information technology has enabled important documents such as insurance policies and insurance document records, which were originally kept on paper, to be stored in the insurance system in the form of electronic documents. In addition to the customers themselves, insurance salesmen, brokers and other personnel may need to access relevant documents. When policy data is leaked, it is impossible to further determine who is responsible for the leaked data. At this time, it is necessary to check the access to insurance document files. Therefore, there is an urgent need for a method to determine the person responsible for the policy information leak. Summary of the invention

[0003] The embodiments of the present invention provide a file tracing method, system, computer device and storage medium to determine the person responsible for the leakage of insurance policy information.

[0004] The first aspect of the present application provides a file tracing method, comprising: The object storage system receives a file download request sent by the business system; The object storage system generates file traceability information and verifies user authority based on the file download request; After verifying that the user's authority is correct, the object storage system obtains a target file that matches the file download request; The object storage system backs up the target file to obtain a backup file; The object storage system calls the PDF signature function to put the file traceability information into the backup file, and obtains a target backup file containing the traceability information; When the target backup file is leaked, the object storage system identifies the risk operator according to the file tracing information in the target backup file.

[0005] A second aspect of the present application provides a file tracing system, including: an object storage system: The object storage system is used to receive a file download request sent by a business system, generate file tracing information and verify user permissions based on the file download request, obtain a target file that matches the file download request after verifying that the user permissions are correct, back up the target file to obtain a backup file, put the file tracing information into the backup file to obtain a target backup file containing tracing information, and when the target backup file is leaked, confirm the risk operator based on the file tracing information in the leaked target backup file.

[0006] A third aspect of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned file tracing method when executing the computer program.

[0007] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned file tracing method is implemented.

[0008] In the scheme implemented by the above-mentioned file tracing method, system, computer equipment and storage medium, a file download request sent by a business system is received through an object storage system; based on the file download request, file tracing information is generated and user authority is verified; if the user authority is verified to be correct, a target file matching the file download request is obtained; the target file is backed up to obtain a backup file; the PDF signature function is called to put the file tracing information into the backup file to obtain a target backup file containing tracing information; when the target backup file is leaked, the risk operator is confirmed based on the file tracing information in the target backup file. In the present invention, in response to the leakage of insurance policy files, tracing information is first added to the file in the file download stage, and when the file leakage occurs, the first person responsible for the information leakage is confirmed through the tracing information, which greatly improves the accuracy of tracing, and multiple signatures of the file do not conflict with each other, and will not affect the validity of the signature of the downloaded file. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0010] Figure 1 This is a schematic diagram of an application environment of a file tracing method in one embodiment of the present invention; Figure 2 is a flow chart of a file tracing method in one embodiment of the present invention; Figure 3 is another flow chart of a file tracing method in one embodiment of the present invention; Figure 4 is another flow chart of a file tracing method in one embodiment of the present invention; Figure 5 is another flow chart of a file tracing method in one embodiment of the present invention; Figure 6 is a schematic diagram of a PDF file tracing system in one embodiment of the present invention; Figure 7 is a schematic diagram of a computer device in one embodiment of the present invention; Figure 8 It is another structural schematic diagram of a computer device in one embodiment of the present invention. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0012] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0013] It should also be understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0014] As used in the present specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]", depending on the context.

[0015] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0016] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0017] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0018] The file tracing method provided by the embodiment of the present invention can be applied as follows: Figure 1 Specifically, the file tracing method is applied in a file tracing system, and the PDF file tracing system includes: Figure 1The client and server shown in the figure communicate with each other through a network, and the server includes an object storage system and a security platform, wherein the object storage system receives a file download request sent by a business system through the object storage system, generates file traceability information and verifies user authority according to the file download request, and obtains a target file matching the file download request if the user authority is verified to be correct, backs up the target file to obtain a backup file, calls a PDF signature function to put the file traceability information into the backup file, obtains a target backup file containing traceability information, and when the target backup file is leaked, confirms the risk operator according to the file traceability information in the target backup file. The security platform is used to receive the file download request forwarded by the object storage system, monitor the download of the target backup document by the business system according to the download request, and receive the object storage system open verification interface, thereby obtaining the public key in the object storage system, verifies the authenticity of the traceability information of the leaked target backup file, and sends the authenticity verification result to the object storage system, so that the object storage system confirms the risk operator according to the authenticity verification result. In the present invention, in case of leakage of insurance policy files, traceability information is first added to the files in the file download stage. When the file leakage occurs, the first person responsible for the information leakage is confirmed through the traceability information, which greatly improves the accuracy of traceability, and the multiple signatures of the files do not conflict with each other, and will not affect the validity of the signature of the downloaded file. Among them, the client is also called the business system, which refers to a program corresponding to the server and providing local services to customers. The business system is used to send a file download request to the object storage system, receive the target backup file downloaded from the object storage system, and upload the leaked target backup file to the object storage system or the security platform when the target backup file is leaked, so that the object storage system verifies the authenticity of the traceability information in the leaked target backup file. The client can be installed on but not limited to various personal computers, laptops, smart phones, tablet computers and other devices. The server can be implemented as an independent server or a server cluster composed of multiple servers.

