File copy supervision method and device based on USB flash disk and medium

Abstract

The invention relates to the technical field of digital information security, and discloses a file copying supervision method and device based on a USB flash disk and a medium, which are applied to a first host in an intranet, and the method comprises the following steps: under the condition that the USB flash disk is connected to the first host, if the first host recognizes that an encrypted file is copied to the USB flash disk, determining that a preset editor program is deployed in the USB flash disk; the preset editor program is used for editing the encrypted file on a second host of the external network; under the condition that the USB flash disk is connected to a second host, the second host edits the encrypted file through a preset editor program, and generates an extranet editing record of the encrypted file in the USB flash disk; under the condition that the USB flash disk is connected to the first host again, reading an extranet editing record in the USB flash disk, and uploading the extranet editing record to an application server connected with an intranet; the extranet editing record is used for indicating the application server to supervise the USB flash disk, so that the technical effect that the file in the encrypted state can be taken away for safe editing is achieved.

Description

Technical Field

[0001] The present application relates to the field of digital information security technology, and in particular to a method, device and medium for supervising file copying based on a USB flash drive. Background Art

[0002] In important units such as government, enterprises, institutions, public security, telecommunications and banks, in order to solve the problem of data leakage through USB flash drive interface copying, many methods are adopted to restrict the use of USB flash drives by authenticating trusted USB flash drives, but the files copied out through trusted USB flash drives are out of control. In addition, in related technologies, the method of disabling USB flash drive copying behavior is also adopted to restrict the outflow of files. However, the method of disabling USB flash drive copying behavior needs to be improved to some extent, so it is necessary to propose a new method of file copying supervision based on USB flash drives. Summary of the invention

[0003] The present application provides a USB flash drive-based file copying supervision method, device and medium, which solves the technical problem of limiting the outflow of files by directly disabling the USB flash drive copying behavior in the related art, which causes inconvenience in use. The present application achieves the technical effect that when the file is in an encrypted state, it can be taken away for safe editing.

[0004] In order to achieve the above objectives, the main technical solutions adopted in this application include:

[0005] In a first aspect, an embodiment of the present application provides a USB-based file copy supervision method, which is applied to a first host in an intranet, and the method includes:

[0006] When the USB flash drive is connected to the first host, if the first host recognizes that an encrypted file is being copied to the USB flash drive, it is determined that a preset editor program has been deployed in the USB flash drive; wherein the preset editor program is a file editor for editing the encrypted file on a second host in an external network; when the USB flash drive is connected to the second host, the second host edits the encrypted file through the preset editor program, and generates an external network editing record of the encrypted file in the USB flash drive;

[0007] When the U disk is connected to the first host again, the external network editing record in the U disk is read, and the external network editing record is uploaded to the application server connected to the intranet; wherein the external network editing record is used to instruct the application server to supervise the U disk.

[0008] The present application provides a method for controlling copied encrypted files based on the USB flash drive authentication restrictions in the related art, which solves the problem that the files are in an encrypted state but there is a need for external copying and editing. The related art limits the outflow of files by directly disabling the USB flash drive copying behavior, but this brings a lot of inconvenience to the situation where there is a real need to copy the files away for editing.

[0009] The embodiment of the present application provides the possibility of external copy editing in an encrypted state for the U disk file inserted in the external network host and not connected to the internal network. When the U disk is connected to the second host, the U disk file is edited and saved using the specific file editor provided by the first host. Under the premise of ensuring the security of the encrypted file, that is, under the premise of being able to prevent the outflow of the content, the availability and convenience of the encrypted file are improved. The external network editing record is retained. After the U disk is connected to the first host again, the first host reads the external network editing record and uploads it to the application server connected to the internal network for subsequent viewing.

[0010] Optionally, before determining that a preset editor program has been deployed in the U disk, the method further includes: if the first host recognizes that the preset editor program does not exist in the U disk, copying the preset editor program to the U disk; if the first host recognizes that the preset editor program exists in the U disk, ensuring that the preset editor program can run normally.

[0011] Optionally, when the USB flash drive is connected to the first host, the method further includes: if the first host recognizes the copying behavior between the USB flash drive and the first host, recording and uploading a copy record to the application server, wherein the copy record is used to characterize the copying behavior.

[0012] Optionally, the external network editing record includes a unique identifier of the encrypted file; the method further includes: when the first host recognizes that the encrypted file is copied to the USB flash drive, writing the unique identifier to the encrypted file;

[0013] The unique identifier is set for the encrypted file in at least one of the following ways, including:

[0014] Writing the unique identifier into the file invisible attribute of the encrypted file;

[0015] Write a file invisible watermark to the encrypted file.

