File management method and device, electronic equipment, storage medium and program product

Abstract

One or more embodiments of the invention provide a file management method and device, electronic equipment, a storage medium and a program product. The file management method is applied to a file agent, the file agent is deployed between a file server and a file client, and the method comprises the steps that a file uploading request sent by the file client is received, and the file uploading request carries a work order identifier and a file to be uploaded; obtaining a content list specified by a corresponding file uploading work order according to the work order identifier; analyzing the file content of the to-be-uploaded file, and judging whether the to-be-uploaded file is matched with the content list or not according to the analyzed file content; and under the condition that the to-be-uploaded file is matched with the content list, storing the to-be-uploaded file to the file server.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of file management technology, and in particular, to a file management method, device, electronic device, storage medium, and program product. Background Art

[0002] A file server is a computer system that is used to store, manage, and share files. It can provide file services by supporting different network protocols. For example, an FTP server provides file services based on the FTP protocol (File Transfer Protocol), and an SFTP server provides file services based on the SFTP protocol (Secure File Transfer Protocol).

[0003] At present, no matter what protocol the file server supports, the file services it provides are still focused on file storage, management and sharing, and cannot meet the security management needs in data governance scenarios. Summary of the invention

[0004] In view of this, one or more embodiments of this specification provide the following technical solutions:

[0005] According to a first aspect of one or more embodiments of this specification, a file management method is proposed, which is applied to a file agent, wherein the file agent is deployed between a file server and a file client, and the method includes:

[0006] Receive a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded;

[0007] Obtaining a content list specified by a corresponding file upload work order according to the work order identifier;

[0008] Parsing the file content of the file to be uploaded, and judging whether the file to be uploaded matches the content list according to the parsed file content;

[0009] When the file to be uploaded matches the content list, the file to be uploaded is stored in the file server.

[0010] Optionally, the process of storing the file to be uploaded in the file server includes:

[0011] Obtaining the file level specified by the corresponding file upload work order according to the work order identifier;

[0012] In the case that the acquired file level belongs to the encryption level, the file to be uploaded is encrypted, and the encrypted file to be uploaded is stored in the file server.

[0013] Optionally, the file upload request also carries source information of the file to be uploaded. Before obtaining the content list specified by the corresponding file upload work order according to the work order identifier, the method further includes:

[0014] Obtain the file source specified in the corresponding file upload work order according to the work order identifier;

[0015] Determining whether the source of the file to be uploaded is the same as the acquired specified file source according to the source information;

[0016] In the case where the source of the file to be uploaded is the same as the source of the specified file, a step of acquiring a content list specified by the corresponding file upload work order according to the work order identifier is performed.

[0017] Optionally, the process of parsing the file content of the file to be uploaded includes:

[0018] In the case where the designated file source is a synchronous task upload, a file content identifier is extracted from the file to be uploaded to implement parsing of the file content of the file to be uploaded;

[0019] In the case that the designated file source is application upload or manual upload, the file type of the file to be uploaded is determined, and the file content of the file to be uploaded is parsed using a parsing method that matches the file type.

[0020] Optionally, when the designated file source is manually uploaded, the file upload request also carries a manually filled source annotation, and the method further includes:

[0021] Determining whether the file to be uploaded is compliant according to the source annotation;

[0022] In the case that the file to be uploaded is compliant, the steps of determining the file type of the file to be uploaded and parsing the file content of the file to be uploaded using a parsing method matching the file type are performed.

[0023] Optionally, the process of judging whether the file to be uploaded is compliant according to the source annotation includes:

[0024] determining an annotation type of the source annotation;

[0025] In the case where the annotation type is a download process number, determining whether the download process number is a legal number, and in the case where the download process number is a legal number, determining that the file to be uploaded is compliant;

[0026] In the case where the annotation type is a custom annotation, the source annotation is transferred to manual judgment.

[0027] Optionally, the process of judging whether the file to be uploaded matches the content list according to the parsed file content includes:

[0028] Determining whether the file content exceeds the range recorded in the content list;

[0029] When the file content does not exceed the range, it is determined that the file to be uploaded matches the content list.

[0030] Optionally, before obtaining the content list specified by the corresponding file upload work order according to the work order identifier, the method further includes:

[0031] Obtain the approved file upload work order from the work order approval system;

[0032] Obtaining a work order identifier and a content list from the file upload work order, and saving a mapping relationship between the work order identifier and the content list;

[0033] The process of obtaining the content list specified by the corresponding file upload work order according to the work order identifier includes:

[0034] The content list is searched in the mapping relationship according to the work order identifier.

[0035] According to a second aspect of one or more embodiments of this specification, a file service audit method is proposed, which is applied to an audit system and includes:

[0036] Obtaining, from the file server, a first-category file service log recorded in the file server;

[0037] Obtain the second type of file service log recorded in the file agent from the file agent;

[0038] Performing a file service audit based on the first type of file service log and the second type of file service log;

[0039] Wherein, the file proxy is deployed between the file server and the file client to execute the steps of the above method.

