Safety protection method, safety protection system and electronic equipment

Abstract

The embodiment of the invention relates to the technical field of network security, and discloses a security protection method, a security protection system and electronic equipment. The security protection method applied to the terminal comprises the steps that when a target operation for a local sensitive file occurs, the target operation which occurs currently is recorded, an association relationship with the local sensitive file is generated, and after the target operation is completed, the local file of the terminal can change; and when the file is sent out, managing and controlling the operation of the currently sent-out file according to the recorded target operation and the association relationship. According to the method and the device, the data security of the terminal is guaranteed by more comprehensively and accurately managing and controlling the file outgoing on the terminal under the condition of not influencing the user experience, so that the construction of the zero-trust architecture is better supported through the safer terminal.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a security protection method, a security protection system and an electronic device. Background Art

[0002] In the era of cloud computing and big data, the network security perimeter is gradually disintegrating, and internal and external threats are becoming more and more severe. Traditional perimeter security architecture is difficult to cope with, and zero-trust security architecture has emerged. Among them, terminals are an important part of zero-trust security architecture, and their security needs to be guaranteed. In particular, the data security on terminals is often subject to the risk of leakage.

[0003] However, the terminal security protection solutions currently proposed are not effective, and terminal data security is still threatened, which is not conducive to the realization of a zero-trust architecture. Summary of the invention

[0004] The embodiments of the present application provide a security protection method, a security protection system and an electronic device, which are at least beneficial for ensuring the security of terminal data by more comprehensively and accurately controlling the outbound sending of files on the terminal without affecting the user experience, so as to better support the construction of a zero-trust architecture through more secure terminals.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a security protection method, which is applied to a terminal, and the method includes: when a target operation for a local sensitive file occurs, the target operation currently occurring is recorded and an association relationship with the local sensitive file is generated, wherein after the target operation is completed, the local file of the terminal will change; when the file is sent out, the operation of the current outgoing file is managed and controlled based on the recorded target operation and the association relationship.

[0006] In some embodiments, the operation of the current outgoing file is controlled based on the recorded target operation and the association relationship, including: tracing the source of the outgoing file based on the recorded target operation and the association relationship to determine whether the current outgoing file belongs to the local sensitive file or a derivative file of the local sensitive file; when it is determined that the current outgoing file belongs to the local sensitive file or a derivative file of the local sensitive file, the operation of the current outgoing file is controlled according to a preset sensitive file control policy.

[0007] In some embodiments, while recording the target operation currently occurring and generating an association relationship with the local sensitive file, the method also includes: recording all files involved in the target operation currently occurring as the local sensitive files; and controlling the operation of the current outgoing file based on the recorded target operation and the association relationship, including: controlling the operation of the current outgoing file based on the recorded target operation, the association relationship and whether the current outgoing file is the local sensitive file.

[0008] In some embodiments, the operation of the current outgoing file is controlled based on the recorded target operation, the association relationship and whether the current outgoing file is the record of the local sensitive file, including: determining whether tracing is required based on whether the current outgoing file is the record of the local sensitive file; if tracing is required, tracing the current outgoing file based on the recorded target operation and the association relationship to obtain complete life cycle data of the current outgoing file; and controlling the operation of the current outgoing file based on the complete life cycle data of the current outgoing file.

[0009] In some embodiments, the controlling the operation of the current outgoing file based on the recorded target operation and the association relationship includes: controlling the operation of the current outgoing file based on the recorded target operation, the association relationship and the content of the current outgoing file.

[0010] In some embodiments, the method further includes: when downloading a file, according to a preset strategy, detecting whether the currently downloaded file is a sensitive file, so as to determine whether an operation on the local sensitive file occurs based on the detected local sensitive file downloaded locally, wherein the preset strategy includes: detecting according to the file source and / or detecting according to the file content.

[0011] In some embodiments, the method further includes: receiving a policy issued by a server for controlling operations on outbound files and / or a policy for detecting whether a file is a sensitive file; and / or reporting relevant control information and / or file information of sensitive files to the server.

[0012] According to some embodiments of the present application, the second aspect of the embodiments of the present application also provides a security protection system, including: a first module and a second module, the first module and the second module are both deployed in a terminal, and the first module is connected to the second module in the same terminal; the first module is configured to synchronize the target operation currently occurring and the association relationship with the local sensitive file to the second module when a target operation for a local sensitive file occurs, wherein after the target operation is completed, the local file of the terminal where the first module is located will change; the second module is configured to receive and record the target operation and the association relationship synchronized by the first module, and when the file is sent out, the operation of the current outgoing file is managed and controlled according to the recorded target operation and the association relationship.

[0013] In some embodiments, a third module is also included, which is deployed in a terminal and connected to the first module in the same terminal; the third module is configured to detect whether the currently downloaded file is a sensitive file according to a preset strategy when downloading a file, and synchronize the file information of the detected sensitive file to the first module, so that the first module can determine whether an operation occurs for the local sensitive file based on the detected sensitive file, wherein the preset strategy includes: detecting according to the source of the file and / or detecting according to the content of the file.

