Data one-way isolation method and device, electronic equipment and storage medium

Abstract

The invention provides a data one-way isolation method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to a browsing request of a browsing user, and displaying a controlled file in a browsing page of a network end; monitoring a to-be-processed operation event for the controlled file; identifying an operation area corresponding to the to-be-processed operation event in the controlled file; if it is determined that the operation area is overlapped with any controlled area, permission control is conducted on to-be-processed data operated by the to-be-processed operation event according to permission management configuration configured for the browsing user in advance. In the scheme, when the controlled file is displayed at the network end, the to-be-processed operation event for the controlled file is monitored, and the operation area is identified. And when the operation area is overlapped with any controlled area, authority control is performed on the to-be-processed data operated by the to-be-processed operation event according to the authority management configuration, so that one-way isolation between the data of the network side and the client side is realized, and the data security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of operation authority control, and in particular to a one-way data isolation method, device, electronic device and storage medium. Background Art

[0002] With the development of scientific research models, multi-center, multi-disciplinary, multi-role, and multi-project collaborative research has gradually become a new trend; in this multi-center, multi-disciplinary, multi-role, and multi-project collaborative research, the exchange of scientific research data becomes particularly important.

[0003] At present, scientific research data is usually uploaded to the network (web terminal) in the form of shared files, and users access the scientific research data on the network through local clients offline. However, when accessing scientific research data on the network through local clients, users can move the scientific research data on the network offline to the local computer, which may cause the leakage of scientific research data and poor data security. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a one-way data isolation method, device, electronic device and storage medium to solve the problem of poor data security in the existing way of accessing scientific research data on the network.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention discloses a method for unidirectionally isolating data, the method comprising:

[0007] Responding to the browsing request of the browsing user, displaying the controlled file in the browsing page of the network end;

[0008] Monitoring pending operation events for the controlled file;

[0009] Identify the operation area in the controlled file corresponding to the operation event to be processed;

[0010] If it is determined that the operation area overlaps with any controlled area, authority control is performed on the to-be-processed data of the to-be-processed operation event operation according to the authority management configuration pre-configured for the browsing user.

[0011] Preferably, the process of determining whether the operating area overlaps with any controlled area includes:

[0012] Acquire a permission management configuration pre-configured for the browsing user, wherein the permission management configuration at least includes: an area range of a controlled area, a first framework identifier corresponding to the controlled area, a controlled event corresponding to the controlled area, and a data processing method corresponding to the controlled area and the controlled event;

[0013] If there is an overlapping portion between the area range of the operating area and the area range of any of the controlled areas in the authority management configuration, it is determined that the operating area overlaps with any of the controlled areas.

[0014] Preferably, if it is determined that the operation area overlaps with any controlled area, according to the permission management configuration pre-configured for the browsing user, permission control is performed on the to-be-processed data of the to-be-processed operation event operation, including:

[0015] If it is determined that the operation area overlaps with any controlled area, determining whether the operation event to be processed is any controlled event corresponding to a target controlled area, the target controlled area being: the controlled area overlapping with the operation area;

[0016] If the operation event to be processed is any of the controlled events corresponding to the target controlled area, determining the data processing mode corresponding to the target controlled area and the operation event to be processed from the authority management configuration;

[0017] According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed.

[0018] Preferably, the operation event to be processed is a copy event, and the data processing method corresponding to the target controlled area and the copy event is encryption processing;

[0019] According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including:

[0020] intercepting the replication event;

[0021] Encrypting the to-be-processed data related to the target controlled area copied by the copy event to obtain a first encrypted character string;

[0022] embedding the first framework identifier corresponding to the target controlled area into the first encrypted string;

[0023] The first encrypted string embedded with the first framework identifier is written into a clipboard.

[0024] Preferably, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is a decryption process;

[0025] According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including:

[0026] Extracting a second framework identifier from the to-be-processed data related to the target controlled area pasted by the pasting event;

[0027] If the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, decrypting the to-be-processed data related to the target controlled area pasted by the paste event to obtain a plaintext character string;

[0028] Writing the plaintext character string into the target controlled area;

[0029] If the extracted second framework identifier is different from the first framework identifier corresponding to the target controlled area, or if the second framework identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

[0030] Preferably, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is encryption processing;

[0031] According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including:

[0032] Extracting a second framework identifier from the to-be-processed data related to the target controlled area pasted by the pasting event;

[0033] If the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, encrypting the to-be-processed data related to the target controlled area pasted by the paste event to obtain a second encrypted string;

[0034] Writing the second encrypted string into the target controlled area;

[0035] If the extracted second framework identifier is different from the first framework identifier corresponding to the target controlled area, or if the second framework identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

[0036] A second aspect of an embodiment of the present invention discloses a one-way data isolation device, the device comprising:

[0037] A display unit, used to respond to a browsing request of a browsing user and display the controlled file on a browsing page of a network terminal;

[0038] A monitoring unit, used for monitoring pending operation events for the controlled file;

[0039] An identification unit, used for identifying an operation area in the controlled file corresponding to the operation event to be processed;

[0040] The control unit is used to perform authority control on the to-be-processed data of the to-be-processed operation event operation according to the authority management configuration pre-configured for the browsing user if it is determined that the operation area overlaps with any controlled area.

[0041] Preferably, the control unit comprises:

[0042] An acquisition module, used to acquire a permission management configuration pre-configured for the browsing user, wherein the permission management configuration at least includes: an area range of a controlled area, a first framework identifier corresponding to the controlled area, a controlled event corresponding to the controlled area, and a data processing method corresponding to the controlled area and the controlled event;

[0043] The determination module is configured to determine that the operation area overlaps with any of the controlled areas if there is an overlapping portion between the area range of the operation area and the area range of any of the controlled areas in the authority management configuration.

[0044] A third aspect of an embodiment of the present invention discloses an electronic device, comprising a processor and a memory, wherein the memory is used to store program code and data of a one-way data isolation method, and the processor is used to call the program instructions in the memory to execute any one of the one-way data isolation methods disclosed in the first aspect of the embodiment of the present invention.

[0045] A fourth aspect of an embodiment of the present invention discloses a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the unidirectional data isolation methods disclosed in the first aspect of the embodiment of the present invention.