[0040] According to a third aspect of one or more embodiments of this specification, a file management device is provided, which is applied to a file agent, wherein the file agent is deployed between a file server and a file client, and the device includes:

[0041] A request receiving unit, receiving a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded;

[0042] A content acquisition unit, which acquires a content list specified by a corresponding file upload work order according to the work order identifier;

[0043] A content matching unit, which parses the file content of the file to be uploaded, and determines whether the file to be uploaded matches the content list according to the parsed file content;

[0044] The file storage unit stores the file to be uploaded in the file server when the file to be uploaded matches the content list.

[0045] According to a fourth aspect of one or more embodiments of this specification, an audit device for a file service is provided, which is applied to an audit system and includes:

[0046] A first log acquisition unit, acquiring, from the file server, a first type of file service log recorded in the file server;

[0047] A second log acquisition unit acquires, from the file agent, a second type of file service log recorded in the file agent;

[0048] A file service audit unit, which performs a file service audit based on the first type of file service log and the second type of file service log;

[0049] Wherein, the file proxy is deployed between the file server and the file client to execute the steps of the above method.

[0050] According to a fifth aspect of one or more embodiments of the present specification, an electronic device is proposed, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor implements the steps of the aforementioned method by running the executable instructions.

[0051] According to a sixth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored, and the instructions are the steps of the aforementioned method when executed by a processor.

[0052] According to a seventh aspect of one or more embodiments of the present specification, a computer program product is proposed, comprising a computer program / instruction, which implements the steps of the aforementioned method when executed by a processor.

[0053] It can be seen from the above embodiments that the present specification can deploy a file agent between the file client and the file server. After receiving the file upload request, the file agent can obtain the content list specified by the corresponding file upload work order according to the work order identifier carried in the file upload request, and can perform file content analysis on the file to be uploaded in the file upload request to determine whether the file content obtained by analysis matches the found content list. If it matches, it can be said that the file content in the file to be uploaded has been approved, and then the file to be uploaded can be uploaded to the file server for storage, so that only approved files can be uploaded to the file server for storage, so that unapproved files will not be stored in the file server, ensuring the file security requirements in the data governance scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the architecture of a file management system provided by an exemplary embodiment.

[0055] Figure 2 It is a flowchart of a file management method provided by an exemplary embodiment.

[0056] Figure 3 is a flowchart of another file management method provided by an exemplary embodiment.

[0057] Figure 4 The present invention is a flowchart of a method for auditing a file service provided by an exemplary embodiment.

[0058] Figure 5 It is a structural schematic diagram of a device provided by an exemplary embodiment.

[0059] Figure 6 It is a block diagram of a file management device provided by an exemplary embodiment.

[0060] Figure 7 It is a block diagram of an audit device for a file service provided by an exemplary embodiment. DETAILED DESCRIPTION

[0061] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0062] A file server is a computer system that is used to store, manage, and share files. It can provide file services by supporting different network protocols. For example, an FTP server provides file services based on the FTP protocol (File Transfer Protocol), and an SFTP server provides file services based on the SFTP protocol (Secure File Transfer Protocol).

[0063] At present, no matter what protocol the file server supports, the file services it provides are still focused on file storage, management and sharing, and cannot meet the security management needs in data governance scenarios.

[0064] For example, in data governance scenarios, it is usually necessary to ensure file security. Although a file server that supports the SFTP protocol can ensure the secure transmission of files between the file client and the file server, it is impossible to know whether files that should not be stored are stored in the file server.

[0065] This specification provides a file management solution, which can deploy a file agent between a file client and a file server, and the file agent assists the file server in parsing and controlling the file content, thereby meeting the needs of data governance scenarios. The specific implementation method will be described in detail in the subsequent embodiments.

[0066] Figure 1 FIG. 1 is a schematic diagram of the architecture of a file management system provided by an exemplary embodiment. Figure 1 As shown, the system may include a file server 11 , a file agent 12 , and a file client 13 .

[0067] The file server 11 may be a physical server including an independent host, or the file server 11 may be a virtual server carried by a host cluster. The file server 11 may support FTP protocol, SFTP protocol, or other file transfer protocols, which are not specifically limited in this specification.

[0068] The file proxy 12 may also be a physical server of an independent host, or a virtual server carried by a host cluster, or the file proxy 12 may also be integrated into the file server 11 , for example, integrating the functions of the file proxy 12 into the file server 11 .

[0069] The physical carrier of the file client 13 can be a PC (Personal Computer), a mobile phone, a tablet device, a laptop, a PDA (Personal Digital Assistants) or other electronic device, and one or more embodiments of this specification are not limited to this. During operation, the electronic device can run the file service program and can realize functions such as file upload and file download.

[0070] The file client 13 is connected to the file proxy 12 , and the file proxy 12 is connected to the file server 11 , that is, the file client 13 is connected to the file server 11 through the file proxy 12 .