[0016] The problem of how to determine whether an encrypted file is the original copied encrypted file after it has been renamed or modified is solved. By changing the invisible attribute of the encrypted file or writing an invisible watermark to the encrypted file, the original copy-out record can be restored even if the content of the encrypted file has been changed. Furthermore, if the encrypted file has been copied in and out of the internal and external networks for multiple times, its circulation record can also be clearly restored.

[0017] Optionally, the USB disk has USB disk identification information; when the first host recognizes that the encrypted file is copied to the USB disk, the method further includes:

[0018] Determine the binding relationship between the encrypted file and the USB flash drive identification information;

[0019] Generate a file key based on the binding relationship;

[0020] The encrypted file is bound and encrypted using the file key, so that the first host copies the bound and encrypted encrypted file to the USB flash drive.

[0021] In a second aspect, an embodiment of the present application provides a USB-based file copy supervision method, which is applied to a second host in an external network, wherein the USB disk stores an encrypted file copied from a first host of content, and when the first host recognizes that the encrypted file is copied to the USB disk, it is determined that a preset editor program has been deployed in the USB disk, and the preset editor program is a file editor for editing the encrypted file on the second host; the method includes:

[0022] When the U disk is connected to the second host, the encrypted file is edited by the preset editor program, and an external network editing record of the encrypted file is generated in the U disk; wherein, when the U disk is connected to the first host again, the first host uploads the external network editing record to an application server connected to the intranet, so that the application server supervises the U disk according to the external network editing record.

[0023] The embodiment of the present application provides the possibility of external copy editing in an encrypted state for the U disk file inserted in the external network host and not connected to the internal network. When the U disk is connected to the second host, the U disk file is edited and saved using the specific file editor provided by the first host, which improves the usability and convenience of the encrypted file while ensuring the security of the encrypted file. The external network editing record is also retained, so that after the U disk is connected to the first host again, the first host reads the external network editing record and uploads it to the application server connected to the internal network for subsequent viewing.

[0024] Optionally, after editing the encrypted file using the preset editor program, the method further includes: saving the edited encrypted file to the USB flash drive.

[0025] To solve the security problem that may be caused by the disconnection of the USB flash drive during the editing process when the editing content of the encrypted file is large and the editing time is too long, this application makes a judgment after the editing behavior is completed. If the USB flash drive is still connected to the second host at this time, the file is saved, thereby reducing the above security risks.

[0026] Optionally, the USB disk has USB disk identification information; the encrypted file is bound and encrypted based on a file key, and the file key includes a binding relationship between the encrypted file and the USB disk identification information;

[0027] Determine whether the USB flash drive is connected to the second host by:

[0028] By means of the preset editor program, judging whether the USB flash drive is connected to the second host based on the USB flash drive identification information and the binding relationship;

[0029] The method further includes: when it is determined that the USB flash drive is connected to the second host, unbinding the encrypted file, and editing the encrypted file after unbinding the encryption through the preset editor program.

[0030] Optionally, the editing of the encrypted file by the preset editor program further includes:

[0031] If the preset editor program loses mouse cursor lock, the clipboard of the encrypted file is cleared.

[0032] It is implemented that when the content in the preset editor program is copied and copied externally, the clipboard will be cleared and cannot be pasted because the editor loses focus; when copying externally to the preset editor program, it will not trigger the loss of focus, and when copying and pasting from internal to internal, it will not trigger the clearing of the clipboard of the encrypted file.

[0033] In a third aspect, an embodiment of the present application provides a USB-based file copy supervision device, which is applied to a first host in an intranet and includes an external copy module and a supervision module;

[0034] The external copy module is used for, when the U disk is connected to the first host, if the first host recognizes that the encrypted file is being copied to the U disk, determining that a preset editor program has been deployed in the U disk; wherein the preset editor program is a file editor for editing the encrypted file on the second host in the external network; when the U disk is connected to the second host, the second host edits the encrypted file through the preset editor program, and generates an external network editing record of the encrypted file in the U disk;

[0035] The supervision module is used to read the external network editing record in the U disk when the U disk is connected to the first host again, and upload the external network editing record to the application server connected to the intranet; wherein the external network editing record is used to instruct the application server to supervise the U disk.

