Printing and recording system

Abstract

The invention provides a printing and recording system, which comprises user equipment, a server, output equipment, printing equipment and recording equipment, and is characterized in that the user equipment is used for logging in a printing and recording software system according to identity information, creating a business document on the printing and recording software system based on a business type, and initiating an approval process after the business document passes security level verification; a carving software system is deployed on the server, and the carving software system is used for performing security level verification on business documents, promoting an approval process and verifying identity information; a white list program and an authorized engraving client are deployed on the output equipment; the printing equipment is used for receiving and executing a printing instruction; the recording device is used for receiving and executing the recording instruction. The invention provides a printing and recording system, which is used for solving the problems that printing and recording behaviors are not effectively monitored in the prior art, and relatively large security holes and secret leakage hidden dangers exist.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security, and in particular to a printing and burning system. Background Art

[0002] With the implementation and launch of various information systems within confidential enterprises, office printing and burning activities in various departments of the enterprise are becoming increasingly frequent. Although the printing room is equipped with various printing and burning equipment, everyone can print or burn at any time. There is no effective monitoring of such activities, resulting in major security loopholes and risks of leaks. Summary of the invention

[0003] The present invention provides a printing and burning system to solve the problems in the prior art that there is no effective monitoring of printing and burning behaviors and there are large security loopholes and potential risks of leakage.

[0004] In a first aspect, the present invention provides a printing and burning system, characterized in that it includes a user device, a server, an output device, a printing device and a burning device, wherein:

[0005] The user device is used to log in to the engraving software system according to the identity information, create a business document based on the business type on the engraving software system, and initiate an approval process after the business document passes the confidentiality level verification, the business type includes printing and burning, the creation of the business document includes selecting the document confidentiality level, setting the business operation, uploading the business file and selecting the file confidentiality level, the confidentiality level verification includes performing a first verification on the file confidentiality level when the business file is received and performing a second verification on the document confidentiality level after all the file confidentialities pass the first verification;

[0006] The server is deployed with the marking software system, which is used to perform the confidentiality check on the business document, promote the approval process and verify the identity information, where the identity information includes the identity information sent by the user device and the identity information sent by the marking client;

[0007] The output device is deployed with a whitelist program and an authorized engraving client, wherein:

[0008] The whitelist program is used to verify whether the engraving client is in the whitelist. If so, the service instruction sent by the engraving client is released. If not, the service instruction sent by the engraving client is discarded. The service instruction includes a printing instruction and a burning instruction.

[0009] The marking client is used to receive the identity information, send the identity information to the marking software system for verification, obtain all business documents that have passed the approval process of the user to whom the identity information belongs after the verification is passed, and send a business instruction after the user selects a required business document from all the business documents that have passed the approval process;

[0010] The printing device is used to receive and execute the printing instruction;

[0011] The burning device is used for receiving and executing the burning instruction.

[0012] In the above scheme, by verifying the confidentiality level of business documents, the probability of errors in human selection and approval is effectively reduced, and the occurrence of leakage incidents is prevented; by verifying the identity information sent by the engraving client, security measures can be improved to ensure that business documents are only obtained by the user himself, effectively avoiding the leakage of sensitive information; by setting up a whitelist program on the output device for interception, the leakage of confidential files caused by users using output devices connected to printing devices or burning devices to send business instructions can be effectively avoided.

[0013] Optionally, performing a first check on the confidentiality level of the file upon receiving the business file includes:

[0014] When receiving the business document, determining whether the business document contains a keyword in a keyword list, wherein the keyword list is preset and each keyword is mapped to a corresponding confidentiality level;

[0015] If not, the file classification level passes the first verification;

[0016] If included, taking the highest level among the levels mapped by the keywords contained in the business file as the identification level, and judging whether the identification level is higher than the file level;

[0017] If it is higher, the file classification level fails the first verification;

[0018] If it is not higher, the file confidentiality level passes the first verification.