[0014] In some embodiments, a fourth module is also included, which is deployed on a server and connected to the second module and the third module; the fourth module is configured to perform at least one of the following operations: issuing a policy for detecting whether it is a sensitive file to the third module, issuing a policy for controlling operations on outbound files to the second module, receiving relevant control information and / or file information of sensitive files reported by the second module, and receiving file information of sensitive files reported by the third module.

[0015] According to some embodiments of the present application, a third aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a security protection method as provided in any embodiment of the present application.

[0016] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0017] When a target operation on a local sensitive file occurs, it will trigger the recording of the current target operation and the generation of an association relationship with the local sensitive file. Therefore, the association between the local sensitive file and other files based on the target operation will be fully recorded. When the file is sent out, the operation of the current outgoing file is controlled according to the recorded target operation and association relationship, so that the association between the outgoing file and the local sensitive file can be fully, accurately and efficiently determined, and then an accurate judgment can be made, avoiding errors and omissions, thereby improving data security. In addition, since the operation on the local sensitive file is recorded when it occurs and controlled when the file is sent out, while ensuring data security through the control action, the file operation other than outgoing will not be slowed down by the control action, thus ensuring the user experience. It is achieved that the operation of outgoing files can be controlled more comprehensively and accurately without affecting the user experience, avoiding the leakage of sensitive data, thereby improving the data security of the terminal, and finally better supporting the construction of a zero-trust architecture through a more secure terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0019] Figure 1 This is the process of the security protection method provided in the embodiment of this application Figure 1 ;

[0020] Figure 2 This is the process of the security protection method provided in the embodiment of this application Figure 2 ;

[0021] Figure 3 This is the process of the security protection method provided in the embodiment of this application Figure 3 ;

[0022] Figure 4 This is the process of the security protection method provided in the embodiment of this application Figure 4 ;

[0023] Figure 5 This is the process of the security protection method provided in the embodiment of this application Figure 5 ;

[0024] Figure 6 This is a schematic diagram of the structure of the safety protection system provided in the embodiment of the present application. Figure 1 ;

[0025] Figure 7 This is a schematic diagram of the structure of the safety protection system provided in the embodiment of the present application. Figure 2 ;

[0026] Figure 8 This is a schematic diagram of the structure of the safety protection system provided in the embodiment of the present application. Figure 3 ;

[0027] Fig. 9 It is a schematic diagram of the interactive process of the security protection method provided in the embodiment of the present application;

[0028] Fig.10 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] As can be seen from the background technology, the terminal security protection solutions currently proposed have the problem of poor effectiveness, which affects the construction of the zero-trust architecture.

[0030] After analysis, it is found that the reasons for the above problems are at least that: some sensitive content is inevitably present in the terminal. For example, with the development of enterprise informatization, the production and operation data of the enterprise are mainly stored in the form of electronic documents and data. These files may contain the core generation technology, important confidential data, daily production data and other aspects of the enterprise, and have high requirements for confidentiality and security. Once leaked, it will cause unpredictable consequences to the enterprise. Enterprise employees may save the above data on some terminals for work needs. However, the terminal inevitably has the need to send files out. For example, enterprise employees need to send some files out based on work needs. Therefore, in many cases, it is not possible to simply block all operations on outgoing files. For example, a terminal security protection solution is currently proposed, which is to block the way of file outgoing and add some file release strategies to control the outgoing files of the terminal to avoid the leakage of sensitive content. However, this often requires the addition of many strategies, and it is easy for users to forge files to bypass the security mechanism. Problems, so this idea is rarely used for processing. To this end, two other ideas have been proposed to control the outbound file transmission of the terminal: 1. Add sensitive detection of file content when the file is transmitted, and directly block the transmission of files containing sensitive content; 2. Introduce document blind watermark technology, when the file download is detected, the information including the downloader will be written into the document, and the corresponding information will be extracted for auditing when the file is transmitted. Among them, scheme 1 can only audit or block files containing sensitive content. If the terminal user changes the content directly presented by the document through binary editing, encryption and decryption compression, etc., the sensitive file will be released because the sensitive content has been changed. Scheme 2 is difficult to achieve the effect of hiding watermark content on plain text files such as text documents (txt), ini files, and code files, and for files with hidden watermark information, the terminal user can destroy the watermark content through binary adjustment, encryption and compression, etc., so that sensitive content will also be released. In other words, the current schemes for controlling the operation of outbound files are easy to be circumvented, so the security protection effect is not good.

[0031] In order to solve the above technical problems, a security protection method, a security protection system and an electronic device are provided in the embodiment of the present application. By recording the target operation of a local sensitive file and the association relationship with the local sensitive file, the operation of the outgoing file can be controlled through the recorded target operation and association relationship when the file is sent out, and the association between it and the sensitive file and the risk of sensitive content leakage when it is sent out can be clarified, so as to make accurate decisions to determine whether to allow or block the outgoing. In particular, the file operations such as binary adjustment, encryption and compression that bring security risks to the above-mentioned control actions will still be fully recorded, so as to provide a reference when the file is sent out, support comprehensive and accurate decision-making, and will not mistakenly release the files after binary adjustment, encryption and compression operations, thereby improving data security. In addition, since the file operation is recorded when it occurs, the control action occurs when the file is sent out, so the completion efficiency of the file operation will not be affected by the control, and can be kept normal, and will not affect the normal operation experience of the user, thereby ensuring the user experience. It is achieved that the terminal data security is guaranteed by more comprehensive and accurate control of the outgoing files on the terminal without affecting the user experience, so as to better support the construction of a zero-trust architecture through a more secure terminal.