[0046] Based on the above-mentioned embodiment of the present invention, a one-way data isolation method, device, electronic device and storage medium are provided. The method includes: responding to the browsing request of the browsing user, displaying the controlled file in the browsing page of the network end; monitoring the pending operation events for the controlled file; identifying the operation area corresponding to the pending operation event in the controlled file; if it is determined that the operation area overlaps with any controlled area, according to the permission management configuration pre-configured for the browsing user, the pending data of the operation event operation is subject to permission control. In this scheme, when the controlled file is displayed on the network end, the pending operation events for the controlled file are monitored and the operation area is identified. When the operation area overlaps with any controlled area, the pending data of the operation event operation is subject to permission control according to the permission management configuration, thereby realizing one-way isolation between the data on the network end and the client end, and improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0048] Figure 1 A flowchart of a one-way data isolation method provided by an embodiment of the present invention;

[0049] Figure 2 An example diagram of a rights management configuration provided by an embodiment of the present invention;

[0050] Figure 3 An example diagram of pasting the to-be-processed data copied in the controlled area A into an external file provided in an embodiment of the present invention;

[0051] Figure 4 An example diagram of pasting the to-be-processed data copied from an external file into the controlled area A provided in an embodiment of the present invention;

[0052] Figure 5 An example diagram of pasting the to-be-processed data copied in the controlled area A back to the controlled area A provided in an embodiment of the present invention;

[0053] Figure 6 An example diagram of the rights management processing logic of a complete copy and paste process provided by an embodiment of the present invention;

[0054] Figure 7 An example diagram of the architecture of a general technical framework provided for an embodiment of the present invention;

[0055] Figure 8Another flow chart of a one-way data isolation method provided by an embodiment of the present invention;

[0056] Fig. 9 A structural block diagram of a one-way data isolation device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0059] In traditional scientific research scenarios, given the particularity and sensitivity of scientific research data (such as medical data), management departments often need to strictly review the export and operation of scientific research data through institutionalized processes during the acquisition and processing stages of scientific research data. Although this can alleviate the risk of data leakage to a certain extent, the lengthy application approval process and efficiency issues can no longer meet the fast-paced research process. How to fully improve the value of scientific research data and circulation management efficiency while ensuring the security of scientific research data is an issue that scientific research managers are paying close attention to today.

[0060] With the development of scientific research models, multi-center, multi-disciplinary, multi-role, and multi-project collaborative research has gradually become a new trend. At this time, the exchange and processing of scientific research data is particularly important; for example, medical alliances and research alliances have posed more challenges to the exchange efficiency and data security of scientific research data.

[0061] The traditional data exchange method of exporting and sharing files through offline data is gradually being abandoned, and is being replaced by intensive data management applications represented by scientific research project data sets and multi-center collaborative networks. These applications use B / S architecture for centralized services or are deployed in private clouds, uploading scientific research data to the web in the form of shared files.

[0062] Users view shared files on the web through local clients and dedicated networks; however, the client and the web cannot achieve one-way data isolation (that is, asymmetric data processing). Users can move scientific research data on the network offline to the local computer, which may cause scientific research data leakage and poor data security. If users' operations on shared files are completely blocked, it will be extremely unfriendly to the user experience.

[0063] Therefore, in order to balance data security and user experience, this solution proposes a one-way data isolation method, device, electronic device and storage medium, which monitors pending operation events for controlled files and identifies the operation area when the controlled files are displayed on the network side. When the operation area overlaps with any controlled area, the pending data for the pending operation event operation is controlled according to the permission management configuration, thereby achieving one-way isolation between the data on the network side and the client, and not completely blocking all operations on the controlled files, thereby improving data security and ensuring the user experience.

[0064] See also Figure 1 , shows a flow chart of a one-way data isolation method provided by an embodiment of the present invention, the one-way data isolation method comprising:

[0065] Step S101: responding to a browsing request of a browsing user, and displaying a controlled file on a browsing page on a network terminal.

[0066] In the specific implementation of step S101, in response to a browsing request of a browsing user for browsing a controlled file, the controlled file is displayed in a browsing page of a network terminal (web terminal). The controlled file is a file that is subject to permission control (such as a shared file).

[0067] It is understandable that before displaying controlled files on the browsing page of the network end, the browsing authority of the browsing user needs to be verified; only when the browsing user has the browsing authority to browse controlled files, the controlled files will be displayed on the browsing page of the network end.

[0068] It should be further explained that when a controlled file is displayed on a browsing page on the network, a request is made to the browsing user for permission to monitor pending operation events for the controlled file. That is, this solution monitors pending operation events for the controlled file on the premise of obtaining authorization from the browsing user in advance.

[0069] Step S102: monitoring pending operation events for the controlled file.

[0070] In the process of implementing step S102, after the controlled file is displayed in the browsing page of the network end, the browsing user's pending operation events for the controlled file in the browsing page are monitored. The pending operation events are any operation events, including but not limited to: copy events, paste events, cut events, etc.

[0071] Step S103: Identify the operation area in the controlled file corresponding to the operation event to be processed.

[0072] It should be noted that when a browsing user triggers a pending operation event in a controlled file, the pending operation event will act on a certain area in the controlled file. The area in the controlled file where the pending operation event acts is called: the operation area corresponding to the pending operation event.

[0073] In the specific implementation of step S103, after monitoring the pending operation event for the controlled file, the operation area in the controlled file corresponding to the pending operation event is identified, that is, which area in the controlled file the pending operation event acts on is identified.

[0074] Step S104: determine whether the operating area overlaps with any controlled area; if the operating area does not overlap with any controlled area, execute step S105; if the operating area overlaps with any controlled area, execute step S106.

[0075] It should be noted that the controlled area is the area in the controlled file that is subject to authority control, and the controlled event is the operation event in the controlled area of ​​the controlled file that is subject to authority control;

[0076] For operation events such as copy events, paste events, cut events, etc., a corresponding event identifier is bound to each operation event in advance; the event identifier can be used to determine which operation events are controlled events. Specifically, according to actual needs, the event identifiers of certain operation events are exposed, and these operation events with exposed event identifiers are controlled events.

[0077] When performing permission management on controlled files, the permission management configuration is pre-configured, and the permission management configuration at least includes: the area range of the controlled area, the first framework identifier corresponding to the controlled area, the controlled event corresponding to the controlled area, and the data processing method corresponding to the controlled area and the controlled event (such as encryption, decryption, salting, replacement with blanks, conversion to garbled characters, etc.).

[0078] The data processing methods corresponding to the controlled areas and controlled events are characterized as follows: which data processing methods need to be adopted when a controlled event in the controlled area is monitored.

[0079] The following definitions can be completed through the permission management configuration mentioned above: which areas in the controlled file are controlled areas, the first frame identifier corresponding to the controlled area, which operation events triggered in the controlled area are controlled events, and the data processing method corresponding to the controlled area and controlled events.

[0080] It is worth noting that when using the permission management configuration to manage the permissions of browsing users, different permission management configurations can be configured for each browsing user (equivalent to personalized permission management), or the same permission management configuration can be configured for all browsing users (global configuration so that all browsing users share the same permission management configuration), or different permission management configurations can be configured for different groups (including at least one browsing user); the corresponding permission management configuration is bound to each browsing user in advance.

[0081] For example, when browsing user A and browsing user B are browsing a controlled file, for browsing user A, area A in the controlled file is a controlled area, and area B is not a controlled area; while for browsing user B, area A and area B in the controlled file are both controlled areas.