[0036] In a fourth aspect, an embodiment of the present application provides a file copy supervision device based on a USB flash drive, which is applied to a second host in an external network, wherein the USB flash drive stores an encrypted file copied from a first host of the content, and when the first host recognizes that the encrypted file is copied to the USB flash drive, it is determined that a preset editor program has been deployed in the USB flash drive, and the preset editor program is a file editor for editing the encrypted file on the second host; the file copy supervision device includes an editing module;

[0037] The editing module is used to edit the encrypted file through a preset editor program when the USB flash drive is connected to the second host, and generate an external network editing record of the encrypted file in the USB flash drive; wherein, when the USB flash drive is connected to the first host again, the first host uploads the external network editing record to the application server connected to the intranet, so that the application server supervises the USB flash drive according to the external network editing record.

[0038] In a fifth aspect, an embodiment of the present application provides a computer device, including:

[0039] A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the above method by executing the computer instructions.

[0040] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A schematic diagram of the steps of a USB-based file copy supervision method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of the file copying and transferring process between the intranet and the intranet provided by an embodiment of the present invention;

[0044] Figure 3 The present invention provides a flowchart of a method for supervising file copying based on a USB flash drive. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0046] In important units such as government, enterprises, institutions, public security, telecommunications and banks, in order to solve the problem of data leakage through copying via USB flash drive interface, many of them adopt the method of trusted USB flash drive authentication and then restrict the use of USB flash drives. However, the files copied through the trusted USB flash drive are out of control. In addition, in related technologies, the method of directly disabling the USB flash drive copying behavior is adopted to restrict the outflow of files, which also ignores the need to copy files away for editing.

[0047] Reference Figure 1 The present application embodiment provides a USB-based file copy supervision method, which is applied to a first host in an intranet. The method includes:

[0048] S100. When a USB flash drive is connected to a first host, if the first host recognizes that an encrypted file is being copied to the USB flash drive, it is determined that a preset editor program has been deployed in the USB flash drive; wherein the preset editor program is a file editor for editing encrypted files on a second host in an external network; when the USB flash drive is connected to a second host, the second host edits the encrypted file through the preset editor program, and generates an external network editing record of the encrypted file in the USB flash drive.

[0049] The encrypted file may be obtained by encrypting the file that needs to be encrypted before being copied externally after the first host identifies the general file, and the state of the general file includes a state that allows direct external copying and a state that prohibits direct external copying. The first host may identify the general file based on sensitive word determination or open interfaces to obtain other system determination results. The first host uses one of the above methods to distinguish the general file into a state that allows direct external copying and a state that prohibits direct external copying.

[0050] Specifically, the first host in the intranet is connected to the application server, and a policy setting for prohibiting external copying is performed on the application server. The policy setting may be one or more of setting a terminal blacklist, setting a file name, setting a file content, setting a file type, setting a time period, and setting a specified size, and may be set in any combination. Setting a terminal blacklist may mean that all files in the blacklist terminal are prohibited from copying files, such as setting all files in the first host A as prohibited from copying files. Setting a file name may mean that the file name contains the prohibited copying of the set content, such as setting all files containing "classification" in the file name as prohibited from copying files. Setting file content may mean setting sensitive words, and limiting the number and type of sensitive words: such as the total number of sensitive words is not allowed to exceed the number; the number of sensitive word types is not allowed to exceed the number; each sensitive word is not allowed to exceed the number, etc. Setting a file type may mean setting a specified type of file not to be copied, such as setting a WORD file not to be copied. Setting a time period may mean that copying is not allowed in a specified time period, such as copying is not allowed during non-working hours. Setting a specified size may mean setting a predetermined file size range not to be copied, such as files exceeding 100M are not allowed to be copied.

[0051] The method based on sensitive word judgment can be to apply string matching algorithms (such as KMP algorithm, Aho-Corasick algorithm, etc.) to match sensitive words to the file content, and quickly detect whether sensitive words exist in the file. The method of opening an interface to obtain the judgment results of other judgment systems can be to make API calls to other judgment systems, such as: the first host in the intranet sends file information to request other judgment systems (sensitive information judgment systems). After receiving the request, the other judgment systems use their internal algorithms (such as content analysis and machine learning models, etc.) to analyze general files and generate judgment results and send them back to the first host.

[0052] The file can be encrypted by at least one of the following methods: file key, SM4 encryption, and preset custom rule encryption to achieve multiple encryption. Specifically, multiple encryption can be to first generate a key for encryption based on the file key, the file key includes the USB disk identification information of the USB disk, i.e., the USB disk number, which is used to bind the USB disk, and then encrypt the generated file key twice. The secondary encryption can be the national secret SM4 encryption with a fixed password, or it can be to encrypt the encrypted file key by shuffling it into the file stream according to a custom rule, or it can be to encrypt the file key by using SM4 encryption and a preset custom rule at the same time, which further improves the security. Furthermore, the encrypted file is automatically decrypted as a normal file when copied into the intranet.