[0071] As for the network for interaction between the file proxy 12 and the file server 11, and between the file client 13 and the file proxy 12, a wired or wireless network can be selected to realize communication based on the communication mode supported by the corresponding electronic device, and this specification does not limit this. For example, the file client 13 can support both wired and wireless communication, and then a wired or wireless network can be used to realize communication with the file proxy 12 as needed.

[0072] Figure 2 It is a flowchart of a file management method provided by an exemplary embodiment.

[0073] Please refer to Figure 2 The file management method can be applied in a file proxy, through which a file client connects to a file server. The corresponding system architecture can be referenced. Figure 1 , the file management method comprises the following steps:

[0074] Step 202: receiving a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded.

[0075] In this embodiment, after connecting to the file proxy, the file client can enter the account and password for identity authentication, and after completing the identity authentication, the file can be uploaded to the file server. The identity authentication method is not limited to the account and password, but can also be other authentication methods such as biometrics and dynamic tokens. For details, please refer to the relevant technology, and this manual does not impose any special restrictions on this.

[0076] In this embodiment, when uploading files through the file client, the file uploader needs to fill in the work order identification of the approved file upload work order, such as the work order number. The file upload work order can correspond to a business scenario with a file download demand, and the file uploader can initiate approval before uploading the corresponding file. The specific process will be described in subsequent embodiments.

[0077] In this embodiment, on the basis of filling in the work order identification, the file uploader can also upload files (referred to as files to be uploaded) to be stored in the file server through the file client. The number of files to be uploaded can be 1 or more.

[0078] In this embodiment, the file client can add the work order identifier and the file to be uploaded to the file upload request and send it to the file proxy. Of course, in other examples, the work order identifier and the file to be uploaded can also be sent separately, and this specification does not impose any special restrictions on this.

[0079] Step 204: Obtain a content list specified by the corresponding file upload work order according to the work order identifier.

[0080] In one example, the file proxy may obtain the content list specified by the file upload work order corresponding to the work order identifier from the work order approval system. For example, after receiving the file upload request, the file proxy may send a work order query request to the work order approval system, and may carry the work order identifier in the work order query request, so that the work order approval system can return the corresponding content list to the file proxy based on the work order identifier. Among them, the work order approval system can return the content list to the file proxy only after the file upload work order corresponding to the work order identifier is approved, so as to ensure that the content list obtained by the file proxy has been approved, and then ensure that the file content of the files to be uploaded that are subsequently uploaded to the file server for storage has been approved. If the file upload work order corresponding to the work order identifier has not been approved, the work order approval system can return a prompt message to the file proxy that the approval has not been passed, and the file proxy can then return the prompt message to the file client.

[0081] In another example, the file proxy may also periodically obtain approved file upload work orders from the work order approval system, and then extract the content list from the file upload work order, and save the mapping relationship between its work order identifier and the content list. In actual implementation, the work order approval system may also push the approved file upload work order to the file proxy, and this specification does not impose any special restrictions on this. In this case, if the file proxy cannot find the content list corresponding to the work order identifier, it usually means that the file upload work order corresponding to the work order identifier has not been approved, and a prompt message indicating that the approval has not been passed may be returned to the file client.

[0082] Taking the mapping relationship between the work order identifier saved by the file proxy and the content list specified by the approved file upload work order as an example, this step can directly find the corresponding content list in the mapping relationship. The content list includes the file content specified in the file upload work order, for example, the content list can be a content identifier set of the file content.

[0083]

[0084] Table 1

[0085] Please refer to the example in Table 1. Assuming that the work order ID carried in the file upload request in the aforementioned step 202 is 123456, through the mapping relationship shown in Table 1, it can be found that the content list corresponding to the work order ID 123456 is a sensitive identity information list, which includes name, phone number, email address, birthday, and occupation.

[0086] It is worth noting that Table 1 is only an example. In actual applications, such a table may not be organized. At the same time, this specification refers to the file content specified in the file upload work order as a content list. In other examples, it is not limited to the organization form of a list, and can also be a content list, a content collection, etc. This specification does not impose any special restrictions on this.

[0087] Step 206: parse the file content of the file to be uploaded, and determine whether the file to be uploaded matches the content list based on the parsed file content.

[0088] Step 208: When the file to be uploaded matches the content list, the file to be uploaded is stored in the file server.

[0089] In this embodiment, the file proxy may also parse the file to be uploaded carried in the file upload request to obtain the file content in the file to be uploaded.

[0090] In one example, the file to be uploaded may be parsed in a parsing method that matches the file type of the file to be uploaded. For example, for a file to be uploaded of the image type, an OCR (Optical Character Recognition) method may be used to identify the content in the corresponding image. For another example, for a file to be uploaded of the text type, a character recognition algorithm may be used to identify the content in the corresponding text.

[0091] In another example, the file sources of the files to be uploaded can be distinguished, and the file proxy can then determine the parsing method of the files to be uploaded according to the file sources, so as to parse the uploaded files using the corresponding parsing method, thereby improving the parsing efficiency. The implementation of this part will be described in detail in the subsequent embodiments.

