Data leakage prevention method

Abstract

The invention discloses a data leakage prevention method, which comprises the following specific steps of: S1, packaging a file by adopting a packaging program through a file distribution unit, and packaging a decryption program in the file at the same time; and S2, extracting the encrypted file, and detecting a computer for extracting the file through a decryption program during file extraction. The method has the advantages that the decryption program and the data file are packaged at the same time, so that a computer using data can realize self-protection without installing any program; a secret key is automatically generated during data encapsulation, and after secret-related data producers complete production of data needing to be transmitted, the secret key is informed to a transmitter, so that the problem of transmission mark leaving is effectively solved; when the medium storing the secret-related data is lost, the stored data can be self-protected, and the leakage of the secret-related data is effectively prevented, so that the responsibility of data file loss personnel is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data anti-disclosure, and particularly relates to a data anti-disclosure method. Background Art

[0002] In actual work scenarios, data information exchange is a common means for government agencies, enterprises and institutions. Currently, the classified information in the burning process is stored in plain text. When it is lost, the classified information can be directly opened on any computer, posing a significant risk of data leakage.

[0003] At present, the protection software on the market requires the installation of protection software on both the burning computer side and the opening computer side to achieve the protection effect. Due to the large randomness and wide spread of transmission, computers without the installed protection software cannot open the files, resulting in difficulties in work, making the burning personnel reluctant to use the protection software, thus leaving the data unprotected and failing to achieve the real protection effect. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a data anti-disclosure method that can effectively prevent the leakage of classified data.

[0005] To solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A data anti-disclosure method includes the following specific steps:

[0007] Step S1: The file distribution unit encapsulates the file using an encapsulation program and simultaneously encapsulates the decryption program in the file;

[0008] Step S2: Extract the encrypted file. When extracting the file, the decryption program detects the computer that extracts the file. The specific detection steps are as follows:

[0009] Step S21: Detect whether it is connected to the Internet; if the decryption program detects that the computer can be connected to the Internet, the file cannot be decrypted and an alarm is immediately triggered, and the alarm information is sent to the alarm information management platform. If the decryption program finds that the computer cannot be connected to the Internet, proceed to the next step;

[0010] Step S22: Detect whether it complies with the confidentiality regulations; when the decryption program detects that the computer does not comply with the confidentiality regulations, the file cannot be decrypted and a warning message is immediately displayed on the computer screen. If the decryption program detects that the computer complies with the confidentiality regulations, proceed to the next step;

[0011] Step S23: Input the secret key and save the file; after the secret key is input normally in the decryption program, the file can be automatically decrypted and saved to the computer.

[0012] Furthermore, in step S1, before the file is packaged, the packaging program needs to verify the identity to confirm that the identity is legitimate.

[0013] Furthermore, in step S1, the encapsulation program encrypts the file when encapsulating the file and generates an extraction key.

[0014] Furthermore, the file encryption method adopts the SM4.0 block cipher algorithm.

[0015] Furthermore, in step S1, the encapsulation program records the operation log when the file encapsulation is completed.

[0016] Furthermore, the alarm information in step S21 includes the file distribution unit, the receiving unit, and the identity of the illegal computer.

[0017] Furthermore, in step S21, the alarm front-end server may push the alarm information to the subscribing unit and copy it to the alarm information management platform.

[0018] Furthermore, the step S2 will also perform a system check on the computer. If it is a Tongxin UOS system, Kylin system or Windows system, the file will be checked for access to the Internet in step S21. Otherwise, the decryption tool will be directly exited and a warning message will be displayed on the computer screen.

[0019] Furthermore, in the step S1, the file is encrypted when it is encapsulated, a key is randomly generated before the file is encrypted, the generated key is used to encrypt the file, and the key is used to decrypt it in step S23.

[0020] Beneficial effects of the present invention:

[0021] (1) By encapsulating the decryption program and the data file at the same time, the computer using the data can achieve self-protection without installing any program;

[0022] (2) When encapsulating data, a key is automatically generated. After the confidential data producer has produced the data to be transmitted, the key will be informed to the transmitter, effectively solving the problem of leaving traces during transmission. When the medium storing confidential data is lost, the stored data can protect itself, effectively preventing confidential data leakage, thereby reducing the responsibility of the person who lost the data file.

[0023] (3) The system automatically encrypts data according to the SM4.0 standard and automatically generates keys, without the need for manual operation, which is simple and fast. DETAILED DESCRIPTION

[0024] The following further describes the specific embodiments of the present invention. It should be noted here that the description of these embodiments is used to help understand the present invention, but does not limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0025] Embodiment 1

[0026] A data anti-disclosure method includes the following specific steps:

[0027] Step S1: The file distribution unit encapsulates the file using an encapsulation program and simultaneously encapsulates the decryption program in the file; the decryption program and the data file are encapsulated simultaneously, enabling the computer using the data to achieve self-protection without installing any programs.