[0019] Optionally, the determining whether the business file contains a keyword in a keyword list includes:

[0020] Traversing each page of the business document, and extracting the first text character and the picture from each page;

[0021] For the first text character, determining whether the first text character contains a keyword in the keyword list;

[0022] For the picture, optical recognition technology is used to extract second text characters from the picture and special character filtering is performed to determine whether the second text characters filtered by the special characters contain keywords in the keyword list.

[0023] Optionally, the performing a second verification on the document confidentiality level after all the document confidentiality levels have passed the first verification includes:

[0024] After all the file levels pass the first verification, determining whether the highest file level among all the file levels is higher than the document level;

[0025] If it is higher, the document confidentiality level fails the second verification;

[0026] If it is not higher, the document confidentiality level passes the second verification.

[0027] Optionally, the verifying the identity information includes:

[0028] Determine whether the identity information is the identity information set by the engraving software system;

[0029] If yes, the verification is passed;

[0030] If not, the verification fails.

[0031] Optionally, the verifying whether the engraving client is in the whitelist includes:

[0032] Verify whether the process name of the engraving client is in the whitelist by text comparison.

[0033] Optionally, also include:

[0034] The user device is deployed with a virtual printer, the virtual printer is preset with the identity information, and the virtual printer is used to:

[0035] When the user device is directly connected to the printing device, the printing instruction sent by the third-party software is received, the business document is created in the engraving software system based on the identity information and the printing instruction, and the approval process is initiated after the business document passes the confidentiality check.

[0036] In the above solution, the virtual printer will automatically upload the print files to the engraving software system and initiate the approval process. Users no longer need to log in to the engraving software system to upload print files and initiate the approval process, thus avoiding the lack of management of printing behavior.

[0037] Optionally, also include:

[0038] In the case where the business type is printing, the engraving client generates a two-dimensional barcode corresponding to the page number for each page of the business document, and displays the two-dimensional barcode on the page corresponding to the page number.

[0039] In the above scheme, by generating a two-dimensional barcode corresponding to the page number for each page of the printed document, when performing clearance and destruction operations, the two-dimensional barcode can be scanned page by page according to the page number of the printed document for verification, thereby preventing the printed document from being partially extracted.

[0040] Optionally, also include:

[0041] When the confidentiality level of the document passes the first verification, the business document is converted into a unified format.

[0042] In the above solution, by converting business documents into a unified format, the need to be compatible and adaptable to all document formats on the market when attaching a two-dimensional barcode is effectively avoided.

[0043] Optionally, also include:

[0044] The same verification code is set on the print driver of the output device and the printing device.

[0045] In the above scheme, by setting the same verification code on the print driver of the output device and the printer for interception, the leakage of confidential files caused by the user using the user device connected to the printing device to send a print instruction can be effectively avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A schematic diagram of the structure of a printing and burning system provided by an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of a hook code provided by an embodiment of the present invention;

[0049] Figure 3 A schematic diagram of a file filtering driver code provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Figure 1 A schematic structural diagram of a printing and burning system provided by an embodiment of the present invention is shown in detail, including a user device, a server, an output device, a printing device and a burning device.

[0052] The user device is used to log in to the engraving software system according to the identity information, create a business document based on the business type on the engraving software system, and initiate the approval process after the business document passes the confidentiality verification.

[0053] In one example, the user device and the server adopt a B / S architecture. The user logs into the engraving software system on the server through a browser on the user device (such as a personal computer), and the login method can be a personal account or a USB Key.

[0054] Specifically, the business types include printing and burning.

[0055] Business types can also include copying, external document registration, importing, internal transmission, external transmission, confidential external transmission, code book, archiving, filing, clearance, destruction, auditing and barcode generation, etc.