[0032] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0033] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0034] In one aspect, the present application provides a security protection method, which is applied to a terminal, wherein the terminal may be any terminal device capable of performing security protection on data, such as a mobile phone, a notebook, etc. In some embodiments, the process of the security protection method is as follows: Figure 1 As shown, the following steps are included:

[0035] Step 101, when a target operation for a local sensitive file occurs, the target operation currently occurring is recorded and an association relationship with the local sensitive file is generated, wherein after the target operation is completed, the local file of the terminal will change.

[0036] Step 102, when the file is sent out, the operation of the current outgoing file is controlled according to the recorded target operation and association relationship.

[0037] In this way, when a target operation on a local sensitive file occurs, it will trigger the recording of the current target operation and the generation of an association relationship with the local sensitive file. Therefore, the association between the local sensitive file and other files based on the target operation will be fully recorded. When the file is sent out, the operation of the current outgoing file is controlled according to the recorded target operation and association relationship, so that the association between the outgoing file and the local sensitive file can be determined comprehensively, accurately and efficiently, and then an accurate judgment can be made, avoiding errors and omissions, thereby improving data security. In addition, since the operation on the local sensitive file is recorded when it occurs and controlled when the file is sent out, while ensuring data security through the control action, the file operation other than outgoing will not be slowed down by the control action, thus ensuring the user experience. It is achieved that the operation of outgoing files is controlled more comprehensively and accurately without affecting the user experience, avoiding the leakage of sensitive data, thereby improving the data security of the terminal, and finally better supporting the construction of a zero-trust architecture through a more secure terminal.

[0038] In order to facilitate those skilled in the art to better understand the above embodiments, they will be explained below.

[0039] In step 101, sensitive files refer to files containing confidential sensitive content, and local sensitive files refer to sensitive files stored in the local storage of the terminal. It can be understood that since the download operation is to save the external file locally, it does not belong to the operation of the local sensitive file, that is, the target operation of the local sensitive file does not include the download operation. At the same time, since the outgoing operation is to send the file to the outside, it will not change the local file of the terminal, that is, the target operation of the local sensitive file does not include the outgoing operation. However, operations such as editing, moving, copying, renaming, deleting, compressing\decompressing, saving as, merging, binary adjustment, and encryption can all change the local files of the terminal (changing the content of the file, the attributes of the file, etc. are all changes to the file). For example, the editing operation will cause the content of the local file of the terminal to change, the moving operation will cause the storage location of the local file of the terminal to change, the copying operation will cause the number of local files of the terminal or the content of the file to change, the renaming operation will cause the file name of the local file to change, and the compression / decompression will cause the content of the file to change, etc. Therefore, all of the above operations can be used as target operations. That is to say, operations such as editing, moving, copying, renaming, deleting, compressing / decompressing, saving as, merging, binary adjustment, encryption, and compression for local sensitive files can all be considered as target operations for local sensitive files. Of course, the above is only an example of target operations for local sensitive files. Other operations that target local sensitive files and can cause changes in the local file sending of the terminal can also be considered as target operations for local sensitive files, and they will not be listed here one by one.

[0040] It should be noted that the embodiments of the present application do not limit the implementation method of how to determine whether the target operation on the sensitive file occurs. It can be understood that since the detection of sensitive files can occur in real time or be completed in advance, there is a difference in determining whether the target operation on the sensitive file occurs at least in whether the sensitive file detection needs to be performed in real time.

[0041] For example, in the case of real-time detection of whether a file is a sensitive file, determining whether a target operation for a local sensitive file occurs can be achieved in the following manner: monitoring the file operation, after monitoring the file operation, detecting whether the operated file is a local file and has a sensitive source and / or sensitive content, and detecting whether the operation performed belongs to the target operation, if the above two detection results are both yes, it is determined that a target operation for a local sensitive file has occurred. In this way, by conducting comprehensive monitoring, errors and omissions in file operations are avoided, which is conducive to improving the comprehensiveness and integrity of records, thereby improving the accuracy of subsequent management and control, and improving the data security of the terminal. Among them, sensitive sources refer to ways in which sensitive data is transmitted, for example, files downloaded by enterprise employees from enterprise office applications (such as collaborative office applications such as wiki), enterprise instant messaging tools, enterprise code repositories (such as git, svn, etc.), enterprise mailboxes, etc. are sensitive files with sensitive sources; sensitive content refers to content that is confidential and whose leakage will bring security risks, for example, files such as enterprise production data and personal privacy data are sensitive files with sensitive content. Therefore, determining whether a target operation for a sensitive file occurs can also be further distinguished in the implementation method of detecting whether there is a sensitive source and / or sensitive content. For example, different applications have different data indicating source channels, such as office applications and code repositories reflect sources through information such as the Uniform Resource Locator (URL) and process names, and instant messaging tools reflect sources through information such as recipients, senders, and chat tools. Therefore, in the process of determining whether a target operation against a local sensitive file has occurred, it can be achieved by detecting URLs and process names, etc. to detect sensitive sources, or it can be achieved by detecting recipients, senders, chat tools, etc. to detect sensitive sources. For example, due to the different forms of sensitive content, such as privacy information or production materials information, the method of determining whether it is sensitive content is also different. Here, the detection methods of sensitive files will not be repeated one by one.