[0082] Based on the above description of the permission management configuration, in the specific implementation of step S104, the permission management configuration pre-configured for the browsing user is obtained; according to the permission management configuration configured for the browsing user, it is determined whether the operation area corresponding to the operation event to be processed overlaps with any controlled area;

[0083] If the operation area does not overlap with any controlled area, execute step S105; if the operation area overlaps with any controlled area, execute step S106.

[0084] Specifically, after obtaining the permission management configuration pre-configured for the browsing user, it is determined whether there is an overlap between the area range of the operation area and the area range of any controlled area in the permission management configuration;

[0085] If there is an overlap between the area range of the operating area and the area range of any controlled area in the authority management configuration, it is determined that the operating area overlaps with any controlled area, and step S106 is executed;

[0086] On the contrary, if there is no overlapping part between the area range of the operating area and the area range of each controlled area in the authority management configuration, it is determined that the operating area does not overlap with the controlled area, and step S105 is executed.

[0087] It is worth noting that "the operating area overlaps with the controlled area" specifically means: the operating area overlaps partially or as a whole with the controlled area; more specifically, "the operating area overlaps with the controlled area" is any one of the following situations: part of the operating area overlaps with part of the controlled area, the operating area covers the controlled area, and the controlled area covers the operating area.

[0088] Step S105: Release and directly execute the pending operation event.

[0089] In the specific implementation of step S105, if the operation area corresponding to the pending operation event does not overlap with the controlled area, it indicates that the pending operation event is not a controlled event. In this case, the pending operation event is released and then directly executed.

[0090] Step S106: according to the authority management configuration pre-configured for the browsing user, authority control is performed on the data to be processed by the operation event to be processed.

[0091] In the process of implementing step S106, if it is determined that the operation area corresponding to the operation event to be processed overlaps with any controlled area, it indicates that the operation event to be processed may be a controlled event, and the data to be processed of the operation event to be processed may be controlled data (data subject to permission control). At this time, according to the permission management configuration configured for the browsing user, permission control is performed on the data to be processed of the operation event to be processed.

[0092] In some embodiments, since the authority management configuration defines which areas are controlled areas, which operation events triggered in the controlled areas are controlled events, and the data processing methods corresponding to the controlled areas and controlled events; therefore, the specific method of performing authority control on the pending data of the pending operation event operation according to the authority management configuration is:

[0093] It is determined whether the operation event to be processed is any controlled event corresponding to the target controlled area, where the target controlled area is: a controlled area overlapping with the operation area; the operation area here refers to: an operation area corresponding to the operation event to be processed.

[0094] If the operation event to be processed is any controlled event corresponding to the target controlled area, determine the data processing method corresponding to the target controlled area and the operation event to be processed from the permission management configuration;

[0095] According to the data processing mode corresponding to the target controlled area and the operation event to be processed, the authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed;

[0096] The “data to be processed related to the target controlled area” specifically refers to: the data to be processed related to the target controlled area among all the data to be processed of the operation event to be processed.

[0097] For example, assuming that the operation event to be processed is a copy event, then the “data to be processed related to the target controlled area” specifically refers to the data to be processed that is copied in the target controlled area.

[0098] For another example: assuming that the operation event to be processed is a paste event, then the “data to be processed related to the target controlled area” specifically refers to: the data to be processed pasted into the target controlled area.

[0099] If the operation event to be processed is not any controlled event corresponding to the target controlled area, it indicates that the operation event to be processed is not a controlled event. In this case, the operation event to be processed is released and then directly executed.

[0100] That is to say, when the operation area corresponding to the operation event to be processed overlaps with any controlled area, it is first determined whether the operation event to be processed is a controlled event.

[0101] If the operation event to be processed is a controlled event, authority control is performed on the data to be processed related to the target controlled area according to the data processing method corresponding to the target controlled area and the operation event to be processed.

[0102] If the pending operation event is not a controlled event, the pending operation event is released and then directly executed.

[0103] In the embodiment of the present invention, when the controlled file is displayed on the network side, pending operation events for the controlled file are monitored and the operation area is identified. When the operation area overlaps with any controlled area, the pending data for the pending operation event operation is controlled according to the permission management configuration, and all operations on the controlled file will not be completely blocked, thereby improving data security and ensuring the user experience.

[0104] In the above embodiments of the present invention Figure 1 On the basis of each step, under different controlled events and different data processing methods, the methods of performing permission control on the data to be processed related to the target controlled area are different; the following explains how to perform permission control on the data to be processed related to the target controlled area through multiple embodiments; among which, the target controlled area is: a controlled area overlapping with the operating area.

[0105] In some embodiments, the operation event to be processed is a copy event, and the data processing method corresponding to the target controlled area and the copy event is encryption processing; the specific method of performing permission control on the data to be processed related to the target controlled area operated by the operation event to be processed is:

[0106] Intercepting a copy event; encrypting the unprocessed data related to the target controlled area copied by the copy event to obtain a first encrypted string; embedding a first framework identifier corresponding to the target controlled area into the first encrypted string; and writing the first encrypted string embedded with the first framework identifier into a clipboard.

[0107] Among them, the encryption processing mentioned above is specifically performed through encryption processing using a specified encryption algorithm (such as AES symmetric encryption algorithm, ChaCha20 encryption algorithm, etc.).

[0108] It is worth noting that, when the operation event to be processed is a copy event, the copy event is used to copy certain data to be processed, and its essence is the process of writing the data to be processed into the clipboard;

[0109] Therefore, when a copy event is monitored and the operation area overlaps with any controlled area, the copy event is intercepted to block the pending data related to the target controlled area from being written to the clipboard; then the pending data related to the target controlled area copied by the copy event is encrypted, and the first framework identifier corresponding to the target controlled area is hidden and embedded at the agreed position of the first encrypted string; after completing the above processing, the copy event is triggered and released to write the first encrypted string embedded with the first framework identifier into the clipboard, thereby completing the permission control of the copy event.

[0110] It is worth noting that the first frame identifier corresponding to the controlled area in the permission management configuration can be used to determine whether a certain area is a controlled area; in actual applications, when the operation event to be processed is a copy event, another specific implementation method of "determining whether there is an overlapping part between the area range of the operation area and the area range of the controlled area" is: when the browsing user triggers a copy event for a controlled file, the browsing user will select the operation area of ​​the controlled file; according to the field of the data to be processed selected by the browsing user, traverse upwards to extract the first frame identifier (first find the key of the first frame identifier, and then find the corresponding value according to the key, and the value is the first frame identifier);

[0111] It should be noted that when the browsing page on the network displays a controlled file, the content displayed in the browsing page is wrapped in Hypertext Markup Language (HTML) code; when the data to be processed is selected, the HTML code line where the selected data to be processed is located can be located, and then the key of the first frame identifier can be traversed upward layer by layer according to the hierarchical relationship of HTML, and then the corresponding value (first frame identifier) ​​can be found according to the key.