[0092] In this embodiment, after parsing the file content of the file to be uploaded, it can be determined whether the file content matches the content list specified by the file upload work order corresponding to the work order identifier. For example, it can be determined whether the file content of the file to be uploaded does not exceed the range recorded in the content list.

[0093] If it does not exceed, it means that the file contents of the to-be-uploaded file are all the contents that have been approved and allowed to be uploaded to the file server, and step 208 can be executed. For example, assuming that the file contents parsed from the to-be-uploaded file are the user's name, phone number, and occupation, which do not exceed the content list shown in the aforementioned Table 1, and then step 208 can be executed to store the to-be-uploaded file in the file server.

[0094] If the file content of the file to be uploaded exceeds the range recorded in the content list, it means that the file content of the file to be uploaded includes content that has not passed the approval. In order to meet the security requirements in the data governance scenario, a prompt message that the approved content is inconsistent can be returned to the file client. For example, assuming that the user's bank card number is parsed from the file to be uploaded, and the bank card number is not in the content list obtained in the above step 204, in other words, the file content of the file to be uploaded has exceeded the range recorded in the content list, and the file to be uploaded is not allowed to be stored in the file server.

[0095] As can be seen from the above description, in this embodiment, a file agent can be deployed between the file client and the file server. After receiving a file upload request, the file agent can obtain the content list specified by the corresponding file upload work order according to the work order identifier carried in the file upload request, and can perform file content parsing on the file to be uploaded in the file upload request to determine whether the file content obtained by parsing matches the found content list. If it matches, it can be said that the file content in the file to be uploaded has been approved, and then the file to be uploaded can be uploaded to the file server for storage, so that only approved files can be uploaded to the file server for storage, so that unapproved files will not be stored in the file server, ensuring the file security requirements in the data governance scenario.

[0096] The following describes the implementation process of this manual in detail from three aspects: file upload work order approval, file upload and download, and log audit.

[0097] 1. File upload work order approval

[0098] In this manual, for each scenario where file sharing is required, a file upload work order can be submitted in advance for approval.

[0099] For example, in a financial certificate cooperation scenario, financial institution 2 needs to obtain the user's certificate information from financial institution 1. Financial institution 1 can upload the user's certificate information to a file server for storage in advance, and financial institution 2 can subsequently download the required user's certificate information from the file server.

[0100] In this example, before uploading the user certificate information to the file server for storage, the file upload personnel of financial institution 1 can first initiate a file upload work order corresponding to the financial certificate cooperation scenario for security approval.

[0101] The file upload work order must include a list of all the content to be uploaded to the file server for storage, such as the user's ID number, the user's driver's license number, the user's passport number, and the user's medical insurance card number. The approval process for the file upload work order is also pre-set, for example, the project leader performs the first-level approval, the project manager performs the second-level approval, etc. The processing and implementation of this part can refer to the relevant technology.

[0102] In other examples, the content to be uploaded to the file server for storage can also be classified, for example, into corporate data and personal data, and the aforementioned user ID number and other content are all personal data. In this way, when filling in the content list, the file uploader can first select the content type, and then realize the classification of the file content type.

[0103] In other examples, commonly used content may be provided to the file uploader in the form of options to improve the efficiency of the file uploader in filling out the file upload work order.

[0104] In other examples, the corresponding file level can also be specified for the content list in the file upload work order. For example, in this example, the file levels corresponding to the personal ID information of the aforementioned user and the content list shown in the aforementioned Table 1 are all confidential. For another example, the file level corresponding to the user's facial features, fingerprints, irises and other biometric features is confidential. For another example, the file level corresponding to the user's basic identity information such as account ID, nickname, gender, and location is internal data, etc. For different file levels, the file agent can adopt different storage strategies when storing the files to be uploaded to the file server. For example, for file levels that require encryption, the file agent can encrypt the files to be uploaded and store them on the file server. For file levels that do not require encryption, the file agent can directly store the files to be uploaded on the file server. The specific implementation process will be described in the subsequent embodiments.

[0105] In other examples, considering that the files that need to be uploaded to the file server in financial institution 1 and shared with financial institution 2 may have different sources, and the data structures of files from different sources may also be different, when initiating a file upload work order, the source of the file (hereinafter referred to as the designated file source) can be specified in the file upload work order. After receiving the file upload request, the file agent can obtain the source information carried in the file upload request, and then determine whether the source information is the same as the designated file source corresponding to the work order identifier. If not, it means that there may be security risks in the file to be uploaded, and a prompt message that the source has not been approved can be returned to the file client. If the source information is the same as the designated file source, the uploaded file can be parsed in a manner corresponding to the designated file source, so as to improve the parsing efficiency of the uploaded file on the basis of ensuring security.

[0106] The specified file source may include application upload, synchronization task upload, and manual upload.

