Electric power information anti-divulging system

Abstract

The invention discloses an electric power information anti-divulging system, and belongs to the technical field of information encryption. The invention aims to solve the problems that the existing electric power information is easily tampered when being written, and serious potential safety hazards exist. According to the invention, a client is authenticated by a server and joins in a local security network; the text identification module is used for identifying local text files of the client and identifying file names of the current and newly established local text files; sending the identified file name to a log auditing module; the local file I / O monitoring sub-module, the network I / O monitoring sub-module and the pasteboard monitoring sub-module are respectively used for monitoring the modification of the local file through the network I / O and the local I / O, and monitoring whether the pasteboard pastes or copies the text file in real time; and the dynamic encryption module is used for encrypting the local text file recognized by the text recognition module in real time. The method is used for safe use of the document information.

Description

Technical Field

[0001] The invention belongs to the technical field of information encryption. Background Art

[0002] Information security mainly refers to the security of information storage and information transmission. When information is transmitted, it is usually encrypted by various modulation and demodulation methods. When information is stored, it is usually encrypted after the file is completed. However, there is no guarantee that the information will not be tampered with when it is entered. In particular, when converting files for some power grid data, there is no guarantee that the stored tables have not been directly tampered with when they are written. Therefore, it is easy to cause serious errors in the safety assessment of the power system and lead to safety hazards. Summary of the invention

[0003] The present invention aims to solve the problem that the existing power information is easily tampered with when being written, which poses a serious safety hazard. A power information leakage prevention system is provided.

[0004] The power information leakage prevention system described in the present invention includes a server and a client, wherein the client includes an intelligent monitoring module, a dynamic encryption module and a log audit module;

[0005] The client passes the server authentication and joins the local security network;

[0006] The intelligent monitoring module includes a text recognition module, a local file I / O monitoring submodule, a network I / O monitoring submodule and a pasteboard monitoring submodule;

[0007] The text recognition module is used to recognize the local text files of the client, and recognize the file names of the current and newly created local text files; and send the recognized file names to the log audit module;

[0008] The local file I / O monitoring submodule is used to monitor the changes to local files through I / O in real time and send the changes to the log audit module;

[0009] The network I / O monitoring submodule is used to monitor the modification of local files through network I / O in real time and send the modification to the log audit module;

[0010] The pasteboard monitoring submodule is used to monitor in real time whether the pasteboard pastes or copies text files, and send the pasted or copied content to the log audit module;

[0011] The log audit module extracts the user name from the certificate used by the user, and logs the user name and the received modification information for corresponding recording;

[0012] The dynamic encryption module is used to encrypt the local text files recognized by the text recognition module in real time.

[0013] Furthermore, the present invention also includes a drag monitoring module, which is used to monitor whether a local text file is dragged and send the drag information to the log audit module.

[0014] The system of the present invention realizes real-time monitoring of client files and records them in a log in real time, so that the files can be prevented from being modified directly after being entered. Therefore, the present invention monitors the files in real time during the file entry process, effectively ensuring the security of the files. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a block diagram of the system principles of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0017] Specific implementation method 1: refer to Figure 1 Specifically describing this embodiment, a power information leakage prevention system described in this embodiment includes a server 1 and a client 2, wherein the client 2 includes an intelligent monitoring module 201, a dynamic encryption module 202 and a log audit module 203;

[0018] Client 2 passes the authentication of server 1 and joins the local security network;

[0019] The intelligent monitoring module 201 includes a text recognition module 2011, a local file I / O monitoring submodule 2012, a network I / O monitoring submodule 2013 and a pasteboard monitoring submodule 2014;

[0020] The text recognition module 2011 is used to recognize the local text files of the client 2, and recognize the file names of the current and newly created local text files;

[0021] And send the identified file name to the log audit module 203;

[0022] The local file I / O monitoring submodule 2012 is used to monitor the modification of local files through I / O in real time and send the modification to the log audit module 203;

[0023] The network I / O monitoring submodule 2013 is used to monitor the modification of local files through network I / O in real time and send the modification to the log audit module 203;

[0024] The pasteboard monitoring submodule is used to monitor in real time whether the pasteboard pastes or copies the text file, and sends the pasted or copied content to the log audit module 203;

[0025] The log audit module 203 extracts the user name from the certificate used by the user, and logs the user name and the received modification information for corresponding recording;

[0026] The dynamic encryption module 202 is used to encrypt the local text file recognized by the text recognition module 2011 in real time.