[0056] Auditing refers to recording and counting all business documents and carrier files generated in the printing software system, and can view all business documents and carrier files through conditional screening, and can clearly view the closed-loop management of each business document and each carrier file, and conduct refined management of each user's printing volume. Carrier files include paper print files output by printing devices and CD-ROM burning files output by burning devices. Auditing records are conducted at each link in the file life cycle to ensure the safe circulation of files, full-process monitoring and traceability.

[0057] Barcode generation refers to the two-dimensional barcode column, which can fill in the form content and generate a two-dimensional barcode for use in copying and other businesses. These businesses require the two-dimensional barcode to be pasted on the cover of the new carrier and scanned for confirmation to complete the business loop.

[0058] Specifically, creating a business document includes selecting a document classification, setting business operations, uploading business files, and selecting a file classification.

[0059] It should be noted that, except for printing and burning, not all business types require uploading business files. Business documents can also display information such as the size of business files and the upload progress. For printing business, business operations include the number of copies and printing mode settings (such as single-sided / double-sided / color printing, etc.).

[0060] When users upload confidential documents to the engraving software system, they mistakenly select the document confidentiality level as non-confidential. At the same time, due to the negligence of the approval personnel, the error was not discovered in time, resulting in the situation of high-level file transmission and low-level transmission, which led to the leakage of high-level file information. By checking the confidentiality level of business documents, the probability of human selection and approval errors is effectively reduced, and the occurrence of leakage incidents is prevented.

[0061] Specifically, the confidentiality level verification includes performing a first verification on the confidentiality level of a file when a business file is received and performing a second verification on the confidentiality level of a document after all the confidentiality levels of the files have passed the first verification.

[0062] It should be noted that the security level verification is completed by the engraving software system.

[0063] In one example, performing a first check on the confidentiality level of a business file upon receiving the business file includes:

[0064] When receiving a business document, determining whether the business document contains a keyword in a keyword list, the keyword list is pre-set and each keyword is mapped to a corresponding confidentiality level;

[0065] If not, the file classification passes the first verification;

[0066] If included, the highest level among the levels mapped by the keywords contained in the business file is used as the identification level to determine whether the identification level is higher than the file level;

[0067] If it is higher, the file classification level fails the first verification;

[0068] If it is not higher, the file classification level passes the first verification.

[0069] Further, determining whether the business document contains a keyword in the keyword list includes:

[0070] Traverse each page of the business document and extract the first text character and image on each page;

[0071] For the first text character, determining whether the first text character contains a keyword in the keyword list;

[0072] For the image, optical character recognition (OCR) is used to extract the second text characters from the image and perform special character filtering to determine whether the second text characters after special character filtering contain keywords in the keyword list.

[0073] In one example, performing a second check on the document classification after all the document classifications have passed the first check includes:

[0074] After all the file classifications have passed the first verification, it is determined whether the highest file classification among all the file classifications is higher than the document classification;

[0075] If it is higher, the document confidentiality level fails the second verification;

[0076] If it is not higher, the document confidentiality level passes the second verification.

[0077] It should be noted that the types of business that are applicable to confidentiality verification include printing, burning and importing. For the types of business that are applicable to confidentiality verification, the approval process can only be initiated after the confidentiality verification is passed.

[0078] A stamping software system is deployed on the server, which is used to check the confidentiality level of business documents, promote the approval process and verify identity information.

[0079] The approval process can include one-level, two-level or three-level approval. In one example, the engraving system promotes the approval process by pushing approval messages to the approvers. The approval messages include the serial number, title, initiator, business document status, business type, description and initiation date. Business document status includes temporarily stored, under approval, waiting to be printed, printed, waiting to be burned and burned.

[0080] After passing the approval process, the business document status will be updated to Approved.

[0081] In one example, verifying the identity information includes:

[0082] Determine whether the identity information is the identity information set by the engraving software system;

[0083] If yes, the verification is successful;

[0084] If not, the verification fails.

[0085] Specifically, the identity information includes the identity information sent by the user equipment and the identity information sent by the engraving client.