[0107] Application upload in this specification may refer to files to be uploaded that need to be stored in the file server from other applications. The file uploader can obtain the files to be uploaded from other applications by writing code, etc., and then send the files to be uploaded to the file proxy.

[0108] In this specification, synchronization task upload may refer to the files to be uploaded that need to be stored in the file server coming from other data platforms. The file uploader can synchronize the files of other data platforms to the file agent by submitting synchronization tasks.

[0109] Manual uploading in this specification may refer to the file to be uploaded that needs to be stored in the file server being manually uploaded by the file uploader through the file client and sent to the file agent. In this case, for data security considerations, the file uploader can annotate the source of the file to be uploaded when uploading the file to be uploaded, so that the file agent can perform a security audit.

[0110] The different file parsing methods corresponding to the above three different designated file sources will be described in detail in subsequent embodiments.

[0111] It can be seen from this that when implementing file management, this manual can achieve advance knowledge and approval of file content and source through file upload work orders.

[0112] 2. File upload and download

[0113] Figure 3 is a flowchart of another file management method provided by an exemplary embodiment.

[0114] Please refer to Figure 3 The file management method can be applied in a file agent, and includes the following steps:

[0115] Step 302: Receive a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded.

[0116] In this embodiment, the implementation process of step 302 may refer to the aforementioned step 202, which will not be described in detail here.

[0117] Step 304: Obtain the file source specified by the corresponding file upload work order according to the work order identifier.

[0118] In this embodiment, the file agent periodically obtains approved file upload work orders from the work order approval system, and obtains the work order identification, content list, file level and specified file source therefrom, and saves the mapping relationship between the four.

[0119]

[0120] Table 2

[0121] Please refer to the example in Table 2, assuming that the corresponding relationship of the four stored in the file proxy is as shown in Table 2. Also assume that the work order ID carried in the file upload request received in the aforementioned step 302 is 654321. Based on the mapping relationship shown in Table 2, the file proxy can obtain that the source of the specified file is a synchronous task upload.

[0122] Step 306: Determine whether the source of the file to be uploaded is the same as the acquired specified file source.

[0123] In this embodiment, the file upload request also carries the source information of the file to be uploaded, and the source information can be automatically added by the file client based on the file source. The file proxy can determine whether the source information is the same as the specified file source obtained in the aforementioned step 306. If they are the same, it means that the source of the file to be uploaded is the same as the approved source, and the subsequent steps can be executed. If they are not the same, it means that the source of the file to be uploaded is different from the approved source, and there may be a security risk, and then a prompt message that the file source is not approved can be returned to the file client.

[0124] Step 308: When the source of the file to be uploaded is the same as the source of the specified file, a content list specified by the corresponding file upload work order is obtained according to the work order identifier.

[0125] Based on the judgment result of the aforementioned step 306 , when the source of the file to be uploaded is the same as the source of the specified file, the file proxy may continue to obtain the content list specified by the corresponding file upload work order according to the work order identifier.

[0126] Please continue to refer to the example in Table 2. The file proxy can obtain that the content list corresponding to the work order ID 654321 is a personal biometric information content list, including facial features, fingerprints, and irises.

[0127] Step 310: parsing the file content of the file to be uploaded.

[0128] In this embodiment, based on the judgment result of the aforementioned step 306, when the source of the file to be uploaded is the same as the source of the designated file, the file proxy may adopt different methods to perform content analysis on the file to be uploaded for different designated file sources.

[0129] Taking the example of the work order ID 654321 carried in the received file upload request, the corresponding designated file source is the synchronous task upload, which means that the received file to be uploaded comes from other data platforms, usually structured data. The file content ID included in the file to be uploaded can be directly extracted from the file to be uploaded to parse the file content of the file to be uploaded and obtain the specific content of the file to be uploaded.

[0130] In another example, assuming that the work order ID carried in the received file upload request is 123456, based on the mapping relationship shown in Table 2, the file proxy can obtain the corresponding content list as a list of personal sensitive identity information content, including: name, phone number, email address, birthday and occupation, and specify that the file source is application upload. The file type of the file to be uploaded may be a picture or text, etc. The file type can be determined first, and then the file content of the file to be uploaded can be parsed using a parsing method that matches the file type to obtain the file content identifier included in the file to be uploaded. For example, for a picture type file to be uploaded, OCR recognition can be used to identify the content in the corresponding picture. For another example, for a text type file to be uploaded, a character recognition algorithm can be used to identify the content in the corresponding text, etc.

[0131] In another example, assuming that the work order ID carried in the received file upload request is 987654, based on the mapping relationship shown in Table 2, the file proxy can obtain its corresponding content list, which is a list of personal basic identity information content, including: nickname, gender and location, and specifies that the file source is manually uploaded.

