Off-line data protection method and device and storage medium

Abstract

The invention relates to an off-line data protection method and device and a storage medium, and is applied to the technical field of off-line data protection.The method includes the steps that a safer SM4 encryption algorithm is adopted for file encryption, and exported Excel data is encrypted, compared with an existing symmetric encryption algorithm A, the SM4 encryption algorithm has higher safety and anti-cracking capacity, and the safety of the Excel data is improved; the key management is more strict, the key generated in the encryption process is mainly stored in an Excel hidden worksheet, table protection is set, the content is encrypted, and the risk of key leakage is reduced; when data export is carried out in an offline state, encryption processing is automatically carried out by triggering a specific event, an offline available encrypted Excel file is generated, different data access permissions are set through user roles and permission levels, and flexibility and safety of data access are ensured through permission verification and dynamic permission adjustment.

Description

Technical Field

[0001] The present invention relates to the technical field of offline data protection, and in particular to an offline data protection method, device and storage medium. Background Art

[0002] With the development of information technology, Excel has become an important tool for daily data processing and analysis in enterprises and organizations. However, once data is exported from the system to Excel, there are many objective shortcomings in management and control, which may lead to problems in data security, integrity and management efficiency.

[0003] The common encryption method in the prior art is the symmetric encryption algorithm A (such as AES), but its key distribution and storage are not secure, which can easily lead to key leakage, thereby exposing data to risks. Most of the prior art relies on encryption and permission management in an online environment and cannot effectively implement data protection in an offline state. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an offline data protection method, device and storage medium to solve the problem in the prior art that the distribution and storage of keys of common symmetric encryption algorithms are insecure, which easily leads to key leakage and thus puts data at risk, and the prior art relies on encryption and permission management in an online environment and cannot effectively implement data protection in an offline state.

[0005] According to a first aspect of an embodiment of the present invention, there is provided an offline data protection method, the method comprising:

[0006] Use standard library functions to implement the SM4 encryption algorithm and bind the encryption process to specific events, including file saving and file exporting;

[0007] Monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving;

[0008] Store the key generated by the encryption process in a hidden Excel worksheet, set table protection and encrypt the content;

[0009] Recording user information in the Excel hidden worksheet, the user information including: user account, user password and permission level, the user password being the key generated during the encryption process; encrypting the user information using an encryption algorithm, and implementing encrypted storage of the user information through a Cryptography object;

[0010] When any user accesses the encrypted worksheet, the user information is obtained, and the user information is compared with the user information recorded in the Excel hidden worksheet. If there is matching user information, the encrypted worksheet is unlocked; if there is no matching user information, all worksheets are locked and the system exits.

[0011] The user's permission level is obtained based on the user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

[0012] Preferably,

[0013] The encryption process is triggered by event-driven method, including:

[0014] If the file to be encrypted is cell data, the cell data is divided into blocks by row or column, each block is encrypted separately, and the encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext.

[0015] Preferably, it also includes:

[0016] Create a field in the Excel hidden worksheet to store the current access times and the maximum allowed times;

[0017] When any user accesses the encrypted worksheet, the Workbook_Open macro is used to automatically read the count. Each time the file is opened, the count is increased by one and the current access count of the Excel hidden worksheet is written back to determine whether the current access count exceeds the maximum allowed number of times. If so, all worksheets are locked and a message box is displayed to prompt.

[0018] Preferably, it also includes:

[0019] When the difference between the current access times and the maximum allowed times is within a preset difference range, a message box is displayed to prompt the remaining access times;

[0020] When the current access times reaches the maximum allowed times and all worksheets are locked, the administrator password recovery function is retained to ensure unique permission unlocking.

[0021] Preferably, it also includes:

[0022] Record the file creation date field and the effective date field in the Excel hidden worksheet;

[0023] When any user accesses an encrypted worksheet, the current time is read using a date function or the Workbook_Open macro, and the obtained current time is compared with the valid date field. If the current time exceeds the valid date field, the sensitive data is cleared or the file is re-encrypted, and an expiration prompt message is displayed;

[0024] When the encrypted worksheet expires, an administrator password unlocking function is provided, or the effective date field is updated through an external tool.

