Sandbox-based file operation processing method and device and electronic equipment

Abstract

According to the sandbox-based file operation processing method and device and the electronic equipment provided by the embodiment of the invention, in the sandbox-based file operation processing method, the electronic equipment creates a first sandbox copy of a first application in response to an access request for a DLP file, opens the DLP file through the first sandbox copy, and then, in response to a first operation, opens the first sandbox copy of the first application through the first sandbox copy; obtaining a second sandbox duplicate for processing the first operation, and processing the first operation through the second sandbox duplicate; wherein the first sandbox avatar is associated with the DLP file, and the control strategy of the first sandbox avatar and the second sandbox avatar is the same as the control strategy of the DLP file, so that the security of the DLP file can be ensured, and the DLP file, the first sandbox avatar and the second sandbox avatar can form a small system; the multiple sandbox copies work cooperatively, so that the running environment and configuration information of the DLP file can be reserved, scene reproduction after the managed and controlled user opens the DLP file next time is facilitated, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of smart terminal technology, and in particular to a sandbox-based operation processing method, device and electronic device. Background Art

[0002] In order to ensure data security, many enterprises deploy data leakage prevention (DLP) services in their internal networks.

[0003] Before the file is transmitted, it can be encrypted locally by selecting a user list for authorization. During the processing, the file encryption and decryption control can also be carried out in combination with components such as file management, system capability management services, permission management services and / or user-mode file system (fuse).

[0004] DLP management applications implement sandbox-level control by creating sandbox clones of applications. Encrypted permission documents can only be viewed in the sandbox clones of legitimate users, and the transmission of encrypted permission documents is restricted due to permission control in the sandbox environment. This security-based design protects document data to the greatest extent.

[0005] Since the management and control is based on the sandbox mechanism, sandbox applications cannot pull up other external applications to share data according to the usage scenario. Therefore, the collaborative processing of the same business by multiple applications will be restricted, especially for read-only permission documents. Summary of the invention

[0006] The present application provides a sandbox-based file operation processing method, device and electronic device. The present application also provides a computer-readable storage medium to realize the processing of operations on DLP files through associated sandbox clones. The management and control strategy of the associated sandbox clones is the same as the management and control strategy of the DLP files to ensure the security of the DLP files, and the associated sandbox clones can perform data communication and collaboratively process business, so as to restore the user's last usage scene and improve the user experience.

[0007] In a first aspect, the present application provides a sandbox-based file operation processing method, including: in response to an access request for a data leakage protection DLP file, creating a first sandbox clone of a first application, and opening the DLP file through the first sandbox clone; wherein the first sandbox clone is associated with the DLP file; in response to a first operation on the DLP file, obtaining a second sandbox clone for processing the first operation; wherein the second sandbox clone includes a sandbox clone of a second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file; and processing the first operation through the second sandbox clone.

[0008] In the above-mentioned sandbox-based operation processing method, the electronic device creates a first sandbox clone of the first application in response to an access request for the DLP file, opens the above-mentioned DLP file through the first sandbox clone, and then, in response to the first operation for the above-mentioned DLP file, obtains a second sandbox clone that processes the above-mentioned first operation, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone can be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the management and control policies of the first sandbox clone and the second sandbox clone are the same as the management and control policies of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones working together can retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time, thereby improving the user experience.

[0009] In one possible implementation, obtaining the second sandbox clone for processing the first operation includes: querying the sandbox clone associated with the first sandbox clone; in response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, creating the second sandbox clone, and associating the second sandbox clone with the first sandbox clone.

[0010] In one possible implementation, before obtaining the second sandbox clone that processes the first operation, it also includes: receiving a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file, the first operation processing request being used to request the second sandbox clone to process the first operation.

[0011] In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone, obtaining a second application that monitors the first operation; and notifying the second application of the first operation.

[0012] In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, it also includes: determining whether the second application is a trusted application; if the second application is a trusted application, executing the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone.

[0013] In a possible implementation, the determining whether the second application is a trusted application includes: determining whether the second application is in a data table; wherein the data table stores configured trusted applications.

[0014] In one possible implementation, the first sandbox clone and the second sandbox clone constitute a sandbox group; the method also includes: in response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, the second operation processing request is used to request a third application to process the second operation; creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; processing the second operation through the third sandbox clone.