[0132] If the exact source of the manually uploaded files is unknown, it may lead to security risks. For example, the file uploader may be bribed to intentionally upload the wrong file or even a file with a virus. This manual is for manual uploads. When uploading files, the file uploader needs to fill in the exact source of the file, which is called source annotation in this manual. In this case, two types of source annotations can be included:

[0133] One type is that the file uploader downloads the file to be uploaded from other places through the internal compliance process of the enterprise. In this case, the file uploader can fill in the download process number used when downloading the file to be uploaded as the source annotation when uploading the file to be uploaded. The file agent can verify whether the download process number is a legal number. If it is a recorded legal download process number, it can confirm that the file source of the file to be uploaded is compliant. Then, similar to application upload, the file type can be determined first, and then the file content of the file to be uploaded can be parsed using a parsing method that matches the file type to obtain the file content identifier included in the file to be uploaded.

[0134] Another type is that the file uploader does not download the file to be uploaded through the internal compliance process of the enterprise. In this case, the file uploader can manually fill in the actual source of the file to be uploaded, such as "** file downloaded from ** platform". For this kind of custom annotation, the file agent can transfer it to manual review, and can parse the file content in the file to be uploaded after the review is passed. Of course, the file agent can also parse and store the file content in the file to be uploaded without waiting for the manual review results. If the manual confirmation fails to pass the review later, the stored file to be uploaded can be deleted from the file server.

[0135] It can be seen that, for files to be uploaded that are uploaded manually, this manual can also realize the knowledge and control of their exact sources.

[0136] It should be noted that the present embodiment does not limit the execution process of the aforementioned step 308 and step 310. In other examples, step 310 may be executed first and then step 308, or step 308 and step 310 may be executed in parallel.

[0137] Step 312: determine whether the file to be uploaded matches the content list based on the parsed file content.

[0138] In this embodiment, the file proxy can determine whether the parsed file content matches the acquired content list, and specifically, can determine whether the file content of the file to be uploaded exceeds the range recorded in the content list.

[0139] If it does not exceed the limit, it means that the file content in the file to be uploaded has been approved, and then the file to be uploaded matches the content list, and the subsequent storage steps can be performed. For example, for the file upload request with work order ID 654321, the file content parsed from the file to be uploaded is facial features and fingerprints, which does not exceed the range recorded in the content list, and the file to be uploaded can be determined to match the content list.

[0140] If it exceeds, it means that the file content of the file to be uploaded includes content that has not passed the approval, and then it is determined that the file to be uploaded does not match the content list, and a prompt message that the approved content does not match can be returned to the file client. For example, for the file upload request with work order ID 123456, the file content parsed from the file to be uploaded is the name and ID number, where the ID number is not recorded in the content list and has exceeded the range recorded in the content list. It can be determined that the file to be uploaded does not match the content list.

[0141] Step 314, when the file to be uploaded matches the content list, the file level specified by the corresponding file upload work order is obtained according to the work order identifier, and when the obtained file level belongs to the encryption level, the file to be uploaded is encrypted and the encrypted file to be uploaded is stored in the file server.

[0142] In this embodiment, based on the judgment result of the aforementioned step 312, when the file to be uploaded matches the content list, the file level specified by the corresponding file upload work order can be obtained according to the work order identifier to determine whether the file to be uploaded needs to be encrypted and stored.

[0143] Please continue to refer to the example in Table 2. Assuming that the work order ID carried in the file upload request received in the aforementioned step 302 is 654321, based on the mapping relationship shown in Table 2, the file proxy can obtain that its corresponding file level is confidential, and confidential belongs to the encryption level. The file proxy can first encrypt the file to be uploaded, and then send the encrypted file to be uploaded to the file server for storage.

[0144] Among them, whether each file level belongs to the encryption level can be preset, for example, confidentiality and secret belong to the encryption level, while internal data does not belong to the encryption level, etc. Of course, in actual implementation, the mapping relationship between the work order identifier and whether it is encrypted can also be directly saved, and this manual does not impose special restrictions on this.

[0145] In this embodiment, the file agent can encrypt the files to be uploaded that need to be encrypted, and then store the encrypted files to be uploaded on the file server, which solves the problem that the file server itself does not have encryption function and cannot encrypt the files it stores, and can better meet the strict requirements for file security in data governance scenarios.

[0146] In this embodiment, a file downloader who needs to download files from a file server can log in to his account to download the required files from the file server. Among them, the download authority of the file downloader can also be specified in the aforementioned file upload work order. Specifically, when initiating the file upload work order, the file uploader can fill in the file downloader who needs to download the corresponding file. After the file upload work order is approved, the download authority of the corresponding file can be granted to the file downloader account specified in the file upload work order. It can be seen from this that this manual can realize the control of the destination of files in the file server (i.e., the file downloader) on the basis of knowing and controlling the source of files, thereby clarifying the blood relationship of files (such as the source of files and the destination of files) and meeting data security requirements.

[0147] 3. Log Audit

[0148] In this embodiment, a log audit function is usually provided for file services. For example, an audit system can be deployed in a file server. Of course, the audit system can also be deployed independently, and this specification does not impose any special restrictions on this.

[0149] Figure 4 The present invention is a flowchart of a method for auditing a file service provided by an exemplary embodiment.