[0042] In particular, the various strategies for detecting whether a file is a sensitive file described above can be issued through the server, which is conducive to the administrator setting strategies according to specific management needs at the server, avoiding the need to set too many and unnecessary strategies, and updating the corresponding strategies in time to avoid sensitive file detection errors.

[0043] For example, in the case of pre-detecting whether a file is a sensitive file, determining whether a target operation on a local sensitive file occurs can be achieved by monitoring the file operation determined as a sensitive file, and after monitoring the file operation on the sensitive file, detecting whether the operation performed is a target operation, and if so, determining that a target operation on a local sensitive file occurs. In this way, by pre-determining sensitive files, the efficiency of determining the target operation on local sensitive files is improved. At the same time, compared with monitoring all local files, only the local files determined as sensitive files need to be monitored, and the monitoring burden is smaller.

[0044] In order to facilitate those skilled in the art to better understand how to predetermine whether a local file is a sensitive file, the following will be combined with Figure 2 For explanation. Figure 2 As shown, in some embodiments, before step 101, the security protection method further includes:

[0045] Step 103, when downloading a file, according to a preset strategy, detect whether the currently downloaded file is a sensitive file, so as to determine whether an operation on the local sensitive file occurs based on the detected local sensitive file downloaded locally, wherein the preset strategy includes: detecting according to the file source and / or detecting according to the file content.

[0046] That is to say, when a file is obtained by downloading, it is determined whether the file is a sensitive file, so that when a file operation is monitored, it can be directly determined whether the file is a sensitive file through comparison. Therefore, the file operation does not need to wait for the process time, and will not interfere with the user operation, which is conducive to ensuring the user experience. In addition, since the detection of sensitive files is bound to the file download, the detection of sensitive files will be triggered when a file is downloaded, and downloading means the generation of a new local file. Therefore, the detection of whether a local file is a local sensitive file will be more timely.

[0047] It should be noted that the embodiment of the present application does not limit how to determine the existence of file downloads. It can be achieved by monitoring each source channel such as office applications, code warehouses, instant messaging tools, mailboxes, peripherals, etc., or by monitoring storage. Once a new file appears in the local storage, the new file will be used as a downloaded file, etc., which will not be described in detail here. After monitoring the file download, it can detect whether the file is a sensitive file according to the above content, and in the process of detection, it can be detected by simultaneously detecting the file source and the file content, or by first detecting the file source and then detecting the file content, etc., to accurately determine whether the downloaded file is a sensitive file. Of course, it can also be detected in combination with other file sensitivity situations, which will not be described in detail here.

[0048] Of course, after determining whether the downloaded file is a sensitive file, any method can be used to mark the sensitive file, for example, adding content indicating that it is a sensitive file to the file's attributes, or writing the file's relevant information (file name, sender, recipient, receiving channel, receiving time, sending time, local storage path, the policy based on which it is determined to be a sensitive file, etc.) into a pre-set data table for maintaining sensitive files, so that when subsequent file operations occur, it is possible to timely and accurately determine whether the file is a sensitive file. In particular, a server can also be set up, which can maintain sensitive file information uploaded by different users, for example, the terminal can push the above-mentioned data table for maintaining sensitive files to the server in real time, so that the management personnel can search when needed.

[0049] It should be noted that the above is only an exemplary description of sensitive file detection when downloading occurs, which can improve the response efficiency during file operations and avoid interfering with file operations and affecting user experience. The above detection process can also be performed when file operations occur. At this time, real-time detection can be performed without the need to maintain sensitive file data tables all the time, which is beneficial to saving storage resources, etc., and will not be described in detail here.

[0050] It should also be noted that Figure 2 This is just an example of processing the same file on the terminal. It is understandable that a file is first downloaded as a local file before the terminal needs to determine whether it is a sensitive file and can operate it, and then there is recording and control. For different files, the order of downloading, operation recording, and external control is not fixed, that is, for different files, step 103 can also occur at the same time as step 101, or after step 102, etc. Here, the execution order of step 103 relative to step 101 and step 102 will not be listed one by one.

[0051] Of course, the above is only an exemplary explanation of whether the target operation on a local sensitive file occurs. In other embodiments, other methods may be used. For example, even if it is predetermined whether a local file is a sensitive file, it is still possible to determine whether the target operation on the local sensitive file occurs by monitoring all files, so as to avoid security issues such as the leakage of sensitive files caused by tampering with the record of whether a local file is a sensitive file due to system failure, malicious attack, etc., which will not be listed one by one here.

[0052] In step 101, the recording method of the currently occurring target operation and the generating method of the association relationship are not limited.