[0019] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.

[0020] In one embodiment, if Figure 2 As shown, a flowchart of a file tracing method is provided, and the method is applied in Figure 2 The following steps are used as an example: S10: The object storage system receives a file download request sent by the business system; S20: The object storage system generates file traceability information and verifies user authority according to the file download request; Specifically, the file tracing method provided by the present invention can be applied to various file storage systems. In the present invention, files are stored in an object storage system. When a target document needs to be downloaded, the business system sends a file download request to the object storage system, generates tracing information based on the generated file download request, and verifies the user's authority. The file can be downloaded only after the user's authority is verified. The tracing information includes: the user ID of the target document being downloaded, the business system name, the service name, the file summary, the download time, and other information.

[0021] S30: After verifying that the user's authority is correct, the object storage system obtains a target file that matches the file download request; Specifically, according to the user's attributes (such as department, rank, etc.), for example, an insurance agent has the right to view the insurance policies handled by himself. In addition, the insurance business manager has the right to view all insurance policies in the department, while other insurance agents do not have the right to download and view. Therefore, when an insurance agent needs to download a certain insurance policy, the department and rank of the insurance agent will be verified, and the user attributes of the insurance agent will be obtained. If the target insurance policy is not handled by the insurance agent and is not the insurance business manager, the insurance agent does not have the right to download the target policy. If the insurance business manager or the target policy is handled by the insurance agent, then the insurance agent has the right to download it. When downloading the target file, in addition to the user's attributes, it is also necessary to verify the operating environment (such as IP address, time, etc.) to determine whether the operating environment for downloading the target file is safe and to verify the attributes of the resources of the downloaded target file (such as document classification, etc.), and comprehensively determine whether the user has access rights. If it is verified that the user has the right to download the file, then the target file matching the file download request is obtained, and the target file is the original file stored in the object storage system.

[0022] S40: the object storage system backs up the target file to obtain a backup file; S50: the object storage system puts the file traceability information into the backup file to obtain a target backup file containing the traceability information; S60: When the target backup file is leaked, the object storage system identifies the risk operator according to the file tracing information in the target backup file.

[0023] Specifically, after the user's authority is verified, the target file that matches the file download request is searched, and the target file is backed up to obtain a backup file. Then, the object storage system will call the PDF signature function to put the file traceability information into the backup file. At this time, a target backup file containing traceability information is obtained, and the target file has been retained in the object storage system without any changes, which can facilitate other users to download the file later. When the target backup file is leaked, the risk operator can be confirmed based on the traceability information in the target backup file. Among them, the PDF signature function ensures that the newly added traceability information will not conflict with other original signatures of the insurance document, does not destroy the integrity of the file, and does not affect the integrity verification of other signatures. In this embodiment, a file download request sent by a business system is received, and file traceability information is generated and user permissions are verified based on the file download request. If the user permissions are verified to be correct, a target file matching the file download request is obtained, the target file is backed up to obtain a backup file, and a PDF signature function is called to put the file traceability information into the backup file to obtain a target backup file containing traceability information. When the target backup file is leaked, the risk operator is confirmed based on the file traceability information in the target backup file. This application relies on the powerful processing performance of the object storage system itself, so that files support dynamic writing of traceability information during downloading, and the traceability information can be traced back to the risk operator who leaked the file, greatly improving the accuracy of traceability.

[0024] In one embodiment, Figure 3 , a flowchart of a file tracing method is provided. Figure 3 As shown, in step S60, the risk operator is confirmed according to the file tracing information in the target backup file, which specifically includes the following steps: S61: The object storage system receives a leaked target backup file uploaded by a business system, so that the object storage system obtains file tracing information in the leaked target backup file.

[0025] S62: The object storage system uses the public key to verify the authenticity of the traceability information in the signature page.

[0026] S63: The object storage system confirms the risk operator according to the authenticity verification result.