[0015] In a possible implementation, after the second sandbox clone processes the first operation, the method further includes: detecting a write operation of the second sandbox clone on the DLP file; and in response to the write operation, the first sandbox clone reading the modified DLP file.

[0016] In one possible implementation, the first operation includes a selection operation of the first sandbox clone on the content of the DLP file, and the DLP file is a read-only file; and processing the first operation by the second sandbox clone includes: translating the selected content in the DLP file by the second sandbox clone.

[0017] In a second aspect, the present application provides a document operation processing device, which is included in an electronic device, and has the function of implementing the electronic device behavior in the first aspect and the possible implementation of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions. For example, a creation module, an opening module, an acquisition module, and a processing module.

[0018] In a third aspect, the present application provides an electronic device comprising: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, enable the electronic device to perform the method provided in the first aspect.

[0019] It should be understood that the second and third aspects of the present application are consistent with the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the method provided in the first aspect.

[0021] In a fifth aspect, the present application provides a computer program, which, when executed by a computer, is used to execute the method provided in the first aspect.

[0022] In one possible design, the program in the fifth aspect may be stored in whole or in part on a storage medium packaged together with the processor, or may be stored in whole or in part on a memory not packaged together with the processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application;

[0024] Figure 2 A schematic diagram of an application scenario of a sandbox-based operation processing method provided in one embodiment of the present application;

[0025] Figure 3 An implementation architecture diagram of a sandbox-based operation processing method provided in one embodiment of the present application;

[0026] Figure 4 A flowchart of a sandbox-based operation processing method provided by one embodiment of the present application;

[0027] Figure 5 A schematic diagram of configuring a trusted application for a file owner provided by an embodiment of the present application;

[0028] Figure 6 A schematic diagram of a first sandbox clone actively requesting to associate with a second sandbox clone provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of an external application passively associating with a first sandbox clone provided by an embodiment of the present application;

[0030] Figure 8 A schematic diagram of the structure of an electronic device provided in another embodiment of the present application;

[0031] Fig. 9 A schematic diagram of the structure of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0032] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0033] Currently, the management and control is based on the sandbox mechanism. Sandbox applications cannot pull up other external applications to share data according to the usage scenario. Therefore, the collaborative processing of the same business by multiple applications will be restricted, especially for read-only permission documents. In addition, the existing sandbox mechanism does not support multiple sandbox applications to automatically configure the same management policy, and cannot support multiple applications with the same policy to collaboratively process the same document; and in the existing related technologies, the DLP mechanism does not support the controlled sandbox application to pull up external applications, especially read-only control, and the operations of the applications in the sandbox cannot be perceived by external applications and cannot be collaboratively processed. For users, many common collaborative operation scenarios cannot be completed, and the user experience is poor.

[0034] Based on the above problems, an embodiment of the present application provides a sandbox-based operation processing method, in which operations on DLP files are processed through associated sandbox clones, and the associated sandbox clones are managed by the DLP management application. The control strategy of the associated sandbox clone is the same as the control strategy of the DLP file, and the associated sandbox clones can share data, such as encrypted files; and, in an embodiment of the present application, the associated sandbox clone provides a monitoring interface to the outside, and the events triggered by the associated sandbox clone can be monitored by external applications. The DLP management application can create a sandbox clone of the external application, and add the created sandbox clone of the external application to the associated sandbox clone, so as to collaboratively process operations on the DLP file.

[0035] The sandbox-based operation processing method provided in the embodiment of the present application can be applied to electronic devices, wherein the above-mentioned electronic devices can be smart phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks or personal digital assistants (PDA) and other devices; the embodiment of the present application does not impose any restrictions on the specific type of electronic devices.

[0036] For example, Figure 1 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application is shown as follows: Figure 1As shown, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0037] It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0038] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0039] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0040] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0041] For ease of understanding, the following embodiments of the present application will be described in detail with Figure 1 Taking the electronic device with the structure shown as an example, the sandbox-based operation processing method provided in the embodiment of the present application is specifically described in combination with the accompanying drawings and application scenarios.