[0053] It is understandable that, depending on the needs, the information that needs to be recorded for the current target operation may be different. For example, when the subsequent management and control strategy is related to the operations that the file has undergone, the more detailed the current target operation is, the better, so that it is conducive to better management and control. In some examples, one or more of the following information of the target operation can be recorded: download source, operating user, operation time, hit sensitive source policy information, local save path. Of course, the above is only for illustration, and other information may also be included in some examples, which will not be repeated here.

[0054] It can also be understood that there are many different situations for generating association relationships, for example, recording information about files involved in the target operation, recording the current target operation and other target operations of the files involved in the operation, and any other way of generating association relationships that can achieve file traceability, which will not be described in detail here.

[0055] It should be noted that the terminal may lose or tamper with some information due to some operational problems, self-failures, etc. Therefore, in the aforementioned embodiment, while recording the target operation, an association relationship with the local sensitive file is also generated. In this way, if there is a problem with the record of the target operation for the local sensitive file, it can be compensated by the association relationship. When there is a problem with the association relationship, it can also be compensated by the record of the target operation for the local sensitive file. However, no matter which one of them can make the file operation that cannot be traced back after binary adjustment, encryption compression, renaming, save as, etc., then sent out, therefore, the existing outbound detection scheme cannot determine whether it is a sensitive file based on the file content, etc., and the outbound file can still be perceived, which improves the security of file outbound. Of course, on the basis of the terminal adopting other methods for security protection, the record of the target operation for the local sensitive file and the association with the local sensitive file can also be retained in only one way, etc., which will not be repeated here.

[0056] In step 102, since the security protection method provided in the embodiment of the present application generates target operation records and association relationships, when the currently outgoing files are controlled, the currently operated files can also be traced through the recorded target operations and association relationships for sensitive files to determine whether they are derived from sensitive files, or in other words, to determine whether they are derivative files of sensitive files, thereby determining whether they are sensitive files, etc. In this way, even if errors or omissions in sensitive file records occur, the currently outgoing files can be treated as sensitive files through the recorded file operations and association relationships, and controlled using sensitive file control strategies, rather than being allowed to bypass the control of outgoing files, which is conducive to further improving the security protection effect of outgoing files. The tracing methods will not be described one by one here.

[0057] It should be noted that file operations may have different effects. For example, operations such as moving, compressing, and decompressing may generate new files. Operations such as binary adjustment, encryption, and compression may cause changes in the content of files. Different processing may be used based on these different effects. For example, the generated new files may still contain sensitive content of sensitive files. Therefore, the generated new files may be recorded as new local sensitive files. Alternatively, local sensitive files with different target operations and different characteristics may be selectively recorded. For example, files after binary adjustment can basically be restored through binary adjustment regardless of subsequent operations. Therefore, files obtained by binary adjustment of local sensitive files may all be recorded as local sensitive files. Compression operations may require complete content to be correctly decompressed, or may also require partial content to be correctly decompressed. It can be decompressed correctly to restore part of the content. Therefore, in some cases, all compressed files and operations on the files can be recorded as local sensitive files. In this way, the security of the files can be fully guaranteed through unified operations. However, in some cases, in order to minimize the occupation of local storage and other resources, compressed files that need to be correctly decompressed based on the complete content can be files generated by operations on part of the contents of the compressed files, such as new files generated by operations such as partial content copying. Considering that these files cannot be decompressed normally and the sensitive content in the original sensitive files cannot be restored, data leakage will not occur. Therefore, files generated by subsequent operations on partial contents of compressed files that need to be correctly decompressed based on the complete content may not be recorded as local sensitive files.

[0058] For example, in some embodiments, Figure 3As shown, step 101, while recording the current target operation and generating an association relationship with the local sensitive file, also performs the following steps: recording all files involved in the current target operation as local sensitive files.

[0059] Correspondingly, the operation of the current outgoing file is controlled based on the recorded target operation and association relationship. This can be achieved in the following way: the operation of the current outgoing file is controlled based on the recorded target operation, association relationship and whether the current outgoing file is a local sensitive file.

[0060] In this way, new files derived from local sensitive files are also recorded as local sensitive files, making the record of local sensitive files more comprehensive, avoiding audit errors caused by missing sensitive files when files are sent out, and helping to further improve the security of outbound file operations.

[0061] It is also understandable that, as mentioned above, when performing control, tracing can be used to achieve it, but since the outgoing files may be local sensitive files or not, and if the outgoing files are not local sensitive files, tracing will fail, tracing will waste time, and the control efficiency will be very low. Therefore, in some embodiments, such as Figure 4 As shown, according to the recorded target operation, association relationship and whether the currently sent file is a local sensitive file, the operation of the currently sent file can be controlled through the following steps:

[0062] Step 1021, based on whether the currently sent out file is a record of a local sensitive file, determines whether tracing is required.

[0063] Step 1022, when tracing is required, tracing the current outbound file is performed based on the recorded target operation and association relationship to obtain complete life cycle data of the current outbound file.

[0064] Step 1023, based on the complete life cycle data of the currently outgoing file, the operation of the currently outgoing file is managed and controlled.

[0065] In this way, new files derived from sensitive files are also recorded as local sensitive files, so that it is possible to directly determine whether tracing is required through the corresponding records, avoiding meaningless tracing operations and improving the management and control efficiency of outbound files.