[0086] Normally, after passing the approval process, business instructions can be sent through the authorized engraving client, but business files may be obtained by all personnel operating the engraving client, resulting in the leakage of sensitive information. By verifying the identity information sent by the engraving client, security measures can be improved to ensure that business files are only obtained by the user himself, effectively avoiding the leakage of sensitive information.

[0087] In one example, the identity information sent by the engraving client is obtained by swiping a card, scanning a face, swiping a fingerprint, or entering an account number and password. The card swiping is achieved through a card reader installed on the output device.

[0088] The services that need to be implemented through the engraving client include printing, burning, copying, external transmission, code book, archiving, filing, clearance and destruction.

[0089] The output device is deployed with a whitelist program and an authorized engraving client, including:

[0090] The whitelist program is used to verify whether the client is in the whitelist. If so, the service instructions sent by the client are allowed to pass. If not, the service instructions sent by the client are discarded.

[0091] The engraving client is used to receive identity information, send the identity information to the engraving software system for verification, obtain all business documents that have passed the approval process of the user to whom the identity information belongs after the verification, and send business instructions after the user selects the required business documents from all business documents that have passed the approval process.

[0092] The output device can be a computer in the printing room output machine, and the printing client is deployed on the computer in the printing room output machine.

[0093] For special sensitive files, some users deliberately bypass the engraving software system and the engraving client in order to avoid leaving traces. Instead of going through the approval process, they directly use the output device connected to the printing device or burning device to send business instructions, resulting in the leakage of confidential files. The above situation can be effectively avoided by setting up a whitelist program on the output device for interception.

[0094] In one example, verifying whether the engraving client is in the whitelist includes verifying whether the process name of the engraving client is in the whitelist by text comparison.

[0095] In one example, the whitelist is a document file configured outside the whitelist program, and the whitelist is configured through the whitelist program.

[0096] For printing services, the whitelisting program is set up based on Microsoft's open source Detours library, which is a library for intercepting Windows API calls and can be used for various purposes, such as monitoring and modifying system calls, creating hooks, etc. The steps to use the Detours library to intercept binary functions on ARM, ARM64, X86, X64, and IA64 machines are as follows:

[0097] Open the source code and compile to generate the detours.lib library;

[0098] The detours.lib library is introduced for the printing business, so that the operations that originally used the system API can "detour" to the rewritten API, thus implementing the interception of the system API related to printing;

[0099] Determine whether the target process is in the whitelist. If so, do not inject the hook through the DLL injection technology. If not, inject the hook through the DLL injection technology to intercept the printing task.

[0100] The hook code is as follows Figure 2 As shown, it is actually a "detour" code segment working in the whitelist program. The code lists the system API functions for printing operations to ensure that the non-whitelisted process will go through the "detour" code segment when printing, thereby achieving the purpose of intercepting printing.

[0101] In Windows systems, the file system is one of the most common and powerful places to insert filter drivers. File system filter drivers can intercept I / O operations (from applications and the system itself) before they reach the file system, which allows file filter drivers to monitor, track, manage, operate, and even allow or deny I / O operations before the file system captures the system I / O operations in the burning operation. Therefore, for the burning business, the core logic of the whitelist interception is: the data has been intercepted by the filter before it is written to the disc, and the file write protection exception is returned, so that after the user performs the burning operation, a pop-up box for disk write protection will pop up, thereby intercepting the burning operation of non-whitelist processes.

[0102] Figure 3 This is a file filter driver code. FsFilterlPreOperation is a callback function that is entered after the system I / O operation. The code first filters the programs requesting I / O through the whitelist configured in the registry, and then declares four filters related to the burning operation to filter the I / O operations of the processes not in the whitelist, so as to only process the burning operation without affecting the stability of the system.

[0103] Specifically, the service instructions include printing instructions and burning instructions.