[0053] The external network editing record can be obtained by editing the encrypted file and recording the editing process in the external network using a preset editor program. The external network editing record is used to effectively track and manage the editing activities of the encrypted file. The external network editing record may include user information, file information, timestamp and operation results. Among them, the user information may be the identification information of the second host that performs the editing operation; the file information may be the encrypted file name, path, version number, etc. being edited; the operation type may be at least one of open, edit and save; the timestamp may be the specific time of recording the editing operation; the operation result may be the information of the success or failure of the editing and saving operations.

[0054] For encrypted externally copied files, the editing behavior of the second external host cannot be known in real time to the first internal host. Encrypted externally copied files can only be edited through the preset editor program provided. When editing and saving, the second external host will encrypt and encode the editing records (including the hardware and system information of the editing computer (mac, hard disk serial number, system version, login system operator), time, size change before and after editing) and save them in the file. When the encrypted document is copied back to the first internal host, the first internal host will automatically decrypt the encrypted file, read the external network editing records, and upload them to the application server.

[0055] Determine that the preset editor program has been deployed in the USB flash drive in the following manner: Use the file explorer in the first host to open Finder to view the files and folders in the USB flash drive, where Finder is a file manager in the operating system of the first host, used to browse and manage files and folders on the first host. After finding the preset editor program in the USB flash drive, try to start it. If the program fails to start, you may need to check compatibility or other necessary files in the USB flash drive to determine that the preset editor program has been deployed in the USB flash drive.

[0056] Reference Figure 2 The execution subject of the method of the present application is the terminal control installed on the first host, and the terminal control is installed on the first host of the intranet. The first host refers to the host on which the terminal control is installed on the intranet, and the second host refers to the host on which the terminal control is not installed on the external network. The first hosts of the intranet are all connected to the application server to realize real-time interaction and query of information, so as to realize the upload and query of the editing records of the external network.

[0057] For files that are not allowed to be copied directly to external devices, encrypted copies are made and the copy records are uploaded to the application server. At the same time, if the preset editor program is not deployed in the U disk, the preset editor program is copied to the U disk. The preset editor program can be a document editor or an exe program that can be run by clicking. When the U disk is inserted into the second host on the external network, the encrypted document can be encrypted and edited using the copied preset editor program. In the encrypted editing state, other external applications of the second host, such as screenshot or screen recording functions, are restricted.

[0058] S200. When the USB flash drive is connected to the first host again, read the external network editing record in the USB flash drive, and upload the external network editing record to the application server connected to the intranet; wherein the external network editing record is used to instruct the application server to supervise the USB flash drive.

[0059] Among them, the application server can also be considered as an intranet cloud platform, which is used to synchronize the operation records of the intranet host in real time and save the external network editing records to the database of the application server. In this way, multiple different first host devices in the intranet can always obtain the latest data status of the external network editing records when working.

[0060] The present application provides a method for controlling copied encrypted files based on the USB flash drive authentication restrictions in the related art, which solves the problem that the files are in an encrypted state but there is a need for external copying and editing. The related art limits the outflow of files by directly disabling the USB flash drive copying behavior, but this brings a lot of inconvenience to the situation where there is a real need to copy the files away for editing.

[0061] The embodiment of the present application provides the possibility of external copy editing in an encrypted state for the U disk file inserted in the external network host and not connected to the internal network. When the U disk is connected to the second host, the U disk file is edited and saved using the specific file editor provided by the first host. Under the premise of ensuring the security of the encrypted file, that is, under the premise of being able to prevent the outflow of the content, the availability and convenience of the encrypted file are improved. The external network editing record is retained. After the U disk is connected to the first host again, the first host reads the external network editing record and uploads it to the application server connected to the internal network, which is convenient for subsequent management and query supervision. After a problem occurs, the relevant editing record can be quickly located to reduce potential data leakage or loss.

[0062] As an implementation mode, before determining that the preset editor program has been deployed in the USB flash drive, the method further includes: if the first host recognizes that the preset editor program does not exist in the USB flash drive, copying the preset editor program to the USB flash drive. Further, if the first host recognizes that the preset editor program exists in the USB flash drive, ensuring that the preset editor program can run normally.

[0063] As an implementation mode, when the USB flash drive is connected to the first host, the method further includes: if the first host recognizes the copying behavior between the USB flash drive and the first host, recording and uploading a copy record to the application server, wherein the copy record is used to characterize the copying behavior.