[0042] Figure 2 A schematic diagram of an application scenario of a sandbox-based operation processing method provided in an embodiment of the present application. In the embodiment of the present application, the DLP management application processes operations on DLP files through an associated sandbox clone, such as Figure 2 As shown, in order to manage the above-mentioned associated sandbox clones, the DLP management application creates a sandbox group for the above-mentioned DLP file, the DLP management application manages the sandbox group corresponding to the DLP file, the DLP management application manages the life cycle of the sandbox group, and the control policy of the sandbox group is the same as the control policy of the DLP file. Applications added to the sandbox group later are uniformly configured by the DLP management application with the same control policy as the DLP file. Figure 2 In the figure, application A is the first application to process DLP files. In the specific implementation, the DLP management application creates a sandbox clone of application A, and processes the above DLP files through the sandbox clone of application A. The sandbox clone of application A and the DLP files are controlled by the same policy. After the DLP management application creates the sandbox group corresponding to the DLP file, it adds the sandbox clone of application A to the above sandbox group. If application A needs application B to collaborate on a business, application A can send a request to the DLP management application, and the DLP management should query whether there is a sandbox clone of application B in the sandbox group. If there is a sandbox clone of application B in the sandbox group, the DLP management application will directly pull up the sandbox clone of application B, and the sandbox clone of application A and the sandbox clone of application B will share data and jointly process the business. If the sandbox clone of application A and the sandbox clone of application B need application C when working together, the sandbox clone of application A or the sandbox clone of application B can send a request, and the DLP management application will query whether the sandbox clone of application C is in the sandbox group. If not, the DLP management application will create a sandbox clone of application C and add the sandbox clone of application C to the sandbox group for data sharing and collaborative processing of the business.

[0043] Figure 3 This is a diagram of an implementation architecture of a sandbox-based operation processing method provided in one embodiment of the present application. Figure 3In the process, the owner user of the document interacts with the DLP management application, sets the control policy and generates the DLP file of the corresponding document. The DLP management application creates a sandbox group corresponding to the DLP file, and configures the control policy of the sandbox group to be the same as the control policy set by the owner user. When a controlled user accesses the above DLP document, application A needs to be used to collaboratively process the access request of the above controlled user. The DLP management application creates a sandbox clone of application A and adds the sandbox clone of application A to the sandbox group corresponding to the above DLP file. Through the above process, the DLP management application can add multiple external applications to the sandbox group, which can form a small system. Multiple sandbox applications can work together to retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time.

[0044] The embodiment of the present application proposes a sandbox-based operation processing method, which processes operations on DLP files through associated sandbox clones, and the associated sandbox clones can share data and collaboratively process the same business. The DLP management application can associate the sandbox clones in two ways: active and passive, and provide a monitoring mechanism that allows external applications to monitor the operations of the associated sandbox clones, so that the DLP management application can associate the sandbox clones of the external applications that perform monitoring to collaboratively process operations on DLP files.

[0045] Figure 4 This is a flow chart of a sandbox-based operation processing method provided by an embodiment of the present application. The sandbox-based operation processing method provided by this embodiment can be implemented by a DLP management application in the electronic device 100. Figure 4 As shown, the above-mentioned sandbox-based operation processing method may include:

[0046] Step 401: The electronic device 100 creates a first sandbox clone of a first application in response to an access request for a DLP file, and opens the DLP file through the first sandbox clone.

[0047] In some examples, the first sandbox clone is associated with the DLP file described above.

[0048] Step 402: In response to a first operation on the DLP file, the electronic device 100 obtains a second sandbox clone for processing the first operation.

[0049] In some examples, the second sandbox clone is a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policies of the above-mentioned DLP files. The control policies of DLP files may include: document access rights, document outbound rights, document automatic backup rights and / or document copy rights, etc. In this embodiment, the first sandbox clone is associated with the DLP file, and the second sandbox clone is associated with the first sandbox clone. In this way, the DLP file, the first sandbox clone and the second sandbox clone can form a small system. Multiple sandbox clones can work together to retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time.