[0028] Step S2: Extraction of the encrypted file. When the file is extracted, the decryption program detects the computer from which the file is extracted. The specific detection steps are as follows:

[0029] Step S21: Detection of whether it is connected to the Internet; if the decryption program detects that the computer can be connected to the Internet, the file cannot be decrypted and an alarm is immediately triggered, and the alarm information is sent to the alarm front-end server. If the decryption program finds that the computer cannot be connected to the Internet, the next step is performed;

[0030] Step S22: Detection of whether it complies with the confidentiality regulations; when the decryption program detects that the computer does not comply with the confidentiality regulations, the file cannot be decrypted and a warning message is immediately displayed on the computer screen. If the decryption program detects that the computer complies with the confidentiality regulations, the next step is performed;

[0031] Step S23: Secret key input and file saving; enter the extraction key in the decryption program. After the key is input normally, the file can be automatically decrypted and saved to the computer.

[0032] Before encapsulating the file in Step S1, the encapsulation program needs to verify the identity and confirm that the identity is legal.

[0033] In Step S1, when the encapsulation program encapsulates the file, it encrypts the file and generates an extraction key. The key is automatically generated when encapsulating the data. After the person making the confidential data finishes making the data to be transmitted, the key is informed to the transmitter, effectively solving the problem of transmission traceability; when the medium storing the confidential data is lost, the stored data can self-protect, effectively preventing the leakage of confidential data, thereby reducing the responsibility of the person who lost the data file.

[0034] The file encryption method uses the SM4.0 block cipher algorithm. The SM4.0 block cipher algorithm automatically generates the key without manual operation, which is simple and fast.

[0035] In step S1, the encapsulation program records the operation log when the file encapsulation is completed. Recording the operation log can facilitate data tracing.

[0036] The alarm information in step S21 includes the file distribution unit, the receiving unit, the identity of the illegal computer, and the creation time.

[0037] In step S21, the alarm front-end server can push the alarm information to the subscribing unit and copy the alarm information management platform so that the subscribing unit and the alarm information management platform can obtain the file loss information in time, effectively assisting the confidentiality management department in tracing the source.

[0038] Step S2 will also perform a system check on the computer. If it is Tongxin UOS system, Kylin system or Windows system, the file will be checked for Internet access in step S21. Otherwise, the decryption tool will be directly exited and a warning message will be displayed on the computer screen. Testing the system can further improve the security of the file.

[0039] In step S1, the file is encrypted when it is encapsulated. Before the file is encrypted, a key is randomly generated, the file is encrypted using the generated key, and the key is used for decryption in step S23.

[0040] The storage data encapsulated by the present invention can automatically determine the operating environment, automatically take different coping measures according to different operating environments, have no special requirements for the computer using the medium, and truly achieve "self-protection".

[0041] The embodiments of the present invention are described in detail above, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments are made without departing from the principles and spirit of the present invention, and still fall within the protection scope of the present invention.

Claims

1. A data leakage prevention method, characterized in that: The specific steps include: Step S1, a file distribution unit encapsulates the file using an encapsulation program, and encapsulates the decryption program in the file at the same time; Step S2, extracting the encrypted file. When extracting the file, the computer that extracts the file is tested through the decryption program. The specific steps of the test are as follows: Step S21, whether to connect to the Internet; if the decryption program detects that the computer can connect to the Internet, it cannot decrypt the file and immediately triggers an alarm, and sends the alarm information to the alarm front-end server. If the decryption program finds that the computer cannot connect to the Internet, it proceeds to the next step; Step S22, whether it complies with the confidentiality regulations; if the decryption program detects that the computer does not comply with the confidentiality regulations, it cannot decrypt the file and immediately displays a warning message on the computer screen. If the decryption program detects that the computer complies with the confidentiality regulations, it proceeds to the next step; Step S23, key input and file saving: Enter the extraction key in the decryption program. After the key input is normal, the file can be automatically decrypted and saved to the computer.

2. The data leakage prevention method according to claim 1, characterized in that: In the step S1, before the file is packaged, the packaging program needs to verify the identity to confirm that the identity is legitimate.

3. The data leakage prevention method according to claim 1, characterized in that: In step S1, the encapsulation program encrypts the file when encapsulating the file and generates an extraction key.

4. The data leakage prevention method according to claim 3, characterized in that: The file encryption method uses the SM4.0 block cipher algorithm.

5. The data leakage prevention method according to claim 1, characterized in that: In step S1, the encapsulation program records the operation log when the file encapsulation is completed.

6. The data leakage prevention method according to claim 1, characterized in that: The alarm information in step S21 includes the file distribution unit, the receiving unit, the identity of the illegal computer, and the creation time.

7. The data leakage prevention method according to claim 1, characterized in that: In step S21, the alarm front-end server can push the alarm information to the subscribing unit and copy the alarm information management platform so that the subscribing unit and the alarm information management platform can obtain the file loss information in time.

8. The data leakage prevention method according to any one of claims 1 to 7, characterized in that: The step S2 will also perform a system check on the computer. If it is a Tongxin UOS system, Kylin system or Windows system, the file will proceed to step S21 to check whether it is connected to the Internet. Otherwise, the decryption tool will be exited directly and a warning message will be displayed on the computer screen.

9. The data leakage prevention method according to any one of claims 1 to 7, characterized in that: In the step S1, the file is encrypted when it is encapsulated, a key is randomly generated before the file is encrypted, the generated key is used to encrypt the file, and the key is used to decrypt it in step S23.