[0064] The copy record includes the copy source, copy target, timestamp, operator information, copy file type, and copy status of the copy behavior. When the copy behavior occurs from the USB flash drive to the first host, the copy source is the USB flash drive and the copy target is the first host, or when the copy behavior occurs from the first host to the USB flash drive, the copy source is the first host and the copy target is the USB flash drive. The operator information can be the user or system that performs the copy operation to facilitate responsibility tracing. The copy file type can be a text file, an image file, or a video file. The copy status can be a copy success or a copy failure.

[0065] As an implementation mode, the external network editing record includes a unique identifier of the encrypted file; the method further includes: when the first host recognizes that the encrypted file is copied to the USB flash drive, writing the unique identifier to the encrypted file.

[0066] The unique identifier is set for the encrypted file in at least one of the following ways, including:

[0067] Writing the unique identifier into the file invisible attribute of the encrypted file;

[0068] Write a file invisible watermark to the encrypted file.

[0069] The globally unique identifier GUID (Globally Unique Identifier) ​​may be an identifier used to uniquely identify information, and is usually composed of a group of 32 hexadecimal digits in a string format of 8-4-4-4-12, such as:

[0070] 123e4567-e89b-12d3-a456-426614174000. Invisible watermark refers to inserting a watermark with 100% transparency into files that allow watermarking, such as office, pdf, and wps. The watermark content is GUID. The purpose of inserting invisible watermark is to add a GUID mark insurance for the invisible attribute of the file.

[0071] The problem of how to determine whether an encrypted file is the original copied encrypted file after it has been renamed or modified is solved. By changing the invisible attribute of the encrypted file or writing an invisible watermark to the encrypted file, the original copy-out record can be restored even if the content of the encrypted file has been changed. Furthermore, if the encrypted file has been copied in and out of the internal and external networks for multiple times, its circulation record can also be clearly restored.

[0072] Specifically, writing the unique identifier to the file invisible attribute of the encrypted file further includes: customizing the file invisible attribute and attribute value for the encrypted file based on the unique identifier.

[0073] In this way, the invisible attributes of the file in the embodiment of the present application can be the customized attributes and attribute values ​​of the encrypted file, and the customized attributes will not be displayed in "Document" - "Attributes" - "Details". In this way, after the present application adds customized attributes to the encrypted file, if the attribute name is not known, the attribute content cannot be seen and obtained. The attribute content is the generated GUID.

[0074] As an implementation mode, the USB disk has USB disk identification information; when the first host recognizes that the encrypted file is copied to the USB disk, the method further includes:

[0075] Determine the binding relationship between the encrypted file and the USB flash drive identification information;

[0076] Generate a file key based on the binding relationship;

[0077] The encrypted file is bound and encrypted using the file key, so that the first host copies the bound and encrypted encrypted file to the USB flash drive.

[0078] As an implementation mode, the present application embodiment provides a USB-based file copy supervision device, which is applied to a first host in an intranet, and includes an external copy module and a supervision module;

[0079] The external copy module is used for, when the U disk is connected to the first host, if the first host recognizes that the encrypted file is being copied to the U disk, determining that a preset editor program has been deployed in the U disk; wherein the preset editor program is a file editor for editing the encrypted file on the second host in the external network; when the U disk is connected to the second host, the second host edits the encrypted file through the preset editor program, and generates an external network editing record of the encrypted file in the U disk;

[0080] The supervision module is used to read the external network editing record in the U disk when the U disk is connected to the first host again, and upload the external network editing record to the application server connected to the intranet; wherein the external network editing record is used to instruct the application server to supervise the U disk.

[0081] As an implementation manner, the external copy module is further used for: if the first host recognizes that the preset editor program does not exist in the USB flash drive, copying the preset editor program into the USB flash drive.

[0082] As an implementation mode, the file copy supervision device further includes an upload module, which is used to: if the first host recognizes the copying behavior between the USB flash drive and the first host, record and upload the copy record to the application server, and the copy record is used to characterize the copying behavior.

[0083] As an implementation method, the external network editing record in the external copy module includes a unique identifier of the encrypted file; the external copy module is further used to: when the first host recognizes that the encrypted file is copied to the USB flash drive, write the unique identifier to the encrypted file;

[0084] The unique identifier is set for the encrypted file in at least one of the following ways, including:

[0085] Write a unique identifier to the file invisible attribute of the encrypted file;

[0086] Write invisible watermark to encrypted files.

[0087] As an implementation method, the USB flash drive has USB flash drive identification information; the external copy module is further used for: when the first host recognizes that the encrypted file is copied to the USB flash drive:

[0088] Determine the binding relationship between the encrypted file and the USB flash drive identification information;

[0089] Generate a file key based on the binding relationship;

[0090] The encrypted file is bound and encrypted using the file key, so that the first host copies the bound and encrypted encrypted file to the USB flash drive.