[0027] Specifically, when a file is leaked, the user is required to upload the leaked target backup file to the object storage system. The object storage system verifies the file by obtaining the traceability information in the leaked target backup file, where the traceability information is encrypted by the user using a private key in the signature page of the target backup file. Therefore, after the leaked target backup file is uploaded to the object storage system, the object storage system will use the public key to decrypt the private key in the signature page. The decrypted traceability information can clearly show the downloading user 1D, the business system name, service name, file summary, and download operation time. Information such as the signature page of the leaked target backup file is displayed. According to the content in the traceability information, the risk operator of the file leak can be locked.

[0028] In this embodiment, the leaked target backup file is uploaded to the object storage system so that the object storage system can obtain the file traceability information in the leaked target backup file, wherein the traceability information is encrypted by the user using a private key in the signature page of the target backup file; the object storage system uses a public key to verify the authenticity of the traceability information in the signature page; the object storage system confirms the risk operator based on the authenticity verification result, and decrypts the traceability information in the signature page of the leaked target backup file through the object storage system using the public key, and traces the decrypted information to the unique risk operator who downloaded the file, thereby greatly improving the accuracy of traceability.

[0029] In one embodiment, Figure 4 , a flowchart of a file tracing method is provided. Figure 4 As shown, in step S60, the risk operator is confirmed according to the file tracing information in the target backup file, which specifically includes the following steps: S64: the object storage platform opens a verification interface to the security platform, so that the security platform obtains the public key in the object storage system and verifies the authenticity of the leaked target backup file traceability information; S65: The security platform will perform authenticity verification based on the target backup file traceability information of the leaked target backup file.

[0030] S66: The object storage system receives the authenticity verification result of the security platform, and confirms the risk operator according to the authenticity verification result.

[0031] Specifically, the present application also provides a method for confirming the risk operator. When verifying the risk operator of the leaked target backup file, the traceability information of the leaked target backup file is verified through the security platform. After the document is uploaded to the security platform, since the object storage system trusts the security platform, the object storage system will open a verification interface to the security platform. The security platform obtains the public key of the object storage system through the interface, and uses the public key to decrypt the private key in the signature page to obtain the authenticity verification result. The security platform sends the authenticity verification result to the object storage system, and the object storage system confirms the risk operator based on the authenticity verification result. Among them, the decrypted traceability information can clearly see the downloading user 1D, the business system name, service name, file summary, and download operation time, etc. are displayed in the signature page of the leaked target backup file. According to the content in the traceability information, the risk operator of the file leak can be locked.

[0032] In this embodiment, the object storage platform opens a verification interface to the security platform, so that the security platform obtains the public key in the object storage system and verifies the authenticity of the leaked target backup file traceability information. The security platform verifies the authenticity of the target backup file traceability information of the leaked target backup file. The object storage system receives the authenticity verification result of the security platform and confirms the risk operator based on the authenticity verification result. The object storage system opens a verification interface to the security platform, so that the security platform can use the public key to decrypt the traceability information in the signature page of the leaked target backup file. The object storage system traces the file download to the only risk operator based on the decrypted information, which greatly improves the accuracy of traceability.

[0033] In one embodiment, Figure 5 , a flowchart of a file tracing method is provided, such as Figure 5 As shown, the authenticity verification of the obtained traceability information specifically includes the following steps: S70: the object storage system sends a download record query request to the security platform, so that the security platform queries the download record of the target backup document, wherein the download record includes the download operation time; S80: The security platform compares the found download operation time with the signature time in the backup document traceability information, so that the object storage system confirms the authenticity of the leaked target backup file.

[0034] S90: The object storage system compares the download operation time with the signature time in the leaked target backup file traceability information to confirm the authenticity of the leaked target backup file.

[0035] Specifically, while the object storage system uses the public key to decrypt the leaked information in the signature page of the leaked target backup file, the object storage system will also send a download record query request to the security platform so that the security platform can query the download record of the leaked target backup file, wherein the download record includes download operation time, download operator, download business system and other download information, and by comparing the download operation time found by the security platform with the signature time in the traceability information of the leaked target backup file, the object storage system can more accurately identify the risk operator of the leaked target backup file.

[0036] In this embodiment, the object storage system sends a download record query request to the security platform, so that the security platform queries the download record of the target backup document, wherein the download record includes the download operation time, and the download operation time found by the security platform is compared with the signature time in the backup document traceability information, so that the object storage system confirms the authenticity of the leaked target backup file.

[0037] In one embodiment, the object storage system forwards the file download request sent by the business system to the security platform, so that the security platform monitors the file download status of the business system, wherein the security platform monitors the file download status of the business system, specifically including the following steps: S01: The security platform parses the download message of the object storage system; S02: The security platform extracts the target backup document download records stored in the database according to the parsed download message, and performs a deduplication operation on the target backup document download records in the database, so as to obtain the file download status of the business system.