[0066] In step 102, the specific control strategy is not limited. In some examples, the control strategy can be based on the recorded operations and associations to determine whether the outbound file originates from a sensitive file. If so, the outbound transmission is blocked. In some examples, the control strategy can also be based on the recorded operations and associations to determine whether the file originates from a sensitive file. If so, it is also based on the recorded operations to determine whether the operations performed to obtain the current outbound file from the sensitive file can restore part of the file content of the sensitive file through corresponding processing. If so, the outbound transmission is blocked, etc.

[0067] Of course, the above is only an exemplary description of the control strategy. In some embodiments, the control strategy may also include other aspects, for example, it may also include strategies related to the content of the file, etc. For example, the control strategy may also be based on the recorded operation to determine whether the file is from a sensitive file. If so, continue to judge based on the content of the current outgoing file, and block the outgoing file if sensitive content is detected. In addition, the control strategy may include not only blocking strategies, but also release strategies, for example, release when it is determined based on the recorded file operation that the file is not related to the sensitive file, or release when it is determined based on the recorded file operation that the content of the sensitive file cannot be restored, etc. The control strategies will not be listed one by one here.

[0068] On this basis, in some embodiments, such as Figure 5 As shown, according to the recorded target operations and association relationships, the operations of the current outgoing files can be controlled through the following steps:

[0069] Step 1024: Control the operation of the current outgoing file according to the recorded target operation, association relationship and the content of the current outgoing file. That is, further control is performed in combination with the content of the file, and multiple considerations are taken into account, which is conducive to further improving the accuracy of control, thereby improving the security of outgoing files.

[0070] In some embodiments, according to the recorded file operations, in the process of controlling the operation of the current outgoing file, not only is it queried whether the current outgoing file belongs to the data table used to record sensitive files, but if so, the complete life cycle data of the current outgoing file in the entire terminal is queried according to the recorded file operations, and based on its complete life cycle data, it is determined whether the result of the current outgoing file control is audit or blocking outgoing, and the relevant information involved in the corresponding control process is sent to the server so that the management personnel can query and audit on the server when necessary. For example, in the case where the result of the control is audit, the result of the control and / or the complete life cycle data are sent to the server so that the management personnel can query and audit on the server when necessary. For example, in the case where the result of the control is blocking outgoing, the user's file outgoing operation is blocked, and the result of the control and / or the complete life cycle data are sent to the server.

[0071] It should be noted that the embodiments of the present application do not limit the way in which the terminal obtains relevant policies (including detection policies and management policies for sensitive files, etc.). The policies can be uniformly issued to the terminals by the management personnel through the server to facilitate the subsequent implementation of changing the policies according to changes in demand. The policies issued to different terminals can be the same or different depending on the terminal or the user of the terminal. The policies can also be configured before the terminal is used by the user, etc., which will not be described in detail here.

[0072] It should also be noted that the embodiments of the present application do not limit the method for determining whether an external file is sent. In some embodiments, the paths through which files are sent, such as IM, mailboxes, browser pages, printing, peripherals, cloud disks, Bluetooth, FTP, etc., can be monitored. Once an external operation is detected on the path through which the file is sent, it is determined that the file has been sent externally. Alternatively, the file operation is monitored. Once a file sending operation is monitored, it is determined that the file has been sent externally, etc., which will not be described in detail here.

[0073] In addition, in order to facilitate subsequent management, relevant information of the management and control can be reported to the server after the management and control, so that the management personnel can perform query and audit on the server when necessary.

[0074] It can also be understood that, as mentioned above, in order to implement the security protection method provided in the above embodiments, it is necessary to monitor file operations, etc. Therefore, in some embodiments, the security protection method also includes: monitoring file operations based on the ETW framework, so that file operations, file downloads, file outbound operations, etc. can be perceived in a timely manner, such as editing, moving, copying, renaming, deleting, compressing\decompressing, saving as, merging, etc. can all be fully and accurately monitored, wherein the ETW framework is a framework in the Windows system. At the same time, after determining the file operation, corresponding processing is required, such as recording, control, etc. Therefore, in some embodiments, after monitoring the corresponding file operation, the Windows hook technology is used to hook the call of the file upload and download, source information-related system, etc., to achieve recording, control, etc.

[0075] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0076] On the other hand, the present application embodiment also provides a safety protection system, such as Figure 6 As shown, it includes: a first module 601 and a second module 602, the first module 601 and the second module 602 are both deployed in a terminal, and the first module 601 is connected to the second module 602 in the same terminal;

[0077] Among them, the first module 601 is configured to synchronize the current target operation and the association relationship with the local sensitive file to the second module 602 when the target operation for the local sensitive file occurs, wherein after the target operation is completed, the local file of the terminal where the first module is located will change; the second module 602 is configured to receive and record the target operation and association relationship synchronized by the first module 601, and when the file is sent out, the operation of the current outgoing file is controlled according to the recorded target operation and association relationship.