[0050] In some examples, the first operation for the above-mentioned DLP file may include: selecting the content of the DLP file and requesting translation, or selecting the content of the DLP file and searching, etc., which is not limited in this embodiment. For example, after the electronic device 100 receives the access request for the DLP file from the controlled user, it creates a first sandbox clone of the first application and opens the above-mentioned DLP file through the first sandbox clone. During the process of the controlled user browsing the DLP file, there is a need to translate part of the content of the DLP file. Then, the controlled user can select the content to be translated in the DLP file and request translation of the selected content. Then, the operation of the controlled user selecting the content to be translated and requesting translation is the operation for the above-mentioned DLP file. Then, in response to this operation of the controlled user on the above-mentioned DLP file, the DLP management application obtains from the sandbox clone associated with the first sandbox clone, and a second sandbox clone that can execute translation of the selected content.

[0051] See also Figure 2 In order to manage the sandbox clones associated with the first sandbox clone, the DLP management application in the electronic device 100 can create a sandbox group corresponding to the DLP file after creating the first sandbox clone of the first application, and add the first sandbox clone to the sandbox group. Then, in response to the first operation on the DLP file, the DLP management application obtains the second sandbox clone that processes the first operation from the sandbox group.

[0052] In some examples, the electronic device 100 obtains the second sandbox clone that processes the above operations as follows: the electronic device 100 queries the sandbox clone associated with the first sandbox clone, and in response to the fact that the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application in the electronic device 100 creates the above-mentioned second sandbox clone and associates the second sandbox clone with the first sandbox clone.

[0053] Step 403: The electronic device 100 processes the first operation through the second sandbox clone.

[0054] In some examples, after the electronic device 100 processes the first operation through the second sandbox clone, the electronic device 100 detects the write operation of the second sandbox clone on the DLP file, and in response to the write operation, the first sandbox clone can read the modified DLP file.

[0055] In some examples, the first sandbox clone and the second sandbox clone may constitute a sandbox group; thus, in response to a second operation on the DLP file, the electronic device 100 may receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone, and the second operation processing request is used to request a third application to process the second operation; then, the electronic device 100 creates a third sandbox clone of the third application, adds the third sandbox clone to the sandbox group, and processes the second operation through the third sandbox clone.

[0056] For some examples, see Figure 5 Before the electronic device 100 creates the second sandbox clone and associates the second sandbox clone with the first sandbox clone, the electronic device 100 may also first determine whether the second application is a trusted application. If the second application is a trusted application, the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone are executed. Specifically, the electronic device 100 may determine whether the second application is a trusted application in the following manner: determine whether the second application is in a data table; wherein the data table stores the configured trusted applications. wherein the trusted application may be configured by the DLP file owner, such as Figure 5 As shown, Figure 5 A schematic diagram of a file owner configuring a trusted application is provided for an embodiment of the present application. Specifically, the file owner can configure the trusted application in the following manner: save the name or package name of the trusted application in a data table, so that the electronic device 100 can determine whether the name or package name of the second application is in the configured data table. If so, the electronic device 100 can determine that the second application is a trusted application. If the name or package name of the second application is not in the configured data table, the electronic device 100 can determine that the second application is not a trusted application. In addition, the file owner can also configure indication information of whether the application is a trusted application in the configuration file of the application installation package. In this way, the electronic device 100 can determine whether the second application is a trusted application based on the above indication information in the configuration file of the second application installation package.

[0057] In addition, whether the second application is a trusted application can also be determined by application market review. If the second application passes the review of the application market, the electronic device 100 can determine that the second application is a trusted application; if the second application fails the review of the application market, the electronic device 100 can determine that the second application is not a trusted application.

[0058] In this embodiment, the manner of associating the sandbox clones may include active and passive methods, and the two joining methods are described below respectively.

[0059] In one implementation, before obtaining the second sandbox clone that processes the first operation, the electronic device 100 receives a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file, and the first operation processing request is used to request the second sandbox clone to process the first operation. In other words, the active method is that the first sandbox clone actively requests the DLP management application to create a second sandbox clone of the second application and associate the second sandbox clone with the first sandbox clone.