[0112] In the process of traversing upwards to extract the first frame identifier; if the first frame identifier can be extracted, there is an overlap between the area range representing the operating area and the area range of the controlled area, and at this time, the data to be processed related to the controlled area is the controlled data (data subject to authority control);

[0113] If the first frame identifier is not extracted, there is no overlapping portion between the area range representing the operating area and the area range of the controlled area, and at this time, the to-be-processed data related to the operating area is not controlled data.

[0114] In some other embodiments, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is decryption processing; the specific method of performing permission control on the data to be processed related to the target controlled area operated by the operation event to be processed is:

[0115] Extracting a second frame identifier from the to-be-processed data related to the target controlled area pasted by the pasting event;

[0116] If the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, decrypt the to-be-processed data related to the target controlled area pasted by the paste event to obtain a plaintext string; and write the plaintext string into the target controlled area;

[0117] If the extracted second frame identifier is different from the first frame identifier corresponding to the target controlled area, or if the second frame identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

[0118] It is worth noting that, when the operation event to be processed is a paste event and the data processing method corresponding to the paste event is decryption processing, the paste event is used to paste some of the data to be processed in the clipboard into the operation area, which is essentially a process of writing the data to be processed in the clipboard out of the clipboard;

[0119] Therefore, when a paste event is monitored and the operation area overlaps with any controlled area, the second frame identifier is first extracted from the to-be-processed data related to the target controlled area in the pasteboard (equivalent to first intercepting the to-be-processed data related to the target controlled area). The operation of "extracting the second frame identifier" is used to determine the source of the to-be-processed data related to the target controlled area.

[0120] If the second frame identifier is not extracted, it indicates that the data to be processed related to the target controlled area is uncontrolled data (such as external data). At this time, there is no need to process the data to be processed related to the target controlled area, and the data to be processed related to the target controlled area in the clipboard is directly written into the target controlled area;

[0121] If the second frame identifier is extracted, it is necessary to compare the second frame identifier with the first frame identifier corresponding to the target controlled area;

[0122] If the extracted second frame identifier is the same as the first frame identifier corresponding to the target controlled area, it indicates that the data to be processed related to the target controlled area originates from the target controlled area. At this time, the data to be processed related to the target controlled area in the clipboard is decrypted to obtain a plaintext string, and the plaintext string is written into the target controlled area.

[0123] If the extracted second frame identifier is different from the first frame identifier corresponding to the target controlled area, indicating that the data to be processed related to the target controlled area originates from other controlled areas (i.e., not from the target controlled area). At this time, the data to be processed related to the target controlled area in the clipboard will not be processed, and the data to be processed related to the target controlled area in the clipboard will be directly written into the target controlled area.

[0124] In other embodiments, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is encryption processing; the specific method of performing permission control on the data to be processed related to the target controlled area operated by the operation event to be processed is:

[0125] A second frame identifier is extracted from the to-be-processed data related to the target controlled area pasted by the paste event.

[0126] If the extracted second frame identifier is the same as the first frame identifier corresponding to the target controlled area, encrypt the to-be-processed data related to the target controlled area pasted by the paste event to obtain a second encrypted string;

[0127] Writing the second encrypted string into the target controlled area;

[0128] If the extracted second frame identifier is different from the first frame identifier corresponding to the target controlled area, or if the second frame identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

[0129] It is worth noting that the explanation of the paste event and the second frame identifier is detailed in the previous embodiment and will not be repeated here.

[0130] When the operation event to be processed is a paste event and the data processing method corresponding to the paste event is encryption processing, firstly extract the second frame identifier from the data to be processed related to the target controlled area in the pasteboard;

[0131] If the second frame identifier is not extracted, the data to be processed related to the target controlled area is characterized as uncontrolled data (such as external data), and the data to be processed related to the target controlled area in the clipboard is directly written into the target controlled area;

[0132] If the second frame identifier is extracted, and the extracted second frame identifier is the same as the first frame identifier corresponding to the target controlled area, it indicates that the data to be processed related to the target controlled area originates from the target controlled area. At this time, the data to be processed related to the target controlled area in the clipboard is encrypted to obtain a second encrypted string, and the second encrypted string is written into the target controlled area;

[0133] If the extracted second frame identifier is different from the first frame identifier corresponding to the target controlled area, indicating that the data to be processed related to the target controlled area originates from other controlled areas (i.e., not from the target controlled area), the data to be processed related to the target controlled area in the clipboard will not be processed, and the data to be processed related to the target controlled area in the clipboard will be directly written into the target controlled area.

[0134] Through the contents of the above embodiments, permission control is performed on different operation events and data operated by different operation events.

[0135] In order to better explain how to perform permission control on different operation events and data operated by different operation events, an example is given in which the data to be processed is medical data.

[0136] In the usage scenario of medical data, the problem that needs to be solved by the rendering and display layer of the browsing page on the network side is that any data seen from the browsing page on the network side is not allowed to be pasted into local files in plain text, but there is no restriction on the operation events within the browsing page (or certain restrictions may be made), these operation events include but are not limited to selection events, copy events, paste events, etc.; local data can be directly pasted into the browsing page on the network side.

[0137] On the basis of the above-mentioned "problems that need to be solved in the rendering and display layer of the browsing page on the network side", a permission management configuration (also called a permission matrix) is configured for browsing users. The following contents are defined through the permission management configuration: which areas in the controlled file are controlled areas, the first frame identifier corresponding to the controlled area, which operation events triggered in the controlled area are controlled events, and the data processing method corresponding to the controlled area and controlled events.

[0138] For example Figure 2 As can be seen from the example diagram of the permission management configuration shown, the controlled file is divided into controlled area A and controlled area B. The first frame identifier corresponding to the controlled area A is marked as A, and the first frame identifier corresponding to the controlled area B is marked as B; in addition, the uncontrolled area is marked as uncontrolled area C.

[0139] For the controlled area A, the copy event and paste event in the controlled area A are both controlled events ( Figure 2 The operation events that are checked in the control area A are controlled events); the data processing method corresponding to the copy event in the controlled area A is encryption processing (using the AES symmetric encryption algorithm), and the data processing method corresponding to the paste event in the controlled area A is decryption processing;

[0140] For the controlled area B, the paste event in the controlled area B is a controlled event; the data processing method corresponding to the paste event in the controlled area B is encryption processing;

[0141] pass Figure 2 The rights management configuration shown shows that within the controlled area A, it is necessary to monitor the copy event and encrypt the copied data, and within the controlled area A, it is necessary to monitor the paste event and decrypt the pasted data;

[0142] In the controlled area B, it is necessary to monitor the paste event and encrypt the pasted data; in the uncontrolled area C, no permission control is performed.