[0150] Please refer to Figure 4 The file service audit method can be applied to an audit system, and includes the following steps:

[0151] Step 402: Obtain from the file server a first type of file service log recorded in the file server.

[0152] In this embodiment, the audit system can obtain the file service log from the file server, which is referred to as the first type of file service log for easy distinction.

[0153] Step 404: Obtain from the file proxy the second type of file service log recorded in the file proxy.

[0154] In this embodiment, using the file management solution provided in the embodiment of this specification, the audit system can also obtain the file service log to be processed by the file agent from the file agent, which is called the second type of file service log. The second type of file service log may include information such as the connection method of the file client and the source of the file.

[0155] Step 406: Perform a file service audit based on the first type of file service log and the second type of file service log.

[0156] In this embodiment, the audit system can perform file service audit by combining the first type of file service log and the second type of file service log. Compared with related technologies, the audit system can obtain more and more comprehensive file service logs from the file agent, and thus obtain more detailed and accurate log audit results.

[0157] Among them, the log audit policy can be set by the developer based on the information included in the first type of file service log and the second type of file service log, for example, to review whether the source of the file is compliant, etc. This manual will not go into details here.

[0158] Figure 5 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 5At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, a memory 508, and a non-volatile memory 510, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 502 reading the corresponding computer program from the non-volatile memory 510 into the memory 508 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0159] Please refer to Figure 6 , the file management device can be applied to Figure 5 The device shown in the figure is used to implement the technical solution of this specification. The file management device 600 may include:

[0160] The request receiving unit 602 receives a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded;

[0161] A content acquisition unit 604 acquires a content list specified by a corresponding file upload work order according to the work order identifier;

[0162] The content matching unit 606 parses the file content of the file to be uploaded, and determines whether the file to be uploaded matches the content list according to the parsed file content;

[0163] The file storage unit 608 stores the file to be uploaded in the file server when the file to be uploaded matches the content list.

[0164] Optionally, the process in which the file storage unit 608 stores the file to be uploaded to the file server includes:

[0165] Obtaining the file level specified by the corresponding file upload work order according to the work order identifier;

[0166] In the case that the acquired file level belongs to the encryption level, the file to be uploaded is encrypted, and the encrypted file to be uploaded is stored in the file server.

[0167] Optionally, the file upload request also carries source information of the file to be uploaded, and before the content acquisition unit 604 acquires the content list specified by the corresponding file upload work order according to the work order identifier, it further includes:

[0168] Obtain the file source specified in the corresponding file upload work order according to the work order identifier;

[0169] Determining whether the source of the file to be uploaded is the same as the acquired specified file source according to the source information;

[0170] In the case where the source of the file to be uploaded is the same as the source of the specified file, a step of acquiring a content list specified by the corresponding file upload work order according to the work order identifier is performed.

[0171] Optionally, the process of parsing the file content of the to-be-uploaded file by the content matching unit 606 includes:

[0172] In the case where the designated file source is a synchronous task upload, a file content identifier is extracted from the file to be uploaded to implement parsing of the file content of the file to be uploaded;

[0173] In the case that the designated file source is application upload or manual upload, the file type of the file to be uploaded is determined, and the file content of the file to be uploaded is parsed using a parsing method that matches the file type.

[0174] Optionally, in the case where the designated file source is manually uploaded, the file upload request also carries a manually filled source annotation, and the following steps are required:

[0175] Determining whether the file to be uploaded is compliant according to the source annotation;

[0176] In the case that the file to be uploaded is compliant, the steps of determining the file type of the file to be uploaded and parsing the file content of the file to be uploaded using a parsing method matching the file type are performed.

[0177] Optionally, the process of judging whether the file to be uploaded is compliant according to the source annotation includes:

[0178] determining an annotation type of the source annotation;

[0179] In the case where the annotation type is a download process number, determining whether the download process number is a legal number, and in the case where the download process number is a legal number, determining that the file to be uploaded is compliant;

[0180] In the case where the annotation type is a custom annotation, the source annotation is transferred to manual judgment.

[0181] Optionally, the process in which the content matching unit 606 determines whether the file to be uploaded matches the content list according to the parsed file content includes:

[0182] Determining whether the file content exceeds the range recorded in the content list;

[0183] When the file content does not exceed the range, it is determined that the file to be uploaded matches the content list.

[0184] Optionally, before the content acquisition unit 604 acquires the content list specified by the corresponding file upload work order according to the work order identifier, it further includes:

[0185] Obtain the approved file upload work order from the work order approval system;

[0186] Obtaining a work order identifier and a content list from the file upload work order, and saving a mapping relationship between the work order identifier and the content list;

[0187] The process of obtaining the content list specified by the corresponding file upload work order according to the work order identifier includes:

[0188] The content list is searched in the mapping relationship according to the work order identifier.