[0060] Figure 6 A schematic diagram of a first sandbox clone actively requesting to associate with a second sandbox clone provided in an embodiment of the present application, such as Figure 6 As shown, the first sandbox clone actively requests the DLP management application in the electronic device 100 to pull up the second application. The DLP management application first queries whether the sandbox clone of the second application (i.e., the second sandbox clone) is in the sandbox clone associated with the first sandbox clone. If the second sandbox clone exists in the sandbox clone associated with the first sandbox clone, the DLP management application directly pulls up the second sandbox clone and notifies the first sandbox clone that the second sandbox clone is successfully pulled up. If the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application creates a second sandbox clone, associates the second sandbox clone with the first sandbox clone, pulls up the second sandbox clone, and notifies the first sandbox clone that the second sandbox clone is successfully pulled up.

[0061] One application scenario of this implementation method is: when a document visitor with read-only permission uses the sandbox clone of word (the first sandbox clone) to read a DLP document, the translation software needs to be translated collaboratively. The document visitor can actively initiate a translation request, and the sandbox clone of word is used as the request initiator to request the DLP management application to pull up the translation software for collaborative work. The DLP management application queries whether there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of word. If not, the DLP management application creates a sandbox clone of the translation software and associates the sandbox clone of the translation software with the sandbox clone of word, and then translates the above DLP document through the sandbox clone of the translation software; if there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of word, the DLP management application directly pulls up the sandbox clone of the translation software without repeatedly creating the sandbox clone, and then translates the above DLP document through the sandbox clone of the translation software. The control policy of the associated sandbox clone is the same as the control policy of the DLP file.

[0062] This implementation solves the problem that document visitors with read-only permissions cannot launch external applications for collaborative work, and ensures the security of data communication. Based on the existing DLP protection mechanism, it enables visitors to launch external applications in reasonable scenarios, greatly improving the visitor's user experience, and the associated sandbox clones are controlled by the same management policy, ensuring data security.

[0063] In another implementation, before creating a second sandbox clone and associating the second sandbox clone with the first sandbox clone, if the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the electronic device 100 can obtain a second application that monitors the above operation and notify the second application of the above operation. In other words, the passive joining method is to allow the external application to passively join the sandbox clone associated with the first sandbox clone through the monitoring mechanism.

[0064] Figure 7 A schematic diagram of an external application passively associating with a first sandbox clone provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, when the first sandbox clone triggers operation A for the DLP file, and the external second application is monitoring operation A through the monitoring mechanism, the DLP management application can notify the external second application that a usage scenario in the sandbox has triggered operation A, and the DLP management application can create a second sandbox clone for the external second application, and associate the second sandbox clone with the first sandbox clone, and then the second sandbox clone works together with the first sandbox clone.

[0065] For example, after the electronic device 100 receives an access request for a DLP file from a user with read-only access permission, it creates a first sandbox clone of a first application and opens the DLP file through the first sandbox clone. Obviously, for the user with read-only access permission, the DLP file is a read-only file. Assume that the DLP file is an English document, and the specific content may be as follows: "Some people, no matter how old they are, are always young; Some people, regardless of whether it is honor or disgrace, are calm and calm; ... "The read-only access user has the need to translate part of the content in the above English document. The read-only access user can select the content to be translated with the mouse. Here, it is assumed that "Some people, regardless of whether it is honor or disgrace, are calm and calm;" is the part selected by the read-only access user with the mouse. The read-only access user requires the translation software to translate the selected sentence. Then, the operation of "selecting" this sentence by the read-only access user with the mouse can be used as a trigger operation for the external translation software to monitor. After the external translation software monitors the above selection operation through the monitoring mechanism, the DLP management application creates a sandbox clone of the translation software, and associates the sandbox clone of the translation software with the first sandbox clone, and then translates the selected content in the above DLP file through the sandbox clone of the translation software.

[0066] This implementation can solve the problem that external applications cannot perceive the operations of applications in the sandbox. Through the monitoring mechanism, a sandbox clone of the external application can be created, and the sandbox clone of the external application can be associated with the sandbox clone of the application that opens the DLP file. The two work together to improve the user experience.

[0067] In the above-mentioned sandbox-based operation processing method, the electronic device 100 creates a first sandbox clone of the first application in response to an access request for the DLP file, and opens the above-mentioned DLP file through the first sandbox clone. Then, the electronic device 100 obtains a second sandbox clone that processes the above-mentioned first operation in response to the first operation for the above-mentioned DLP file, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone may be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the management and control policies of the first sandbox clone and the second sandbox clone are the same as the management and control policies of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones can work together to retain the operating environment and configuration information of the DLP file, so as to facilitate the reproduction of the scene after the controlled user opens the DLP file next time, thereby improving the user experience.