[0078] In this way, by setting the first module 601 and the second module 602 in the terminal, when the target operation for the local sensitive file occurs in the terminal, the first module 601 will synchronize the current target operation and the association relationship with the local sensitive file to the second module 602. Therefore, the second module 602 can perceive all local sensitive files and files derived from local sensitive files and other files with data leakage risks based on the synchronized information. In this way, when the file is sent out, the second module 602 can accurately determine its association with the local sensitive file and perform accurate management and control, thereby improving the security of the file outbound. At the same time, when performing file operations, since no management and control are performed, but the management and control are placed in the outbound process, the file operations performed by the user do not need to be managed, the response efficiency is not affected, and the user experience can be guaranteed. It is achieved that information security is improved without affecting the user experience. It is achieved that the terminal data security is guaranteed by more comprehensive and accurate management and control of the outbound file on the terminal without affecting the user experience, so as to better support the construction of a zero-trust architecture through a more secure terminal.

[0079] In some embodiments, Figure 7 As shown, the security protection system further includes a third module 603, which is deployed in the terminal and connected to the first module 601 in the same terminal. The third module 603 is configured to detect whether the currently downloaded file is a sensitive file according to a preset strategy when downloading a file, and synchronize the file information of the detected sensitive file to the first module 601, so that the first module 601 can determine whether an operation on the sensitive file occurs according to the detected sensitive file, wherein the preset strategy includes: detection according to the file source and / or detection according to the file content.

[0080] In some embodiments, Figure 8 As shown, the security protection system also includes a fourth module 604, which is deployed on the server and connected to the second module 602 and the third module 603. The fourth module 604 is configured to perform at least one of the following operations: issuing a policy for detecting whether it is a sensitive file to the third module 603, issuing a policy for controlling the operation of sending files to the second module 602, receiving relevant information and / or file information of sensitive files reported by the second module 602, and receiving file information of sensitive files reported by the third module 603.

[0081] It should be noted that the above-mentioned first module 601, second module 602 and third module 603 are all deployed on the terminal based on the kernel layer and the user layer.

[0082] It is not difficult to find that this embodiment is a system embodiment corresponding to the method embodiment, and this embodiment can be implemented in conjunction with the method embodiment. The relevant technical details mentioned in the method embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the method embodiment.

[0083] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application, but this does not mean that there are no other units in this embodiment.

[0084] In order to facilitate those skilled in the art to better understand the security protection system and security protection method provided by the above embodiments, Fig. 9 The security protection interaction method shown is explained.

[0085] like Fig. 9 As shown, a terminal A in the security protection system includes a first module, a second module and a third module, and a server B includes a fourth module. When applied, the interaction process between the first module, the second module, the third module and the fourth module will be as follows:

[0086] Step 901: The fourth module receives the sensitive file detection strategy and the file outbound management and control strategy configured by the administrator through the configuration interface.

[0087] Among them, the sensitive file detection strategy can include source detection strategy, sources include office applications, code warehouses, instant messaging tools, mailboxes, peripherals, etc., and support further refinement of strategies according to different source channels, such as office applications, code warehouses and other channels are subdivided into specific URLs, ports, paths, etc., instant messaging tools, mailboxes, etc. are subdivided into specific software, etc.; it can also include content detection strategy, where the content detection strategy can be a content matching rule. Once the downloaded file content hits these matching rules, it is also considered a sensitive source file. The control strategy for outbound file transmission can include the conditions for outbound transmission and the conditions for blocking outbound transmission.

[0088] Step 902: The fourth module sends the sensitive file detection strategy to the third module.

[0089] The fourth module is connected to the third module through communication, and the transmission is performed through the communication connection.

[0090] Step 903: The fourth module sends the file outbound management and control policy to the second module.

[0091] The fourth module is connected to the second module through communication, and the transmission is performed through the communication connection.

[0092] Step 904, the third module performs a file download operation on the terminal. If a file download is monitored, the currently downloaded file is detected according to the received sensitive file policy, and when it is detected that it is a sensitive file, the file information of the file is synchronized to the first module.

[0093] Step 905: The third module reports the file information of the detected sensitive file to the fourth module.

[0094] Step 906: The first module writes the corresponding file information into a preset monitoring file list according to the received file information to form a record of the local sensitive file.

[0095] Among them, the first module can write the corresponding file information in the preset monitoring file list and also store the received file information in the terminal.

[0096] Step 907, the first module monitors the file operation. If a file operation is monitored, it queries whether the object of the file operation belongs to the monitored file list and whether the sent file is the target operation. If both are yes, the current file operation is recorded in the file operation list and the file operation is associated with the operation of the corresponding local sensitive file in the file operation list to form an association relationship with the local sensitive file. If the current file operation also generates a new file, the new file is updated to the monitored file list.

[0097] Step 908: The second module monitors the outgoing file.

[0098] Step 909: If the second module monitors that the file is sent out, it will initiate a query to the first module.

[0099] Step 910: The first module returns the complete life cycle data of the corresponding file in the terminal to the second module based on the operations and association relationships recorded in the file operation list.

[0100] The complete life cycle data of the file in the terminal includes the file operations that the file has undergone, as well as the file operations that the file has undergone from the downloaded file.

[0101] Step 911, the second module controls the file according to the received complete life cycle data, wherein, when the control result is audit, the second module sends the file outward, and when the control result is blocking, the second module blocks the file from being sent outward.