[0025] Preferably, it also includes:

[0026] When any user exports a worksheet or switches worksheets, watermark content is dynamically generated and stored in the Excel hidden worksheet. The Shapes.AddTextEffect method is used to add the watermark content to the worksheet as a semi-transparent text object or the watermark content is set as the background of the worksheet through PageSetup.CenterHeader.

[0027] According to a second aspect of an embodiment of the present invention, there is provided an offline data protection device, the device comprising:

[0028] Encryption module: used to implement encryption algorithms using standard library functions and bind encryption processes to specific events, including file saving and file exporting;

[0029] Encryption trigger module: used to monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving;

[0030] Key protection module: used to store the key generated by the encryption process in a hidden Excel worksheet, set table protection and encrypt the content;

[0031] Permission setting module: used to record user information in the Excel hidden worksheet, the user information includes: user account, user password and permission level, the user password is the key generated in the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object;

[0032] User information comparison module: used to obtain user information when any user accesses the encrypted worksheet, compare the user information with the user information recorded in the Excel hidden worksheet, and if there is matching user information, unlock the encrypted worksheet; if there is no matching user information, lock all worksheets and exit;

[0033] Permission determination module: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

[0034] According to a third aspect of an embodiment of the present invention, there is provided a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, each step in the above method is implemented.

[0035] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0036] This application encrypts the exported Excel data by using a more secure SM4 encryption algorithm to encrypt the file. Compared with the existing symmetric encryption algorithm A, the SM4 encryption algorithm has higher security and anti-cracking capabilities, and its key management is more stringent. It mainly stores the key generated by the encryption process in a hidden Excel worksheet, sets table protection and encrypts the content, reducing the risk of key leakage; when exporting data offline, encryption is automatically performed by triggering specific events, and an encrypted Excel file that can be used offline is generated. Different data access permissions are set by user roles and permission levels, and the flexibility and security of data access are ensured through permission verification and dynamic permission adjustment.

[0037] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0039] Figure 1 is a flowchart of an offline data protection method according to an exemplary embodiment;

[0040] Figure 2 is a system schematic diagram of an offline data protection device according to another exemplary embodiment;

[0041] In the attached figure: 1- encryption module, 2- encryption trigger module, 3- key protection module, 4- authority setting module, 5- user information comparison module, 6- authority determination module. DETAILED DESCRIPTION

[0042] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0043] Embodiment 1

[0044] Figure 1 is a flowchart of an offline data protection method according to an exemplary embodiment. Figure 1 As shown, the method includes:

[0045] S1, using standard library functions to implement the SM4 encryption algorithm, binding the encryption process to specific events, the specific events including file saving and file export;

[0046] S2, monitoring the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, triggering the encryption process through event driving;

[0047] S3, stores the key generated by the encryption process in a hidden Excel worksheet, sets table protection and encrypts the content;

[0048] S4, recording user information in the Excel hidden worksheet, the user information including: user account, user password and permission level, the user password being the key generated during the encryption process; encrypting the user information using an encryption algorithm, and implementing encrypted storage of the user information through a Cryptography object;

[0049] S5, when any user accesses the encrypted worksheet, the user information is obtained, and the user information is compared with the user information recorded in the Excel hidden worksheet. If there is matching user information, the encrypted worksheet is unlocked; if there is no matching user information, all worksheets are locked and the system exits;

[0050] S6, obtaining the user's permission level according to the user information, and when the user performs a file operation included in the permission level, modifying the worksheet according to the user's operation behavior; if the user performs a file operation not included in the permission level, the worksheet content is not changed;

[0051] It is understood that encryption of offline data includes:

[0052] Use standard library functions to implement encryption algorithms, such as SM4 (national commercial encryption algorithm), and process binary data through the ADODB.Stream module;

[0053] Trigger mechanism: Bind the encryption process to a specific event (such as Workbook_BeforeSave or Workbook_BeforeClose), monitor the user's file saving or exporting behavior, and trigger the encryption process through event-driven (such as OnFileExport) to ensure real-time encryption when the file is exported;

[0054] Block encryption: When reading cell data (i.e. the data to be encrypted is relatively large), it is divided into blocks by row or column, and each block is encrypted separately to prevent the problem of memory usage caused by too much data in the whole table. The encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext;

[0055] Key storage and protection: The key is stored in a hidden Excel worksheet, and the table protection (hidden and read-only attributes) is set and the content is encrypted; access must be unlocked with a user password;

[0056] This embodiment automatically performs encryption processing when exporting data, and generates an encrypted Excel file that can be used offline. Even when the file is disconnected from the online system, it can still maintain high-strength encryption protection.