[0091] The present application embodiment provides a USB-based file copy supervision method, which is applied to a second host in an external network, wherein the USB stores an encrypted file copied from a first host of the content, and when the first host recognizes that the encrypted file is copied to the USB, it is determined that a preset editor program has been deployed in the USB, and the preset editor program is a file editor for editing the encrypted file on the second host; the method includes:

[0092] When the U disk is connected to the second host, the encrypted file is edited through a preset editor program, and an external network editing record of the encrypted file is generated in the U disk; wherein, when the U disk is connected to the first host again, the first host uploads the external network editing record to the application server connected to the intranet, so that the application server supervises the U disk according to the external network editing record.

[0093] Specifically, referring to Table 1, when the U disk is connected to the second host, a preset editor program is deployed on the U disk. At this time, the encrypted file is at least set with a prohibition on editing and a prohibition on saving. If it is determined that the local machine contains a U disk corresponding to the U disk number, the prohibition on editing of the encrypted file is lifted.

[0094] 1. Determine whether the encrypted file is in a state of allowing direct external copying or a state of prohibiting direct external copying, that is, determine whether the encrypted file is an encrypted type file. An encrypted file in a state of allowing external copying is not encrypted, and an encrypted file in a state of prohibiting external copying is encrypted.

[0095] 2. Determine whether the type of the encrypted file before encryption is a type supported by the editor. The encrypted file includes an encrypted document, and the encrypted document can be edited by a document editor.

[0096] 3. Determine whether the U disk used to copy the encrypted file is connected to the local computer. If the U disk corresponding to the file key of the encrypted file is not connected to the local computer, the encrypted file is prohibited from opening.

[0097] When the encrypted file is in a state where external copying is prohibited, the USB flash drive is not connected to the intranet, and the local computer contains a USB flash drive corresponding to the USB flash drive number, the encrypted file is decrypted and permission is controlled for use by other applications, which can prohibit the use of screen recording software or audio recording software.

[0098] During the editing process of an encrypted document, content can only be copied in from external applications or copied within this application, but content from this application is not allowed to be copied out to external applications. In other words, only internal-to-internal or external-to-internal copy and paste processes are allowed, but internal-to-external copy and paste processes are not allowed.

[0099] When saving and closing an encrypted document, save the content and re-encrypt it, and cancel restrictions on the use of other applications, such as canceling restrictions on the use of screen recording software or audio recording software.

[0100] Table 1 Schematic diagram of control functions based on USB disk file copy supervision

[0101]

[0102] The embodiment of the present application provides the possibility of external copy editing in an encrypted state for the U disk file inserted in the external network host and not connected to the internal network. When the U disk is connected to the second host, the U disk file is edited and saved using the specific file editor provided by the first host, which improves the usability and convenience of the encrypted file while ensuring the security of the encrypted file. The external network editing record is also retained, so that after the U disk is connected to the first host again, the first host reads the external network editing record and uploads it to the application server connected to the internal network for subsequent viewing.

[0103] As an implementation mode, after editing the encrypted file by the preset editor program, the method further includes: saving the edited encrypted file to a USB flash drive. Further, after editing the encrypted file by the preset editor program on the second host, the method further includes: if it is determined that the USB flash drive is connected to the second host, the preset editor program saves the encrypted file on the second host.

[0104] To solve the security problem that may be caused by the disconnection of the USB flash drive during the editing process when the editing content of the encrypted file is large and the editing time is too long, this application makes a judgment after the editing behavior is completed. If the USB flash drive is still connected to the second host at this time, the file is saved, thereby reducing the above security risks.

[0105] Furthermore, before the preset editor program edits the encrypted file on the second host, the method further includes: if it is determined that the USB flash drive is connected to the second host, the preset editor program opens the encrypted file on the second host. This achieves the technical effect that there is a preset editor program and an encrypted file on the second host in the external network, but if the USB flash drive corresponding to the encrypted file is not inserted into the second host, the encrypted file cannot be opened, further improving security.

[0106] As an implementation method, the USB flash drive has USB flash drive identification information; the encrypted file is bound and encrypted based on a file key, and the file key includes a binding relationship between the encrypted file and the USB flash drive identification information;

[0107] Determine whether the USB flash drive is connected to the second host by the following methods:

[0108] By using a preset editor program, judging whether the USB flash drive is connected to the second host based on the USB flash drive identification information and the binding relationship;

[0109] The method also includes: when it is determined that the USB flash drive is connected to the second host, unbinding the encrypted file, and editing the encrypted file after unbinding the encryption through a preset editor program.