[0189] Please refer to Figure 7 , the audit device of the file service can also be applied to Figure 5 The device shown in the figure is used to implement the technical solution of this specification. Among them, the audit device 700 of the file service may include:

[0190] A first log obtaining unit 702 obtains, from the file server, a first type of file service log recorded in the file server;

[0191] The second log acquisition unit 704 acquires the second type of file service log recorded in the file agent from the file agent;

[0192] A file service audit unit 706, which performs a file service audit based on the first type of file service log and the second type of file service log;

[0193] The file proxy is deployed between the file server and the file client, and executes the steps of each method in the aforementioned embodiments of this specification.

[0194] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.

[0195] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0196] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

Claims

1. A file management method, applied to a file proxy, wherein the file proxy is deployed between a file server and a file client, the method comprising: Receive a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded; Obtaining a content list specified by a corresponding file upload work order according to the work order identifier; Parsing the file content of the file to be uploaded, and judging whether the file to be uploaded matches the content list according to the parsed file content; When the file to be uploaded matches the content list, the file to be uploaded is stored in the file server.

2. According to the method of claim 1, the process of storing the file to be uploaded to the file server comprises: Obtaining the file level specified by the corresponding file upload work order according to the work order identifier; In the case that the acquired file level belongs to the encryption level, the file to be uploaded is encrypted, and the encrypted file to be uploaded is stored in the file server.

3. According to the method of claim 1, the file upload request also carries source information of the file to be uploaded, and before obtaining the content list specified by the corresponding file upload work order according to the work order identifier, the method further comprises: Obtain the file source specified in the corresponding file upload work order according to the work order identifier; Determining whether the source of the file to be uploaded is the same as the acquired specified file source according to the source information; In the case where the source of the file to be uploaded is the same as the source of the specified file, a step of acquiring a content list specified by the corresponding file upload work order according to the work order identifier is performed.

4. According to the method of claim 3, the process of parsing the file content of the file to be uploaded comprises: In the case where the designated file source is a synchronous task upload, a file content identifier is extracted from the file to be uploaded to implement parsing of the file content of the file to be uploaded; In the case that the designated file source is application upload or manual upload, the file type of the file to be uploaded is determined, and the file content of the file to be uploaded is parsed using a parsing method that matches the file type.

5. According to the method of claim 4, when the designated file source is manually uploaded, the file upload request also carries a manually filled source annotation, and the method further comprises: Determining whether the file to be uploaded is compliant according to the source annotation; In the case that the file to be uploaded is compliant, the steps of determining the file type of the file to be uploaded and parsing the file content of the file to be uploaded using a parsing method matching the file type are performed.

6. According to the method of claim 5, the process of judging whether the to-be-uploaded file is compliant according to the source annotation comprises: determining an annotation type of the source annotation; In the case where the annotation type is a download process number, determining whether the download process number is a legal number, and in the case where the download process number is a legal number, determining that the file to be uploaded is compliant; In the case where the annotation type is a custom annotation, the source annotation is transferred to manual judgment.

7. According to the method of claim 1, the process of judging whether the file to be uploaded matches the content list according to the parsed file content comprises: Determining whether the file content exceeds the range recorded in the content list; When the file content does not exceed the range, it is determined that the file to be uploaded matches the content list.

8. The method according to claim 1, before obtaining the content list specified by the corresponding file upload work order according to the work order identifier, the method further comprises: Obtain the approved file upload work order from the work order approval system; Obtaining a work order identifier and a content list from the file upload work order, and saving a mapping relationship between the work order identifier and the content list; The process of obtaining the content list specified by the corresponding file upload work order according to the work order identifier includes: The content list is searched in the mapping relationship according to the work order identifier.

9. An audit method for file services, applied to an audit system, comprising: Obtaining, from the file server, a first-category file service log recorded in the file server; Obtain the second type of file service log recorded in the file agent from the file agent; Performing a file service audit based on the first type of file service log and the second type of file service log; The file proxy is deployed between the file server and the file client, and executes the steps of the method as described in any one of claims 1-8.

10. A file management device, applied to a file agent, wherein the file agent is deployed between a file server and a file client, and the device comprises: A request receiving unit, receiving a file upload request sent by a file client, wherein the file upload request carries a work order identifier and a file to be uploaded; A content acquisition unit, which acquires a content list specified by a corresponding file upload work order according to the work order identifier; A content matching unit, which parses the file content of the file to be uploaded, and determines whether the file to be uploaded matches the content list according to the parsed file content; The file storage unit stores the file to be uploaded in the file server when the file to be uploaded matches the content list.

11. An audit device for file services, applied to an audit system, comprising: A first log acquisition unit, acquiring, from the file server, a first type of file service log recorded in the file server; A second log acquisition unit, which acquires, from the file agent, a second type of file service log recorded in the file agent; A file service audit unit, which performs a file service audit based on the first type of file service log and the second type of file service log; The file proxy is deployed between the file server and the file client, and executes the steps of the method as described in any one of claims 1-8.

12. An electronic device comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 9 by executing the executable instructions.

13. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 9.

14. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 9.

Images