[0057] Permission management:

[0058] Record the account number, password and permission level in a hidden worksheet, encrypt the information using an encryption algorithm (such as AES), and implement encrypted storage through the Cryptography object;

[0059] Permission verification:

[0060] When the file is opened, a verification window pops up through the Workbook_Open macro (based on UserForm design);

[0061] The account and password entered by the user are matched using the same encryption logic. If the verification succeeds, the file protection status is released; if it fails, all worksheets are locked and the file is exited.

[0062] Clearance Level:

[0063] Use hidden tags (such as cell comments or dedicated worksheets) to record permission levels, dynamically adjust user operation scopes (read-only, edit, export) based on permissions, and set password protection based on permissions;

[0064] Adjust permission levels in real time, for example, prohibit high-privilege users from arbitrarily reducing the permissions of other users;

[0065] This embodiment implements fine-grained permission control, supports setting different data access permissions based on user roles and permission levels, and ensures flexibility and security of data access through permission verification and dynamic permission adjustment.

[0066] Access limit:

[0067] Create fields in a hidden worksheet to store the current access count and the maximum allowed number of times to ensure that users cannot view them directly. Use the Workbook_Open macro to automatically read the count. Each time the file is opened, the count is increased by one and written back to the hidden table.

[0068] Dynamic verification:

[0069] When opening a file, first check whether the current count has exceeded the limit. If so, lock all worksheets and display a message box (such as using MsgBox to notify the user). After the file is locked, retain the administrator password recovery function to ensure unique permission unlocking;

[0070] Prompt mechanism:

[0071] When approaching the maximum number of accesses, a pop-up window will be displayed to remind you of the remaining available times;

[0072] When a user reaches access limits, the file is locked and a notification is sent to the administrator.

[0073] This embodiment prevents excessive access and abuse of data by limiting the number of times users access the encrypted Excel file;

[0074] Document validity period limit:

[0075] Hide the file creation date and validity period in the worksheet to ensure that they are not visible, and use date functions (such as Now()) to dynamically verify the current time;

[0076] Dynamic Validation:

[0077] When opening a file, the Workbook_Open macro is triggered to read the current time and compare it with the validity period field.

[0078] If it has expired, clear sensitive data (such as resetting cell content) or encrypt the file and display an expiration prompt message;

[0079] Recovery mechanism after file expiration:

[0080] Provide administrator password unlocking function, or update the validity period field through external tools;

[0081] Support notification function to remind users that files are about to expire;

[0082] This embodiment sets the effective use period of the file to ensure that the file automatically becomes invalid after the validity period has expired, thereby preventing long-term abuse and data leakage;

[0083] Watermark display:

[0084] Dynamically embed watermarks in files to enhance copyright protection and accountability.

[0085] Watermark generation:

[0086] By dynamically generating watermark content (such as user name, export time, etc.) and storing it in a hidden worksheet, use the Shapes.AddTextEffect method to add the watermark as a semi-transparent text object, or set the background watermark through PageSetup.CenterHeader.

[0087] Irremovability:

[0088] Set the watermark object to locked state, combined with worksheet protection, to prevent users from deleting the watermark;

[0089] The macro program detects deletion attempts and records tampering;

[0090] Dynamic display: trigger watermark redrawing in specific events (such as file opening or worksheet switching) to ensure that it is always visible;

[0091] The watermark information is synchronized with the server records to track the file users;

[0092] This embodiment adds a watermark to the Excel file to display important copyright information and user information, thereby preventing data leakage and illegal dissemination.

[0093] Embodiment 2

[0094] Figure 2 is a system schematic diagram of an offline data protection device according to another exemplary embodiment, the device comprising:

[0095] Encryption module 1: used to implement encryption algorithm using standard library functions and bind encryption process to specific events, including file saving and file exporting;

[0096] Encryption trigger module 2: used to monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving;

[0097] Key protection module 3: used to store the key generated by the encryption process in a hidden Excel worksheet, set table protection and encrypt the content;

[0098] Permission setting module 4: used to record user information in the Excel hidden worksheet, the user information includes: user account, user password and permission level, the user password is the key generated in the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object;