[0027] Furthermore, the present invention further includes a drag monitoring module, which is used to monitor whether a local text file is dragged and send the drag information to the log audit module 203.

[0028] The dynamic encryption and decryption module dynamically encrypts all the text files written out, and sets the encryption flag. When reading the encrypted file, the encrypted data is decrypted and finally presented to the user in plain text. The operating system kernel of the client 2 also includes a log audit module 203. Any read and write operations of the user when using the monitored application are automatically and compulsorily recorded in the log. The primary key of each log is the user name extracted from the certificate used by the user; the log audit module 203 adopts the 3WIH log format. The server 1 provides identity authentication function and information configuration function. Before the client 2 starts the information leakage prevention system, it first needs to authenticate the identity of the server 1 through the certificate distributed by the administrator. If the authentication is successful, the system is allowed to start, and the relevant configuration information is downloaded from the server 1 to the local. Otherwise, the authentication fails and the information leakage prevention system is not started; the server 1 also provides a security audit function. The client 2 sends all the local file operations and network I / O information of the user to the server 1. These audit information are stored in the server 1 end database, which is convenient for subsequent responsibility tracking: the server 1 is also used to save the log generated by the log audit module 203. The local file I / O monitoring submodule 2012 monitors the local file I / O by hooking the relevant process in the file filter driver. The local file I / O monitoring submodule 2012 intercepts the Windows file filter driver and filters all file operations of the user in the interception process.

[0029] The network I / O monitoring submodule monitors the network I / O by monitoring the network communication data from the kernel level through the TDI filter driver. The monitoring program calls the dynamic encryption and decryption driver module to encrypt the data sent by the process in the environment and decrypt the data received by the process in the environment. For the process outside the environment, if the process outside the environment sends data to the server 1 in the specified IP list, the data packet will be discarded: the network data sent by the process in the environment to the protected server 1 is first encrypted in the TDI filter driver, and then the data is dropped to the SSL VPN virtual network card through routing. The VPN decrypts the encrypted data, encapsulates the data and sends it out through the VPN encrypted tunnel. The dynamic encryption and decryption module uses the AES256-bit high-intensity encryption algorithm, and the encryption key changes, providing the same strategy and key for the work group using the information leakage prevention system.

[0030] Although the present invention is described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the present invention. It should therefore be understood that many modifications may be made to the exemplary embodiments and that other arrangements may be devised without departing from the spirit and scope of the present invention as defined by the appended claims. It should be understood that the various dependent claims and features described herein may be combined in a manner different from that described in the original claims. It should also be understood that the features described in conjunction with a single embodiment may be used in other described embodiments.

Claims

1. A power information leakage prevention system, characterized in that: It comprises a server (1) and a client (2), wherein the client (2) comprises an intelligent monitoring module (201), a dynamic encryption module (202) and a log audit module (203); The client (2) is authenticated by the server (1) and joins the local security network; The intelligent monitoring module (201) comprises a text recognition module (2011), a local file I / O monitoring submodule (2012), a network I / O monitoring submodule (2013) and a pasteboard monitoring submodule (2014); The text recognition module (2011) is used to recognize the local text files of the client (2), and recognize the file names of the current and newly created local text files; and send the recognized file names to the log audit module (203); The local file I / O monitoring submodule (2012) is used to monitor the modification of local files through I / O in real time and send the modification to the log audit module (203); The network I / O monitoring submodule (2013) is used to monitor in real time the modification of local files through the network I / O, and send the modification to the log audit module (203); The pasteboard monitoring submodule is used to monitor in real time whether the pasteboard pastes or copies the text file, and sends the pasted or copied content to the log audit module (203); The log audit module (203) extracts the user name from the certificate used by the user, and logs the user name and the received modification information for corresponding recording; The dynamic encryption module (202) is used to encrypt the local text file recognized by the text recognition module (2011) in real time.

2. The power information leakage prevention system according to claim 1, characterized in that: It also includes a drag monitoring module, which is used to monitor whether a local text file is dragged and send the drag information to the log audit module (203).

Images