[0068] It is to be understood that some or all of the steps or operations in the above embodiments are merely examples, and the present application embodiments may also perform other operations or variations of various operations. In addition, the various steps may be performed in different orders presented in the above embodiments, and it is possible that not all of the operations in the above embodiments need to be performed.

[0069] It is understandable that, in order to realize the above functions, the electronic device includes hardware and / or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to exceed the scope of this application.

[0070] This embodiment can divide the electronic device into functional modules according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0071] Figure 8 A schematic diagram of the structure of an electronic device provided in another embodiment of the present application, in which each functional module is divided according to each function, Figure 8 A possible schematic diagram of the composition of the electronic device 800 involved in the above embodiment is shown. Figure 8As shown, the electronic device 800 may include: a creation module 801, an opening module 802, an acquisition module 803 and a processing module 804;

[0072] The creation module 801 is used to create a first sandbox clone of the first application in response to an access request for the DLP file; wherein the first sandbox clone is associated with the DLP file;

[0073] An opening module 802 is used to open the DLP file through the first sandbox clone;

[0074] An acquisition module 803 is used to acquire, in response to the first operation on the DLP file, a second sandbox clone for processing the first operation; wherein the second sandbox clone includes a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file;

[0075] The processing module 804 is used to process the above-mentioned first operation through the second sandbox clone.

[0076] It should be noted that this application Figure 4 All relevant contents of each step involved in the illustrated method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0077] The electronic device 800 provided in this embodiment is used to execute the present application Figure 4 The sandbox-based operation processing method provided by the illustrated embodiment can therefore achieve the same effect as the above-mentioned method.

[0078] Fig. 9 A schematic diagram of the structure of an electronic device provided in another embodiment of the present application, Figure 8 The electronic device shown is different in that Fig. 9 The electronic device 900 shown may also include: a query module 805 and an association module 806;

[0079] The query module 805 is used to query the sandbox clones associated with the first sandbox clone;

[0080] The creation module 801 is further configured to create a second sandbox clone in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone;

[0081] The association module 806 is used to associate the second sandbox clone with the first sandbox clone.

[0082] In some examples, the electronic device 800 may further include: a receiving module 807;

[0083] The receiving module 807 is used to receive a first operation processing request initiated by the first sandbox clone in response to the first operation on the above-mentioned DLP file before the acquisition module 803 acquires the second sandbox clone that processes the above-mentioned first operation, and the above-mentioned first operation processing request is used to request the second sandbox clone to process the above-mentioned first operation.

[0084] In some examples, the electronic device 800 may further include: a notification module 808;

[0085] The acquisition module 803 is further configured to acquire a second application that monitors the first operation in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone before the association module 806 associates the second sandbox clone with the first sandbox clone.

[0086] The notification module 808 is used to notify the second application of the first operation.

[0087] In some examples, the electronic device 800 may further include: a determination module 809;

[0088] The judgment module 809 is used to judge whether the second application is a trusted application before the association module 806 associates the second sandbox clone with the first sandbox clone; if the second application is a trusted application, the creation module 801 and the association module 806 execute the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone. In this embodiment, the judgment module 809 is specifically used to judge whether the second application is in the data table; wherein the above data table stores the configured trusted applications.

[0089] In this embodiment, the first sandbox clone and the second sandbox clone constitute a sandbox group; the receiving module 807 is further used to receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone in response to the second operation on the DLP file, wherein the second operation processing request is used to request the third application to process the second operation;

[0090] The creation module 801 is further used to create a third sandbox clone of the third application and add the third sandbox clone to the above sandbox group;

[0091] The processing module 804 is further configured to process the second operation through the third sandbox clone.

[0092] In some examples, the first operation may include a selection operation of the first sandbox clone on the content of the DLP file, where the DLP file is a read-only file; thus, the processing module 804 is specifically used to translate the selected content in the DLP file through the second sandbox clone.