[0104] It should be noted that even if an unauthorized engraving client is deployed on an output device, it cannot communicate with the engraving software system. By authorizing the engraving client, the situation of too many engraving clients and out of control is avoided, which is conducive to the management of the engraving client. The engraving client can be authorized using a license.

[0105] In one example, the communication between the engraving client and the engraving software system is implemented based on WebService.

[0106] The printing device is used to receive and execute printing instructions.

[0107] The burning device is used for receiving and executing the burning instruction.

[0108] For some third-party software (such as winchll, CAD, etc.) that directly send printing instructions without applying for approval from the engraving software system, since the engraving software system cannot obtain the print files, this type of printing cannot be recorded and left in the engraving software system, resulting in a lack of control over the printing behavior.

[0109] In one example, a printing and burning system provided by an embodiment of the present invention further includes:

[0110] The user device is deployed with a virtual printer, which has preset identity information. The virtual printer is used for:

[0111] When the user device is directly connected to the printing device, it receives the printing instructions sent by the third-party software, creates a business document in the engraving software system based on the identity information and printing instructions, and initiates the approval process after the business document passes the confidentiality verification.

[0112] The virtual printer will automatically upload print files to the engraving software system and initiate the approval process. Users no longer need to log in to the engraving software system to upload print files and initiate the approval process, avoiding the lack of management of printing behavior.

[0113] Currently, only the first page of the output printed file has a unique two-dimensional barcode for identification, and the inner pages lack the unique two-dimensional barcode. As a result, when the printed files are cleared and destroyed, it is easy for key sensitive information pages to be extracted, resulting in leakage incidents.

[0114] In one example, a printing and burning system provided by an embodiment of the present invention further includes:

[0115] In the case where the business type is printing, the engraving client generates a two-dimensional barcode corresponding to the page number for each page of the business document, and displays the two-dimensional barcode on the page with the corresponding page number.

[0116] By generating a two-dimensional barcode corresponding to the page number for each page of the printed document, it is possible to force the two-dimensional barcode to be scanned page by page for verification according to the page number of the printed document during clearance and destruction operations, thereby preventing the printed document from being partially extracted.

[0117] Usually, users submit files in various formats such as DOC, DOCX, PPT, EXCEL, .cd, .ps, .rp, etc., which means that attaching a 2D barcode requires compatibility and adaptation to all document formats on the market, which is almost impossible. Therefore, it is necessary to convert files in various formats and output files in a unified format.

[0118] In one example, a printing and burning system provided by an embodiment of the present invention further includes:

[0119] When the file classification passes the first verification, the business file is converted into a unified format.

[0120] In the above solution, each business file is formatted separately after passing the first verification, which effectively avoids the server load or even jamming that may occur when batch converting multiple business files in the same business document at the same time.

[0121] In one example, the unified format is a PDF format.

[0122] For special sensitive files, some users deliberately bypass the engraving software system and the engraving client in order to avoid leaving traces. Instead of going through the approval process, they directly use the user device connected to the printing device to send the print command, resulting in the leakage of confidential files. The above situation can be effectively avoided by setting the same verification code on the print driver of the output device and the printer for interception.

[0123] In one example, a printing and burning system provided by an embodiment of the present invention further includes:

[0124] Set the same verification code on the print driver of the output device and the printing device.

[0125] The verification code in the print driver will be added to the print command and sent to the printing device. The printing device verifies whether its own verification code is the same as the verification code of the print driver. If they are the same, the print command is executed to output the paper document. The verification process of the verification code is processed silently and is imperceptible to the user.

[0126] In one example, the verification code includes an account number and a password.

[0127] Taking Windows system as an example, the printer can set the verification code by entering System Management -> Input -> User Authentication -> Set Account and Password, and the print driver can set the verification code by right-clicking My Computer -> Properties -> Bluetooth and other devices -> Printers and Scanners -> Select the actual printer to be used -> Printer Preferences -> Basic Settings -> User Authentication -> Set Account and Password -> Verify.