[0143] exist Figure 2 On the basis of the content shown, when a browsing user browses a controlled file on a browsing page on the network side, the browsing user's pending operation events for the controlled file are monitored, and permission control is performed according to the pending operation events and the operation areas corresponding to the pending operation events. Data in different controlled areas and outside controlled areas are processed in a process-based manner, and the process of "writing external data of external files into the controlled area of ​​controlled files" is also processed. The following uses processes one to seven to illustrate the permission management processing logic of this solution from a complete copy and paste process.

[0144] In the example contents shown in the following processes 1 to 7, the operation event to be processed is a copy event or a paste event, and the operation area corresponding to the operation event to be processed is a controlled area A, a controlled area B or an uncontrolled area C. The specific explanation of the controlled area A and the controlled area B is detailed in the above-mentioned Figure 2 Explanation of the.

[0145] Process 1: The browsing user selects any data to be processed in the controlled file for copying, which is essentially the process of writing the selected data to be processed to the clipboard; at this time, the first frame identifier is obtained by traversing upward according to the field of the selected data to be processed; the selected data to be processed is diverted according to the obtained first frame identifier, that is, it enters different processing flows according to the first frame identifier; the data to be processed in the controlled area A needs to be encrypted; the data to be processed in the controlled area B and the uncontrolled area C are not processed and are directly written to the clipboard.

[0146] Process 2: For the data to be processed that is selected to be copied in the controlled area A (in this case, the operation event to be processed is a copy event, the operation area is the controlled area A, and the data to be processed is controlled data), intercept the copy event of the browser to prevent the data to be processed from being written to the clipboard; Figure 2 The data processing method corresponding to the copy event in the controlled area A shown is to encrypt the data to be processed that is selected for copying in the controlled area A to obtain a first encrypted string; and hide the first framework logo embedded in the controlled area A at the agreed position of the first encrypted string.

[0147] Among them, "embedding the first framework identifier" can be completed in the back end through an interface, and the purpose of "embedding the first framework identifier" is to identify the source of the first encrypted string.

[0148] It should be noted that, in order to better understand this solution, the controlled area A covers the operation area of ​​the replication event, so the operation area and the target controlled area corresponding to the replication event are both the controlled area A.

[0149] Process three: After executing process two, the original copy event is automatically triggered, the copy event is released, and the first encrypted string embedded with the first frame identifier of the controlled area A is written to the clipboard. At this time, the copy event is completed, and the browsing user's pending operation events continue to be monitored.

[0150] Process 4: When the browsing user executes a paste event, the essence is the process of writing the pending data in the clipboard out of the clipboard; the browsing user's paste location is mainly divided into the following two types: one is to paste the pending data into a controlled file for data interaction, and the other is to paste the pending data into an external file (such as a local client text file or Excel spreadsheet).

[0151] When the browsing user's pasting location is a controlled file, the detailed process is shown in the following process 5;

[0152] When the browsing user's pasting location is an external file, the data to be processed in the clipboard is directly written to the external file, and the data to be processed written into the external file is any one of the following: the first encrypted string embedded with the first frame identifier of the controlled area A, the unencrypted data to be processed selected and copied in the controlled area B, and the unencrypted data to be processed selected and copied in the uncontrolled area C.

[0153] For example, through Figure 3 As shown in the example diagram of pasting the data to be processed copied in the controlled area A to an external file, it can be seen that the controlled area A of the controlled file displays the plain text data to be processed 1, data to be processed 2 and data to be processed 3; in the controlled area A, the data to be processed 1, data to be processed 2 and data to be processed 3 are selected and copied ( Figure 3 The dotted line framed part), after the logical processing of the above process one to process three, a first encrypted string embedded with the first frame identifier of the controlled area A is obtained, and the first encrypted string is written to the clipboard; when the copied data to be processed 1, data to be processed 2 and data to be processed 3 are pasted into an external file, the content written from the clipboard to the external file is the first encrypted string, that is, the content displayed in the external file is the first encrypted string.

[0154] Process 5: When the data to be processed in the clipboard is pasted into the controlled file, a series of judgment logic will be triggered, and logical judgment will be performed based on the operation area where the data to be processed is pasted and the source of the data to be processed.

[0155] First, determine whether the paste event needs to be intercepted. Since the uncontrolled area C does not perform permission control, if the operation area for pasting the data to be processed is the uncontrolled area C (in this case, the operation event to be processed is a paste event), then the data to be processed in the clipboard is directly written into the uncontrolled area C;

[0156] If the operation area for pasting the data to be processed is controlled area A or controlled area B (in this case, the operation event to be processed is a paste event), it is necessary to intercept the paste event to prevent the data to be processed in the clipboard from being directly written into controlled area A or controlled area B.

[0157] It should be noted that when the operation area corresponding to the paste event is the controlled area A or the controlled area B, in order to better understand this solution, the controlled area A or the controlled area B covers the operation area corresponding to the paste event, so the operation area and the target controlled area corresponding to the paste event are both controlled area A, or, the operation area and the target controlled area corresponding to the paste event are both controlled area B.

[0158] Process six: After intercepting the paste event, it is necessary to determine the source of the data to be processed in the clipboard. The source of the data to be processed in the clipboard is any of the following: the controlled area of ​​the controlled file, the uncontrolled area of ​​the controlled file, and the external file.

[0159] When determining the source of the data to be processed in the clipboard, the second frame identifier is extracted from the agreed position of the data to be processed in the clipboard.

[0160] If the second frame identifier is not extracted, it means that the data to be processed in the clipboard comes from an external file (for example, the data to be processed is plain text data of an external file) or an uncontrolled area of ​​a controlled file. At this time, no processing is performed and the data to be processed in the clipboard is directly written to the target controlled area (controlled area A or controlled area B) corresponding to the paste event.

[0161] For example Figure 4 As shown in the example figure of pasting the data to be processed copied from an external file into the controlled area A, it can be seen that the external file displays the plain text data to be processed 1, data to be processed 2 and data to be processed 3; in the external file, the data to be processed 1, data to be processed 2 and data to be processed 3 are selected and copied, and after the logical processing of the above-mentioned process five and process six, the second frame identifier is not extracted. At this time, no processing is done, and the plain text data to be processed 1, data to be processed 2 and data to be processed 3 in the clipboard are directly written into the controlled area A, that is, the content displayed in the controlled area A is the plain text data to be processed 1, data to be processed 2 and data to be processed 3.

[0162] If the second frame identifier is extracted, the following logical judgment of process seven is required.

[0163] Process seven: If the second frame identifier can be extracted, it is necessary to determine whether the second frame identifier and the first frame identifier corresponding to the target controlled area (controlled area A or controlled area B) are the same; if the first frame identifier and the first frame identifier corresponding to the target controlled area are different, the data to be processed in the clipboard is directly written to the target controlled area (controlled area A or controlled area B) corresponding to the paste event.