[0038] Specifically, after the object storage system receives the file download request sent by the business system, the object storage system forwards the file download request sent by the business system to the security platform. After obtaining the file download message forwarded by the object storage system, the security platform parses the download message to obtain the download record of the business system downloading the file, wherein the download record is stored in a database. In order to obtain the download record of the business system, it is necessary to deduplicate the download records stored in the database. After deduplication, a deduplicated file table will be generated in the database. The deduplication folder stores the download times of the target file downloaded by the business system, thereby obtaining the number of times the business system downloads the document.

[0039] Optionally, in one embodiment, the business system file download status is obtained, followed by: performing a sensitivity analysis on the content of the target backup document based on the business system file download status, so that the security platform records the sensitivity analysis results and warns the risky operator.

[0040] Specifically, when the number of times a business system downloads a target document is very high in a certain period of time, or a certain IP address downloads a target file very frequently within a period of time, for example, the number of times a business system requests to download exceeds the average number of downloads of the document, or the set target number of downloads within a period of time, then statistics are collected on users who download the business system. If the security platform determines that the user downloads the target file too frequently, then it is necessary to perform sensitive content analysis on the content of the file, such as identification of sensitive fields and sensitive images. The security platform conducts a comprehensive analysis of the user through sensitive fields, sensitive images and download times, and records are made based on the results of the sensitive analysis. If there is a problem with the results of the sensitive analysis, then the risk operator will be warned.

[0041] In this embodiment, the security platform parses the download message of the object storage system, extracts the target backup document download record stored in the database based on the download message parsed by the security platform, and deduplicates the target backup document download record in the database to obtain the business system file download status, and performs a sensitive analysis on the content of the target backup document based on the business system file download status, so that the security platform records the sensitive analysis results and warns the risk operator. When a leaked target backup file is found, the warning given by the security platform can further prove that the risk operator has a tendency to leak files.

[0042] In a scheme implemented by a file tracing method provided in the present application, a file download request sent by a business system is received through an object storage system; based on the file download request, file tracing information is generated and user authority is verified; if the user authority is verified to be correct, a target file matching the file download request is obtained; the target file is backed up to obtain a backup file; a PDF signature function is called to put the file tracing information into the backup file to obtain a target backup file containing tracing information; when the target backup file is leaked, the risk operator is confirmed based on the file tracing information in the target backup file. In the present invention, in response to the leakage of insurance policy files, tracing information is first added to the file in the file download stage, and when the file leakage occurs, the first person responsible for the information leakage is confirmed through the tracing information, which greatly improves the accuracy of tracing, and multiple signatures of the file do not conflict with each other, and will not affect the validity of the signature of the downloaded file.

[0043] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0044] In one embodiment, a file tracing system is provided. Figure 6 As shown in the figure, the file traceability system includes: object storage system, business system and security platform. The specific functional modules are described in detail as follows: The object storage system is used to receive a file download request sent by a business system, generate file tracing information and verify user authority based on the file download request, obtain a target file matching the file download request after verifying that the user authority is correct, back up the target file to obtain a backup file, put the file tracing information into the backup file to obtain a target backup file containing tracing information, and confirm the risk operator based on the file tracing information in the leaked target backup file when the target backup file is leaked; The business system is used to send a file download request to the object storage system, receive the target backup file downloaded from the object storage system, and when the target backup file is leaked, upload the leaked target backup file to the object storage system or the security platform, so that the object storage system verifies the authenticity of the traceability information in the leaked target backup file; The security platform is used to receive a file download request forwarded by the object storage system, monitor the download status of the target backup document by the business system based on the download request, and receive an open verification interface of the object storage system to obtain a public key in the object storage system, verify the authenticity of the traceability information of the leaked target backup file, and send the authenticity verification result to the object storage system, so that the object storage system can confirm the risk operator based on the authenticity verification result.

[0045] The present invention provides a file tracing system, which receives a file download request sent by a business system through an object storage system, generates file tracing information and verifies user authority based on the file download request, and obtains a target file that matches the file download request if the user authority is verified to be correct; backs up the target file to obtain a backup file, calls a PDF signature function to put the file tracing information into the backup file, and obtains a target backup file containing tracing information, and when the target backup file is leaked, confirms the risk operator based on the file tracing information in the target backup file. In the present invention, in response to the leakage of insurance policy files, tracing information is first added to the file in the file download stage, and when the file leakage occurs, the first person responsible for the information leakage is confirmed through the tracing information, which greatly improves the accuracy of tracing, and multiple signatures of the file do not conflict with each other, and will not affect the validity of the signature of the downloaded file.