[0102] Step 912: The second module reports the complete life cycle data of the corresponding file to the fourth module, and when the result of the control is an audit, the audit result is also reported to the fourth module.

[0103] It should be noted that Fig. 9 This is only an example of the system and method being implemented together, and does not mean that the system must be implemented as such. Fig. 9 The steps shown are implemented.

[0104] Another aspect of the present application embodiment further provides an electronic device, such as Fig.10 As shown, it includes: at least one processor 1001; and a memory 1002 that is communicatively connected to the at least one processor 1001; wherein the memory 1002 stores instructions that can be executed by the at least one processor 1001, and the instructions are executed by the at least one processor 1001 so that the at least one processor 1001 can execute the security protection method described in any of the above method embodiments.

[0105] Among them, the memory 1002 and the processor 1001 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 1001 and the memory 1002 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are all well known in the art, and therefore, are not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 1001 is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor 1001.

[0106] The processor 1001 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 1002 can be used to store data used by the processor 1001 when performing operations.

[0107] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0108] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0109] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A safety protection method, characterized in that: Applied to a terminal, the method comprises: When a target operation on a local sensitive file occurs, the target operation currently occurring is recorded and an association relationship with the local sensitive file is generated, wherein after the target operation is completed, the local file of the terminal will change; When the file is sent out, the operation of the current outgoing file is controlled based on the recorded target operation and the association relationship.

2. The safety protection method according to claim 1, characterized in that: The controlling of the operation of the current outgoing file according to the recorded target operation and the association relationship includes: According to the recorded target operation and the association relationship, the source of the file to be sent out is traced to determine whether the current outgoing file belongs to the local sensitive file or a derivative file of the local sensitive file; When it is determined that the currently sent out file is the local sensitive file or a derivative file of the local sensitive file, the operation of the currently sent out file is controlled according to a preset sensitive file control policy.

3. The safety protection method according to claim 1, characterized in that: While recording the target operation currently occurring and generating an association relationship with the local sensitive file, the method further includes: Record all files involved in the target operation currently occurring as the local sensitive files; The controlling of the operation of the current outgoing file according to the recorded target operation and the association relationship includes: The operation of the currently sent file is controlled based on the recorded target operation, the association relationship, and whether the currently sent file is the local sensitive file.

4. The safety protection method according to claim 3, characterized in that: The controlling the operation of the currently sent file according to the recorded target operation, the association relationship and the record of whether the currently sent file is the local sensitive file includes: Determine whether tracing is required based on whether the currently sent out file is a record of the local sensitive file; When tracing back the source is required, tracing back the currently sent out file according to the recorded target operation and the association relationship to obtain the complete life cycle data of the currently sent out file; Based on the complete life cycle data of the currently outgoing file, operations on the currently outgoing file are controlled.

5. The safety protection method according to claim 1, characterized in that: The controlling of the operation of the current outgoing file according to the recorded target operation and the association relationship includes: The operation of the currently outgoing file is controlled according to the recorded target operation, the association relationship and the content of the currently outgoing file.

6. The safety protection method according to any one of claims 1 to 5, characterized in that: The method further comprises: When downloading a file, according to a preset strategy, it is detected whether the currently downloaded file is a sensitive file, so as to determine whether an operation on the local sensitive file occurs based on the detected local sensitive file downloaded locally, wherein the preset strategy includes: detecting according to the file source and / or detecting according to the file content.

7. The safety protection method according to any one of claims 1 to 5, characterized in that: The method further comprises: Receive policies issued by the server for controlling operations on outbound files and / or policies for detecting whether files are sensitive; and / or, Report the relevant information and / or sensitive file information of the control to the server.

8. A safety protection system, characterized in that: include: A first module and a second module, wherein the first module and the second module are both deployed in a terminal, and the first module is connected to the second module in the same terminal; The first module is configured to synchronize the target operation currently occurring and the association relationship with the local sensitive file to the second module when the target operation for the local sensitive file occurs, wherein after the target operation is completed, the local file of the terminal where the first module is located will change; The second module is configured to receive and record the target operation and the association relationship synchronized by the first module, and when the file is sent out, control the operation of the current outgoing file according to the recorded target operation and the association relationship.

9. The safety protection system according to claim 8, characterized in that: Also includes a third module, the third module is deployed in the terminal and connected to the first module in the same terminal; The third module is configured to detect whether the currently downloaded file is a sensitive file according to a preset strategy when downloading a file, and synchronize the file information of the detected sensitive file to the first module, so that the first module can determine whether an operation occurs on the local sensitive file based on the detected sensitive file, wherein the preset strategy includes: detecting according to the file source and / or detecting according to the file content.

10. The safety protection system according to claim 9, characterized in that: It also includes a fourth module, which is deployed on the server and connected to the second module and the third module; The fourth module is configured to perform at least one of the following operations: send a policy for detecting whether it is a sensitive file to the third module, send a policy for controlling the operation of outgoing files to the second module, receive relevant information and / or file information of sensitive files reported by the second module, and receive file information of sensitive files reported by the third module.

11. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the security protection method according to any one of claims 1 to 7.

Images