[0164] If the first framework identifier is the same as the first framework identifier corresponding to the target controlled area, and the target controlled area is the controlled area A, the data to be processed in the pasteboard is decrypted to obtain a plaintext string, and the plaintext string is written into the controlled area A;

[0165] When the target controlled area is the controlled area B, the data to be processed in the clipboard is encrypted to obtain a second encrypted string, and the second encrypted string is written into the controlled area B.

[0166] That is to say, when the data to be processed copied from the controlled area A is pasted back to the controlled area A, the data to be processed in the pasteboard is the first encrypted string embedded with the first frame identifier of the controlled area A; because the second frame identifier extracted from the first encrypted string (that is, the first frame identifier embedded in the first encrypted string) is the same as the first frame identifier of the controlled area A, the frame identifiers match, and at this time, the data to be processed in the pasteboard (that is, the first encrypted string) is decrypted, and the plaintext string is echoed in the controlled area A;

[0167] For example Figure 5 As shown in the example diagram of pasting the copied data to be processed in the controlled area A back to the controlled area A, it can be seen that the plain text data to be processed 1, data to be processed 2 and data to be processed 3 are displayed in the controlled area A; the data to be processed 1, data to be processed 2 and data to be processed 3 are selected and copied in the controlled area A, and after the logical processing of the above process one to process three, the first encrypted string embedded with the first framework identifier of the controlled area A is obtained, and the first encrypted string is written to the clipboard;

[0168] When the copied data to be processed 1, data to be processed 2 and data to be processed 3 are pasted back into the controlled area A, the first encrypted string in the clipboard is decrypted through the logical processing of the above process seven, and the obtained plaintext data to be processed 1, data to be processed 2 and data to be processed 3 are written into the controlled area A for display.

[0169] When the data to be processed copied from the controlled area A (here equivalent to the first encrypted string embedded with the first frame identifier of the controlled area A) is pasted into the controlled area B, since the second frame identifier extracted from the first encrypted string (that is, the first frame identifier embedded in the first encrypted string) is different from the first frame identifier of the controlled area B, the frame identifiers do not match. At this time, the first encrypted string in the clipboard is directly written into the controlled area B for display.

[0170] Similarly, when the data to be processed (plaintext data) copied from the controlled area B is pasted back into the controlled area B, since the second frame identifier extracted from the data to be processed (equivalent to the first frame identifier of the controlled area B here) is the same as the first frame identifier of the controlled area B, the frame identifiers match. At this time, the data to be processed in the clipboard is encrypted to obtain a second encrypted string, which is then written into the controlled area B for display.

[0171] When the data to be processed (plain text data) copied from the controlled area B is pasted back to the controlled area A, the frame identifiers do not match because the second frame identifier extracted from the data to be processed (equivalent to the first frame identifier of the controlled area B here) is different from the first frame identifier of the controlled area A. At this time, the data to be processed (plain text data) in the clipboard is directly written into the controlled area A for display.

[0172] Based on the contents of the above process 1 to process 7, this solution is applied to implement a complete copy and paste process with detailed permission management processing logic as follows: Figure 6 shown.

[0173] Figure 6 In the process, the browsing user selects any data to be processed in the controlled file for copying, traverses upward according to the field of the selected data to be processed to obtain the first frame identifier, and then enters different processing flows according to the first frame identifier; specifically, the data to be processed in the controlled area B and the uncontrolled area C are not processed and are directly written to the clipboard; the data to be processed in the controlled area A needs to be encrypted to obtain the first encrypted string (first intercept the copy event, and then perform encryption), the first frame identifier of the controlled area A is embedded in the first encrypted string, and the first encrypted string embedded with the first frame identifier of the controlled area A is written to the clipboard.

[0174] The browsing user selects the paste position; when pasting the pending data in the clipboard into an external file, the pending data written into the external file can be any of the following: the first encrypted string embedded with the first frame identifier of the controlled area A, the copied unprocessed pending data is selected in the controlled area B, and the copied unprocessed pending data is selected in the uncontrolled area C; the pasting is completed.

[0175] When pasting the data to be processed in the clipboard into the controlled file, determine whether to intercept the paste event.

[0176] If the paste event is not intercepted (the operation area is the uncontrolled area C), the data to be processed in the clipboard is directly written into the uncontrolled area C; and the paste is completed.

[0177] If a paste event is intercepted (the operation area is the controlled area A or the controlled area B), it is determined whether the second frame identifier can be extracted.

[0178] If the second frame identifier cannot be extracted, the data to be processed in the clipboard is directly written into the target controlled area (controlled area A or controlled area B) corresponding to the paste event.

[0179] If the second framework identifier can be extracted, determine whether the framework identifier matches (determine whether the second framework identifier is the same as the first framework identifier corresponding to the target controlled area).

[0180] If the frame identifiers do not match (the second frame identifier is different from the first frame identifier corresponding to the target controlled area), directly write the data to be processed in the clipboard to the target controlled area (controlled area A or controlled area B) corresponding to the paste event; and complete the paste.

[0181] If the framework identifiers match (the second framework identifier is the same as the first framework identifier corresponding to the target controlled area), the data to be processed pasted into the controlled area A is decrypted to obtain the plaintext string written into the controlled area A, and the data to be processed pasted into the controlled area B is encrypted to obtain the second encrypted string written into the controlled area B; the pasting is completed.

[0182] The above embodiments of the present invention Figures 2 to 6 A detailed example is given for this scheme.

[0183] In actual applications, when this solution is applied to product projects, in order to meet specific business needs, this solution is implemented through a general technical framework;

[0184] like Figure 7 The example diagram of the architecture of the general technical framework is shown in Figure 1. The general technical framework includes the following three parts: an initialization part 701, a controlled item selection part 702, and a permission management configuration part 703;

[0185] The specific content of the initialization part 701 is: introducing a general technical framework in the product project, initializing the controlled area of ​​the controlled file through the general technical framework, and adding a first framework identifier to the controlled area to support adjusting the controlled area of ​​the controlled file according to business needs;

[0186] This general technical framework is used to monitor global operation events and expose the event identifiers of operation events, thereby completing the initialization of controlled events and supporting the adjustment of controlled events according to business needs.

[0187] This general technical framework is used to initialize the encryption algorithm and key used in encryption processing, as well as the decryption algorithm and key used in decryption processing, to support the configuration of different data processing methods based on business needs.

[0188] The specific content of the controlled item selection part 702 is: select the controlled item according to the business needs. Specifically, according to the content of the initialization part 701, select the controlled area, select the controlled event, and select the encryption algorithm, decryption algorithm, and key.