[0099] User information comparison module 5: used for obtaining user information when any user accesses the encrypted worksheet, comparing the user information with the user information recorded in the Excel hidden worksheet, and unlocking the encrypted worksheet if there is matching user information; if there is no matching user information, locking all worksheets and exiting;

[0100] Permission determination module 6: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

[0101] Embodiment three:

[0102] This embodiment provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, each step in the above method is implemented;

[0103] It is understandable that the storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0104] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0105] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0106] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0107] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0108] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0109] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0110] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0111] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0112] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. An offline data protection method, characterized in that: The method comprises: Use standard library functions to implement the SM4 encryption algorithm and bind the encryption process to specific events, including file saving and file exporting; Monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving; Store the key generated by the encryption process in a hidden Excel worksheet, set table protection and encrypt the content; Recording user information in the Excel hidden worksheet, the user information including: user account, user password and permission level, the user password being the key generated during the encryption process; encrypting the user information using an encryption algorithm, and implementing encrypted storage of the user information through a Cryptography object; When any user accesses the encrypted worksheet, the user information is obtained, and the user information is compared with the user information recorded in the Excel hidden worksheet. If there is matching user information, the encrypted worksheet is unlocked; if there is no matching user information, all worksheets are locked and the system exits. The user's permission level is obtained based on the user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

2. The method according to claim 1, characterized in that: The encryption process is triggered by event-driven method, including: If the file to be encrypted is cell data, the cell data is divided into blocks by row or column, each block is encrypted separately, and the encrypted data is stored back to the original location or written into a new worksheet to isolate the plaintext.

3. The method according to claim 2, characterized in that Also includes: Create a field in the Excel hidden worksheet to store the current access times and the maximum allowed times; When any user accesses the encrypted worksheet, the Workbook_Open macro is used to automatically read the count. Each time the file is opened, the count is increased by one and the current access count of the Excel hidden worksheet is written back to determine whether the current access count exceeds the maximum allowed number of times. If so, all worksheets are locked and a message box is displayed to prompt.

4. The method according to claim 3, characterized in that: Also includes: When the difference between the current access times and the maximum allowed times is within a preset difference range, a message box is displayed to prompt the remaining access times; When the current access times reaches the maximum allowed times and all worksheets are locked, the administrator password recovery function is retained to ensure unique permission unlocking.

5. The method according to claim 4, characterized in that Also includes: Record the file creation date field and the effective date field in the Excel hidden worksheet; When any user accesses an encrypted worksheet, the current time is read using a date function or the Workbook_Open macro, and the obtained current time is compared with the valid date field. If the current time exceeds the valid date field, the sensitive data is cleared or the file is re-encrypted, and an expiration prompt message is displayed; When the encrypted worksheet expires, an administrator password unlocking function is provided, or the effective date field is updated through an external tool.

6. The method according to claim 5, characterized in that Also includes: When any user exports a worksheet or switches worksheets, watermark content is dynamically generated and stored in the Excel hidden worksheet. The Shapes.AddTextEffect method is used to add the watermark content to the worksheet as a semi-transparent text object or the watermark content is set as the background of the worksheet through PageSetup.CenterHeader.

7. An offline data protection device, characterized in that: The device comprises: Encryption module: used to implement encryption algorithms using standard library functions and bind encryption processes to specific events, including file saving and file exporting; Encryption trigger module: used to monitor the user's file saving or file exporting behavior, and when monitoring any user's file saving or file exporting specific events, trigger the encryption process through event driving; Key protection module: used to store the key generated by the encryption process in a hidden Excel worksheet, set table protection and encrypt the content; Permission setting module: used to record user information in the Excel hidden worksheet, the user information includes: user account, user password and permission level, the user password is the key generated in the encryption process; encrypt the user information using an encryption algorithm, and implement encrypted storage of the user information through a Cryptography object; User information comparison module: used to obtain user information when any user accesses the encrypted worksheet, compare the user information with the user information recorded in the Excel hidden worksheet, and if there is matching user information, unlock the encrypted worksheet; if there is no matching user information, lock all worksheets and exit; Permission determination module: used to obtain the user's permission level based on user information. When the user performs a file operation included in the permission level, the worksheet is modified according to the user's operation behavior. If the user performs a file operation not included in the permission level, the worksheet content does not change.

8. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the host controller, each step in the offline data protection method according to any one of claims 1 to 6 is implemented.

Images