[0128] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0129] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A printing and burning system, characterized in that: Includes user devices, servers, output devices, printing devices and burning devices, including: The user device is used to log in to the engraving software system according to the identity information, create a business document based on the business type on the engraving software system, and initiate an approval process after the business document passes the confidentiality level verification, the business type includes printing and burning, the creation of the business document includes selecting the document confidentiality level, setting the business operation, uploading the business file and selecting the file confidentiality level, the confidentiality level verification includes performing a first verification on the file confidentiality level when the business file is received and performing a second verification on the document confidentiality level after all the file confidentialities pass the first verification; The server is deployed with the marking software system, which is used to perform the confidentiality check on the business document, promote the approval process and verify the identity information, where the identity information includes the identity information sent by the user device and the identity information sent by the marking client; The output device is deployed with a whitelist program and an authorized engraving client, wherein: The whitelist program is used to verify whether the engraving client is in the whitelist. If so, the service instruction sent by the engraving client is released. If not, the service instruction sent by the engraving client is discarded. The service instruction includes a printing instruction and a burning instruction. The marking client is used to receive the identity information, send the identity information to the marking software system for verification, obtain all business documents that have passed the approval process of the user to whom the identity information belongs after the verification is passed, and send a business instruction after the user selects a required business document from all the business documents that have passed the approval process; The printing device is used to receive and execute the printing instruction; The burning device is used for receiving and executing the burning instruction.

2. The system according to claim 1, characterized in that: The first checking of the confidentiality level of the file upon receiving the business file comprises: When receiving the business document, determining whether the business document contains a keyword in a keyword list, wherein the keyword list is preset and each keyword is mapped to a corresponding confidentiality level; If not, the file classification level passes the first verification; If included, taking the highest level among the levels mapped by the keywords contained in the business file as the identification level, and judging whether the identification level is higher than the file level; If it is higher, the file classification level fails the first verification; If it is not higher, the file confidentiality level passes the first verification.

3. The system according to claim 2, characterized in that: The determining whether the business file contains a keyword in the keyword list includes: Traversing each page of the business document, and extracting the first text character and the picture from each page; For the first text character, determining whether the first text character contains a keyword in the keyword list; For the picture, optical recognition technology is used to extract second text characters from the picture and special character filtering is performed to determine whether the second text characters filtered by the special characters contain keywords in the keyword list.

4. The system according to claim 1, characterized in that: The second verification of the document confidentiality level after all the document confidentiality levels have passed the first verification comprises: After all the file levels pass the first verification, determining whether the highest file level among all the file levels is higher than the document level; If it is higher, the document confidentiality level fails the second verification; If it is not higher, the document confidentiality level passes the second verification.

5. The system according to claim 1, characterized in that: The verifying of the identity information comprises: Determine whether the identity information is the identity information set by the engraving software system; If yes, the verification is passed; If not, the verification fails.

6. The system according to claim 1, characterized in that: The verification of whether the engraving client is in the whitelist includes: Verify whether the process name of the engraving client is in the whitelist by text comparison.

7. The system according to claim 1, characterized in that: Also includes: The user device is deployed with a virtual printer, the virtual printer is preset with the identity information, and the virtual printer is used to: When the user device is directly connected to the printing device, the printing instruction sent by the third-party software is received, the business document is created in the engraving software system based on the identity information and the printing instruction, and the approval process is initiated after the business document passes the confidentiality check.

8. The system according to claim 1, characterized in that: Also includes: In the case where the business type is printing, the engraving client generates a two-dimensional barcode corresponding to the page number for each page of the business document, and displays the two-dimensional barcode on the page corresponding to the page number.

9. The system according to claim 8, characterized in that: Also includes: When the confidentiality level of the document passes the first verification, the business document is converted into a unified format.

10. The system according to claim 1, characterized in that: Also includes: The same verification code is set on the print driver of the output device and the printing device.

Images