[0189] The specific content of the permission management configuration part 703 is: according to the content of the selected controlled item part 702, a permission management configuration is formed for the back-end to call, wherein a different permission management configuration can be configured for each browsing user, or the same permission management configuration can be configured for all browsing users, or different permission management configurations can be configured for different groups; the permission management configuration is bound to the browsing user to complete the introduction of the general technical framework.

[0190] The general technical framework mentioned above can be flexibly grafted into various network applications (web applications), and business needs can be quickly realized by completing customization; after binding the role account of the browsing user, permission classification and permission distribution can be quickly realized, which has high universality;

[0191] For ordinary browsing users, they can realize the imperceptible operation of network-side data editing and the influx and merging of local data, effectively improving data processing efficiency and operability; for administrators, there is no need to worry about the controlled files on the network side leaking data, which improves data security.

[0192] In general, the overall implementation process of this solution is as follows: Figure 8 As shown in another flow chart of a one-way data isolation method, Figure 8 The following steps are involved:

[0193] Step S801: The administrator configures the rights management configuration for the browsing user.

[0194] In the specific implementation, the administrator completes the setting of permission management configuration through corresponding operations and permission distribution, selects data processing methods (such as encryption and decryption algorithms and keys), controlled areas of controlled files, and controlled events of controlled files; and binds corresponding permission management configuration to each browsing user.

[0195] It should be noted that the encryption algorithm and decryption algorithm in the permission management configuration can be globally configured, that is, all browsing users can share the same encryption algorithm and decryption algorithm.

[0196] Step S802: The browsing user logs in to the network terminal to view the controlled file and obtains the authority to monitor pending operation events for the controlled file.

[0197] Step S803: monitoring pending operation events for the controlled file.

[0198] Step S804: Determine whether to intercept the pending operation event; if the pending operation event is not intercepted, execute step S805; if the pending operation event is intercepted, execute steps S806-S807.

[0199] In the specific implementation of step S804, when determining whether to intercept the pending operation event, the three parts of "determining whether the pending data is controlled data", "determining whether the pending operation event is a controlled event", and "determining whether the framework identifier matches" are mainly used for joint determination;

[0200] For the judgment principles of the three parts of "determining whether the data to be processed is controlled data", "determining whether the operation event to be processed is a controlled event", and "determining whether the framework identifier matches", please refer to the relevant instructions of the above "Process 1 to Process 7", which will not be repeated here.

[0201] If it is determined that the pending operation event is not to be intercepted, step S805 is executed; if it is determined that the pending operation event is to be intercepted, steps S806-S807 are executed.

[0202] Step S805: Release the pending operation event, perform normal data interaction, and execute step S807.

[0203] Step S806: Encrypt or decrypt the data to be processed.

[0204] Step S807: Determine whether the browsing user has completed all operations; if not, return to step S803 to continue monitoring pending operation events; if all operations are completed, end.

[0205] The above embodiments of the present invention Figure 8 This is a description of the overall implementation process of this solution; in actual application, this solution has the following beneficial effects:

[0206] (1) Good user experience: For developers, they can quickly introduce the general technical framework according to business needs and expose parameters on demand; for administrators, they can configure the permission management configuration on demand to achieve permission control of different granularities; for browsing users, under the permission control of the permission management configuration, browsing users are allowed to operate controlled files on the network end with restrictions on the local client, and the browsing users' operations on controlled files are not completely blocked, thereby improving the browsing users' user experience and data processing efficiency.

[0207] (2) More effective and controllable data security management: This solves the problem of text leakage in the data rendering display layer, and achieves "data is visible but not accessible". For administrators, permission management can be configured for browsing users as needed to implement role-based security management. Encryption and decryption algorithms are used to avoid storing data in controlled files offline, and the keys used for encryption and decryption algorithms are stored separately, further improving the security of data in controlled files.

[0208] (3) Low cost and easy maintenance: The data security solution can be implemented by introducing the general technical framework of this solution into the front-end page according to business needs, and the introduction cost is low. The web end with B / S architecture can provide a simple and easy-to-understand operation method. Developers can expose parameters according to business needs, and administrators can configure permission management configuration as needed, which is easy to maintain.

[0209] (4) High versatility and strong scalability: The general technical framework supports the exposure and configuration of framework identification, operation events, and data processing methods, and can flexibly form permission management configuration according to business needs; at the same time, data processing methods are not limited to encryption and decryption, and other data processing methods can be expanded, supporting the completion of data processing methods by the backend in the form of interfaces.

[0210] Corresponding to the one-way data isolation method provided by the above embodiment of the present invention, see Fig. 9 , the embodiment of the present invention also provides a structural block diagram of a one-way data isolation device, the one-way data isolation device includes: a display unit 100, a monitoring unit 200, an identification unit 300 and a control unit 400;

[0211] The display unit 100 is used to respond to the browsing request of the browsing user and display the controlled file in the browsing page of the network end.

[0212] The monitoring unit 200 is used to monitor pending operation events for the controlled file.

[0213] The identification unit 300 is used to identify the operation area corresponding to the operation event to be processed in the controlled file.

[0214] The control unit 400 is used to perform authority control on the data to be processed of the operation event to be processed according to the authority management configuration pre-configured for the browsing user if it is determined that the operation area overlaps with any controlled area.

[0215] In the embodiment of the present invention, when the controlled file is displayed on the network side, pending operation events for the controlled file are monitored and the operation area is identified. When the operation area overlaps with any controlled area, the pending data for the pending operation event operation is controlled according to the permission management configuration, and all operations on the controlled file will not be completely blocked, thereby improving data security and ensuring the user experience.

[0216] Preferably, combined Fig. 9 The control unit 400 includes an acquisition module and a determination module, and the execution principle of each module is as follows:

[0217] The acquisition module is used to obtain the permission management configuration pre-configured for the browsing user, and the permission management configuration at least includes: the area range of the controlled area, the first framework identifier corresponding to the controlled area, the controlled event corresponding to the controlled area, and the data processing method corresponding to the controlled area and the controlled event.

[0218] The determination module is used to determine that the operation area overlaps with any controlled area if there is an overlapping part between the area range of the operation area and the area range of any controlled area in the authority management configuration.

[0219] Preferably, combined Fig. 9 The control unit 400 includes a judgment module, a first processing module and a second processing module; the execution principle of each module is as follows:

[0220] The judgment module is used to judge whether the operation event to be processed is any controlled event corresponding to the target controlled area if it is determined that the operation area overlaps with any controlled area. The target controlled area is: a controlled area overlapping with the operation area.

[0221] The first processing module is used to determine the data processing method corresponding to the target controlled area and the operation event to be processed from the authority management configuration if the operation event to be processed is any controlled event corresponding to the target controlled area.

[0222] The second processing module is used to perform authority control on the to-be-processed data related to the target controlled area operated by the to-be-processed operation event according to the data processing mode corresponding to the target controlled area and the to-be-processed operation event.