[0046] For the specific definition of the file traceability system, please refer to the definition of the file traceability method above, which will not be repeated here. Each module in the above file traceability system can be implemented in whole or in part by software, hardware and their combination. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0047] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, it realizes the functions or steps of a service-side method of intelligent operation of a bank self-service counter based on artificial intelligence.

[0048] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input system connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server through a network connection. When the computer program is executed by the processor, a function or step based on the client side of the file tracing method is implemented.

[0049] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: The object storage system receives a file download request sent by the business system; The object storage system generates file traceability information and verifies user authority based on the file download request; After verifying that the user's authority is correct, the object storage system obtains a target file that matches the file download request; The object storage system backs up the target file to obtain a backup file; The object storage system puts the file traceability information into the backup file to obtain a target backup file containing the traceability information; When the target backup file is leaked, the object storage system identifies the risk operator according to the file tracing information in the target backup file.

[0050] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: The object storage system receives a file download request sent by the business system; The object storage system generates file traceability information and verifies user authority based on the file download request; After verifying that the user's authority is correct, the object storage system obtains a target file that matches the file download request; The object storage system backs up the target file to obtain a backup file; The object storage system puts the file traceability information into the backup file to obtain a target backup file containing the traceability information; When the target backup file is leaked, the object storage system identifies the risk operator according to the file tracing information in the target backup file.

[0051] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0052] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0053] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0054] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A file tracing method, characterized in that: include: The object storage system receives a file download request sent by the business system; The object storage system generates file traceability information and verifies user authority based on the file download request; After verifying that the user's authority is correct, the object storage system obtains a target file that matches the file download request; The object storage system backs up the target file to obtain a backup file; The object storage system puts the file traceability information into the backup file to obtain a target backup file containing the traceability information; When the target backup file is leaked, the object storage system identifies the risk operator based on the file tracing information in the leaked target backup file.

2. The file tracing method according to claim 1, characterized in that: Confirm the risk operator based on the file tracing information in the leaked target backup file, including: The object storage system receives the leaked target backup file uploaded by the business system, so that the object storage system obtains the file tracing information in the target backup file of the leaked target backup file, wherein the tracing information is encrypted by the user using a private key in the signature page of the target backup file; The object storage system uses the public key to verify the authenticity of the traceability information in the signature page; The object storage system confirms the risk operator according to the authenticity verification result.

3. The file tracing method according to claim 1, characterized in that: Confirm the risk operator based on the file tracing information in the leaked target backup file, including: The object storage system opens a verification interface to the security platform, so that the security platform obtains the public key in the object storage system and verifies the authenticity of the traceability information of the leaked target backup file; The security platform will verify the authenticity of the target backup file based on the target backup file traceability information of the leaked target backup file; The object storage system receives the authenticity verification result of the security platform, and confirms the risk operator according to the authenticity verification result.

4. The file tracing method according to claim 2-3 is characterized in that: Verify the authenticity of the traceability information obtained, including: The object storage system sends a download record query request to the security platform, so that the security platform queries the download record of the target backup document, wherein the download record includes the download operation time; The object storage system obtains the download operation time found by the security platform and the signature time in the leaked target backup file traceability information; The object storage system compares the download operation time with the signature time in the leaked target backup file traceability information to confirm the authenticity of the leaked target backup file.

5. The file tracing method according to claim 1, characterized in that: The object storage system forwards the file download request sent by the business system to the security platform, so that the security platform monitors the file download status of the business system.

6. The file tracing method according to claim 5, characterized in that: The security platform monitors the file downloading status of the business system, including: The security platform parses the download message of the object storage system; The security platform extracts the target backup document download records stored in the database according to the parsed download message, and performs a deduplication operation on the target backup document download records in the database, so as to obtain the file download status of the business system.

7. The file tracing method according to claim 6, characterized in that: Obtain the business system file download status, including: The security platform performs a sensitivity analysis on the content of the target backup document based on the business system file download situation, so that the security platform records the sensitivity analysis results and warns the risk operator.

8. A file tracing system, characterized in that: include: Object storage systems; The object storage system is used to receive a file download request sent by a business system, generate file tracing information and verify user permissions based on the file download request, obtain a target file that matches the file download request after verifying that the user permissions are correct, back up the target file to obtain a backup file, put the file tracing information into the backup file to obtain a target backup file containing tracing information, and when the target backup file is leaked, confirm the risk operator based on the file tracing information in the leaked target backup file.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the file tracing method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the file tracing method according to any one of claims 1 to 7 is implemented.

Images