[0110] As an implementation manner, the editing of the encrypted file by the preset editor program further includes:

[0111] If the preset editor program loses mouse cursor lock, the clipboard of the encrypted file is cleared.

[0112] A file can be an information unit stored in a computer, containing data in a specific format, such as text, images, and videos, etc. It can also be a Word document (.doc / .docx), a PDF document (.pdf), and a presentation (.ppt / .pptx), etc. By clearing the clipboard of the encrypted file when the preset editor program loses the mouse cursor lock, the content of the encrypted file cannot be copied. At the same time, when the content is copied externally to the encrypted file, the document editor will not lose the mouse cursor lock, achieving the effect that the content of the encrypted file in the document editor is not allowed to be copied to other places, but the content of other places can be copied to the encrypted file, thereby improving security and convenience.

[0113] Specifically, when the preset editor program copies the content in the encrypted file and pastes it out, the editor loses the mouse cursor lock and empties the clipboard, so that pasting cannot be performed because there is no content in the clipboard. When the preset editor program copies the content in the encrypted file and pastes it directly in the encrypted file, the editor retains the mouse cursor lock, the content in the clipboard is still there, and pasting can be performed normally. When the preset editor program copies the content in the external file and wants to paste it in the encrypted file, the editor retains the mouse cursor lock, the content in the clipboard is still there, and pasting can be performed normally.

[0114] Reference Figure 3 As an implementation method, the present application embodiment provides an execution process of a file copy supervision method based on a USB flash drive, including:

[0115] S110. A terminal control is provided on the intranet host, which can monitor the copying behavior of the copied file. If the file is copied from the intranet host to a USB flash drive, there are two cases: the first case is that the status of the copied file to be copied is to allow external copying, then a unique identifier GUID is generated and written into the invisible attributes and invisible watermark of the file to record the copying behavior. The recorded copy information includes the copy time information and the copied intranet host number information, etc.

[0116] S120, the second is that if the status of the copy file to be copied is a state that prohibits external copying, further judgment is made as to whether the copy file to be copied needs to be encrypted. If it does not need to be encrypted, copying is prohibited, the copying process is terminated, and the copying behavior is recorded. The recorded copy information includes copy time information, etc.

[0117] S130. If the copied file is to be encrypted, it is copied out after multiple encryption. First, a key is generated for encryption based on the file key. The file key includes the USB disk identification information of the USB disk, that is, the USB disk number, which is used to bind the USB disk. Then, the generated file key is encrypted twice to achieve multiple encryption. The secondary encryption can be the national secret SM4 encryption with a fixed password, or the encrypted file key can be encrypted by shuffling it into the file stream according to a custom rule, or the file key can be encrypted by SM4 encryption and a preset custom rule at the same time.

[0118] Furthermore, after the copied file is encrypted multiple times, a unique identifier GUID is generated and written into the file's invisible attributes and invisible watermark to record the copying behavior. The recorded copy information includes the copy time information and the copied intranet host number information, etc.

[0119] S140. If the file is copied from a USB flash drive to an intranet host, there are two situations: the first situation is that the file to be copied is encrypted, then the copying behavior is recorded after decryption; the second situation is that the file to be copied is not encrypted, then the copying behavior is directly recorded.

[0120] As an implementation mode, the present application embodiment provides a file copy supervision device based on a USB flash drive, which is applied to a second host in an external network, wherein the USB flash drive stores an encrypted file copied from a first host of the content, and when the first host recognizes that the encrypted file is copied to the USB flash drive, it is determined that a preset editor program has been deployed in the USB flash drive, and the preset editor program is a file editor for editing the encrypted file on the second host; the file copy supervision device includes an editing module;

[0121] The editing module is used to edit the encrypted file through a preset editor program when the USB flash drive is connected to the second host, and generate an external network editing record of the encrypted file in the USB flash drive; wherein, when the USB flash drive is connected to the first host again, the first host uploads the external network editing record to the application server connected to the intranet, so that the application server supervises the USB flash drive according to the external network editing record.

[0122] As an implementation method, the editing module is also used to: save the edited encrypted file to a USB flash drive.

[0123] As an implementation method, the USB flash drive has USB flash drive identification information; the encrypted file is bound and encrypted based on the file key, and the file key includes the binding relationship between the encrypted file and the USB flash drive identification information. The editing module is also used to: determine whether the USB flash drive is connected to the second host by:

[0124] Through the preset editor program, it is determined whether the USB flash drive is connected to the second host based on the USB flash drive number and the binding relationship.

[0125] The editing module is also used to: when it is determined that the USB flash drive is connected to the second host, unbind the encrypted file and edit the encrypted file after unbinding the encryption through a preset editor program.