[0223] In some embodiments, the operation event to be processed is a replication event, and the data processing method corresponding to the target controlled area and the replication event is encryption processing;

[0224] The second processing module in the control unit 400 is specifically used to: intercept a copy event; encrypt the data to be processed related to the target controlled area copied by the copy event to obtain a first encrypted string; embed the first framework identifier corresponding to the target controlled area into the first encrypted string; and write the first encrypted string embedded with the first framework identifier into the clipboard.

[0225] In some other embodiments, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is a decryption process;

[0226] The second processing module in the control unit 400 is specifically used to: extract a second framework identifier from the data to be processed related to the target controlled area pasted by the paste event; if the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, decrypt the data to be processed related to the target controlled area pasted by the paste event to obtain a plaintext string; write the plaintext string into the target controlled area; if the extracted second framework identifier is different from the first framework identifier corresponding to the target controlled area, or if the second framework identifier cannot be extracted, write the data to be processed related to the target controlled area pasted by the paste event into the target controlled area.

[0227] In some other embodiments, the operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is encryption processing;

[0228] The second processing module in the control unit 400 is specifically used to: extract a second framework identifier from the data to be processed related to the target controlled area pasted by the paste event; if the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, encrypt the data to be processed related to the target controlled area pasted by the paste event to obtain a second encrypted string; and write the second encrypted string into the target controlled area;

[0229] If the extracted second frame identifier is different from the first frame identifier corresponding to the target controlled area, or if the second frame identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

[0230] Preferably, an embodiment of the present invention further provides an electronic device, which includes a processor and a memory, wherein the memory is used to store program code and data of a one-way data isolation method, and the processor is used to call program instructions in the memory to execute a one-way data isolation method disclosed in the above method embodiment.

[0231] Preferably, an embodiment of the present invention further provides a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute a one-way data isolation method disclosed in the above method embodiment.

[0232] In summary, the embodiments of the present invention provide a one-way data isolation method, device, electronic device and storage medium, which monitor pending operation events for controlled files when the controlled files are displayed on the network side, and identify the operation area. When the operation area overlaps with any controlled area, the pending data operated by the pending operation event is subjected to permission control according to the permission management configuration, thereby achieving one-way isolation between the data on the network side and the client side, and improving data security.

[0233] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0234] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0235] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A one-way data isolation method, characterized in that: The method comprises: Responding to the browsing request of the browsing user, displaying the controlled file in the browsing page of the network end; Monitoring pending operation events for the controlled file; Identify the operation area in the controlled file corresponding to the operation event to be processed; If it is determined that the operation area overlaps with any controlled area, authority control is performed on the to-be-processed data of the to-be-processed operation event operation according to the authority management configuration pre-configured for the browsing user.

2. The method according to claim 1, characterized in that The process of determining that the operating area overlaps with any controlled area comprises: Acquire a permission management configuration pre-configured for the browsing user, wherein the permission management configuration at least includes: an area range of a controlled area, a first framework identifier corresponding to the controlled area, a controlled event corresponding to the controlled area, and a data processing method corresponding to the controlled area and the controlled event; If there is an overlapping portion between the area range of the operating area and the area range of any of the controlled areas in the authority management configuration, it is determined that the operating area overlaps with any of the controlled areas.

3. The method according to claim 2, characterized in that If it is determined that the operation area overlaps with any controlled area, according to the permission management configuration pre-configured for the browsing user, the permission control is performed on the pending data of the pending operation event operation, including: If it is determined that the operation area overlaps with any controlled area, determining whether the operation event to be processed is any controlled event corresponding to a target controlled area, the target controlled area being: the controlled area overlapping with the operation area; If the operation event to be processed is any of the controlled events corresponding to the target controlled area, determining the data processing mode corresponding to the target controlled area and the operation event to be processed from the authority management configuration; According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed.

4. The method according to claim 3, characterized in that The operation event to be processed is a copy event, and the data processing method corresponding to the target controlled area and the copy event is encryption processing; According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including: intercepting the replication event; Encrypting the to-be-processed data related to the target controlled area copied by the copy event to obtain a first encrypted character string; embedding the first framework identifier corresponding to the target controlled area into the first encrypted string; The first encrypted string embedded with the first framework identifier is written into a clipboard.

5. The method according to claim 3, characterized in that: The operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is a decryption process; According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including: Extracting a second framework identifier from the to-be-processed data related to the target controlled area pasted by the pasting event; If the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, decrypting the to-be-processed data related to the target controlled area pasted by the paste event to obtain a plaintext character string; Writing the plaintext character string into the target controlled area; If the extracted second framework identifier is different from the first framework identifier corresponding to the target controlled area, or if the second framework identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

6. The method according to claim 3, characterized in that The operation event to be processed is a paste event, and the data processing method corresponding to the target controlled area and the paste event is encryption processing; According to the data processing mode corresponding to the target controlled area and the operation event to be processed, authority control is performed on the data to be processed related to the target controlled area operated by the operation event to be processed, including: Extracting a second framework identifier from the to-be-processed data related to the target controlled area pasted by the pasting event; If the extracted second framework identifier is the same as the first framework identifier corresponding to the target controlled area, encrypting the to-be-processed data related to the target controlled area pasted by the paste event to obtain a second encrypted string; Writing the second encrypted string into the target controlled area; If the extracted second framework identifier is different from the first framework identifier corresponding to the target controlled area, or if the second framework identifier cannot be extracted, the unprocessed data related to the target controlled area pasted by the paste event is written into the target controlled area.

7. A one-way data isolation device, characterized in that: The device comprises: A display unit, used to respond to a browsing request of a browsing user and display the controlled file on a browsing page of a network terminal; A monitoring unit, used for monitoring pending operation events for the controlled file; An identification unit, used for identifying an operation area in the controlled file corresponding to the operation event to be processed; The control unit is used to perform authority control on the to-be-processed data of the to-be-processed operation event operation according to the authority management configuration pre-configured for the browsing user if it is determined that the operation area overlaps with any controlled area.

8. The device according to claim 7, characterized in that The control unit comprises: An acquisition module, used to acquire a permission management configuration pre-configured for the browsing user, wherein the permission management configuration at least includes: an area range of a controlled area, a first framework identifier corresponding to the controlled area, a controlled event corresponding to the controlled area, and a data processing method corresponding to the controlled area and the controlled event; The determination module is configured to determine that the operation area overlaps with any of the controlled areas if there is an overlapping portion between the area range of the operation area and the area range of any of the controlled areas in the authority management configuration.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory is used to store program code and data of the data unidirectional isolation method, and the processor is used to call the program instructions in the memory to execute a data unidirectional isolation method as described in any one of claims 1-6.

10. A storage medium, characterized in that: The storage medium includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute a one-way data isolation method as described in any one of claims 1-6.

Images