[0093] It should be noted that this application Figure 4 to Figure 7All relevant contents of each step involved in the illustrated method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0094] The electronic device 800 provided in this embodiment is used to execute the present application Figure 4 to Figure 7 The sandbox-based operation processing method provided by the illustrated embodiment can therefore achieve the same effect as the above-mentioned method.

[0095] It should be understood that the electronic device 800 may correspond to Figure 1 The electronic device 100 shown in FIG. Among them, the functions of the opening module 802, the obtaining module 803, the processing module 804, the association module 805, the receiving module 806, the obtaining module 807, the notification module 808 and the judgment module 809 can be Figure 1 The processor 110 in the electronic device 100 is shown implemented.

[0096] In the case of adopting an integrated unit, the electronic device 800 may include a processing module, a storage module, and a communication module.

[0097] The processing module can be used to control and manage the actions of the electronic device 800, for example, it can be used to support the electronic device 800 to execute the steps executed by the above modules. The storage module can be used to support the electronic device 800 to store program codes and data, etc. The communication module can be used to support the communication between the electronic device 800 and other devices.

[0098] Among them, the processing module can be a processor or a controller, which can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and so on. The storage module can be a memory. The communication module can specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip and / or a Wi-Fi chip.

[0099] In one embodiment, when the processing module is a processor and the storage module is a memory, the electronic device 800 involved in this embodiment can be a Figure 1 Device of the structure shown.

[0100] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the present application. Figure 4 to Figure 7 The method provided by the illustrated embodiment.

[0101] The present application also provides a computer program product, which includes a computer program, which, when executed on a computer, enables the computer to execute the present application. Figure 4 to Figure 7 The method provided by the illustrated embodiment.

[0102] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0103] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0104] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0105] In several embodiments provided in the present application, any function can be stored in a computer-readable storage medium if it is implemented in the form of a software functional unit and sold or used as an independent product. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0106] The above is only a specific implementation of the present application. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. The protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A sandbox-based file operation processing method, characterized in that: include: In response to an access request for a data leakage prevention (DLP) file, create a first sandbox clone of a first application, and open the DLP file through the first sandbox clone; wherein the first sandbox clone is associated with the DLP file; In response to a first operation on the DLP file, obtaining a second sandbox clone that processes the first operation; wherein the second sandbox clone includes a sandbox clone of a second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file; The first operation is processed by the second sandbox clone.

2. The method according to claim 1, characterized in that The obtaining of a second sandbox clone for processing the first operation comprises: Querying the sandbox clone associated with the first sandbox clone; In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, the second sandbox clone is created and associated with the first sandbox clone.

3. The method according to claim 1, characterized in that Before obtaining the second sandbox clone that processes the first operation, the method further includes: In response to a first operation on the DLP file, a first operation processing request initiated by the first sandbox clone is received, where the first operation processing request is used to request a second sandbox clone to process the first operation.

4. The method according to claim 2, characterized in that: Before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, obtaining a second application that monitors the first operation; The second application is notified of the first operation.

5. The method according to any one of claims 2 to 4, characterized in that: Before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: Determining whether the second application is a trusted application; If the second application is a trusted application, the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone are performed.

6. The method according to claim 5, characterized in that The determining whether the second application is a trusted application includes: Determine whether the second application is in a data table; wherein the data table stores configured trusted applications.

7. The method according to claim 1, characterized in that The first sandbox clone and the second sandbox clone constitute a sandbox group; the method further includes: In response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, where the second operation processing request is used to request a third application to process the second operation; Creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; The second operation is processed by the third sandbox clone.

8. The method according to claim 1, characterized in that After the second sandbox clone processes the first operation, the method further includes: Detecting a write operation of the second sandbox clone on the DLP file; In response to the write operation, the first sandbox clone reads the modified DLP file.

9. The method according to claim 1, characterized in that: The first operation includes a selection operation of the first sandbox clone on the content of the DLP file, and the DLP file is a read-only file; Processing the first operation by the second sandbox clone includes: The selected content in the DLP file is translated by the second sandbox clone.

10. An electronic device, characterized in that: include: one or more processors; Memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, enable the electronic device to perform the method as described in any one of claims 1-9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 9.

Images