[0126] As an implementation mode, the editing module is further used to: clear the clipboard of the encrypted file if the preset editor program loses the mouse cursor lock.

[0127] The present application provides a computer device, including: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute a USB-based file copy supervision method provided in the above embodiment.

[0128] The computer device includes: one or more processors, memory, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system).

[0129] The processor may be a central processing unit, a network processor or a combination thereof. The processor may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0130] The memory stores instructions executable by at least one processor, so that the at least one processor executes the method shown in the above embodiment.

[0131] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the storage may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0132] The memory may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid state drive; the memory may also include a combination of the above types of memory.

[0133] The computer device also includes a communication interface, which is used for the computer device to communicate with other devices or a communication network.

[0134] The present application provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute a USB-based file copy supervision method as provided in the above embodiment.

[0135] The embodiment of the present application also provides a computer-readable storage medium. The above method according to the embodiment of the present application can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0136] The embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method of any embodiment of the present application.

[0137] Although the embodiments of the present application are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations are all within the scope defined by the appended claims.

[0138] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0139] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0144] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0145] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0146] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

[0147] Although the embodiments of the present application have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for supervising file copying based on a USB flash drive, characterized in that: Applied to a first host in an intranet, the method comprises: When the USB flash drive is connected to the first host, if the first host recognizes that an encrypted file is being copied to the USB flash drive, it is determined that a preset editor program has been deployed in the USB flash drive; wherein the preset editor program is a file editor for editing the encrypted file on a second host in an external network; when the USB flash drive is connected to the second host, the second host edits the encrypted file through the preset editor program, and generates an external network editing record of the encrypted file in the USB flash drive; When the U disk is connected to the first host again, the external network editing record in the U disk is read, and the external network editing record is uploaded to the application server connected to the intranet; wherein the external network editing record is used to instruct the application server to supervise the U disk.

2. The method according to claim 1, characterized in that Before determining that the preset editor program has been deployed in the U disk, the method further includes: if the first host recognizes that the preset editor program does not exist in the U disk, copying the preset editor program to the U disk.

3. The method according to claim 1, characterized in that In the case where the USB flash drive is connected to the first host, the method further includes: if the first host recognizes the copying behavior between the USB flash drive and the first host, recording and uploading a copy record to the application server, wherein the copy record is used to characterize the copying behavior.

4. The method according to claim 1, characterized in that The external network editing record includes a unique identifier of the encrypted file; the method further includes: when the first host recognizes that the encrypted file is copied to the USB flash drive, writing the unique identifier to the encrypted file; The unique identifier is set for the encrypted file in at least one of the following ways, including: Writing the unique identifier into the file invisible attribute of the encrypted file; Write a file invisible watermark to the encrypted file.

5. The method according to claim 1, characterized in that The USB disk has USB disk identification information; when the first host recognizes that the encrypted file is copied to the USB disk, the method further includes: Determine the binding relationship between the encrypted file and the USB flash drive identification information; Generate a file key based on the binding relationship; The encrypted file is bound and encrypted using the file key, so that the first host copies the bound and encrypted encrypted file to the USB flash drive.

6. A method for supervising file copying based on a USB flash drive, characterized in that: In a second host in an external network, the U disk stores an encrypted file copied from a first host of the content, and when the first host recognizes that the encrypted file is copied to the U disk, it is determined that a preset editor program has been deployed in the U disk, and the preset editor program is a file editor for editing the encrypted file on the second host; the method includes: When the U disk is connected to the second host, the encrypted file is edited by the preset editor program, and an external network editing record of the encrypted file is generated in the U disk; wherein, when the U disk is connected to the first host again, the first host uploads the external network editing record to an application server connected to the intranet, so that the application server supervises the U disk according to the external network editing record.

7. The method according to claim 6, characterized in that After editing the encrypted file through the preset editor program, the method further includes: saving the edited encrypted file to the U disk.

8. The method according to claim 7, characterized in that The U disk has U disk identification information; the encrypted file is bound and encrypted based on a file key, and the file key includes a binding relationship between the encrypted file and the U disk identification information; Determine whether the USB flash drive is connected to the second host by: By means of the preset editor program, judging whether the USB flash drive is connected to the second host based on the USB flash drive identification information and the binding relationship; The method further includes: when it is determined that the USB flash drive is connected to the second host, unbinding the encrypted file, and editing the encrypted file after unbinding the encryption through the preset editor program.

9. The method according to claim 6, characterized in that The editing of the encrypted file by the preset editor program further includes: If the preset editor program loses mouse cursor lock, the clipboard of the encrypted file is cleared.

10. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 9 by executing the computer instructions.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 9.

Images