Data leakage protection method and data security protection method

Abstract

The invention discloses a data leakage protection method, a data security protection method, devices corresponding to the methods, and electronic equipment. According to the data leakage protection method, an application starting event is monitored, and applications comprise applications based on a browser kernel; if the starting event is monitored, a client device is injected into a user interface U I process of the application; the client device injects a script into a page obtained by the U I process; the rendering process of the application renders the page injected with the script; and the script modifies the operation options causing data leakage in the page into invalid operation options. By adopting the processing mode, page element-level data leakage protection is realized, and a user can acquire information from the page at the same time; therefore, data leakage protection and information acquisition from the Internet can be effectively considered.

Description

Technical Field

[0001] This application relates to the field of data security technology, specifically to data leakage prevention methods and devices, data security protection methods and devices, a toolkit, a system, and electronic devices. Background Technology

[0002] In practice, employees' office equipment often contains a large amount of internal information, such as work documents and application data. If employees send this internal information to external networks, various risks will arise. To prevent employees from leaking internal information, internal security policies can be implemented. Currently, a typical security strategy is to use domain filtering and other methods at the gateway layer to prohibit employees from accessing websites that could lead to data leaks, such as cloud storage websites.

[0003] However, the inventors of this application have found that the existing solutions have at least the following problems: employees are prohibited from uploading files to the Internet and are also prohibited from downloading files from the Internet, which makes many useful files on the Internet unusable and reduces office efficiency. Summary of the Invention

[0004] This application provides a data leakage prevention method and apparatus to address the problem that existing technologies cannot simultaneously address data leakage prevention and information acquisition from the Internet. This application also provides a data security protection method and apparatus to address the problem that existing technologies cannot simultaneously address data security protection and information acquisition from the Internet. This application further provides a toolkit and system, as well as electronic equipment.

[0005] This application provides a data leakage prevention method, including:

[0006] Monitor application launch events, including browser-based applications;

[0007] If the launch event is detected, the client device is injected into the application's user interface (UI) process;

[0008] The client device injects scripts into the page obtained by the UI process;

[0009] The application's rendering process renders the page into which the script is injected;

[0010] The script modifies the operation options on the page that could lead to data leakage into invalid operation options.

[0011] Optional, also includes:

[0012] Start the service device;

[0013] The monitoring application startup event includes:

[0014] The service device monitors the application launch event.

[0015] Optional, also includes:

[0016] The UI process sends page access requests to the server via a network process;

[0017] The network process sends the page returned by the server to the UI process;

[0018] The client device determines that the UI process has obtained the page based on the communication content between the UI process and the network process.

[0019] Optional, also includes:

[0020] The UI process obtains the page content and content length after the script is injected, and provides the page content and content length to the rendering process.

[0021] The rendering process renders the page into which the script is injected, including:

[0022] The rendering process renders the page into which the script is injected, based on the page content and its length.

[0023] Optional, also includes:

[0024] The script detects whether the page contains sensitive content;

[0025] The script modifies the operation options on the page that could lead to data leakage into invalid operation options, including:

[0026] If the script detects that the page contains sensitive content, it will modify the operation option to an invalid operation option.

[0027] Optionally, the script determines whether the page contains sensitive content, including:

[0028] The script determines whether the page contains sensitive content based on preset sensitive content or sensitive content identification rules.

[0029] Optional, also includes:

[0030] The client device recorded sensitive data and leaked operational information.

[0031] Optionally, the client device injects a data leakage prevention script into the page obtained by the UI process, including:

[0032] The client device obtains the script corresponding to the page based on the correspondence between the page URL and the script. The location method of the operation options is different on different pages.

[0033] The corresponding script is injected into the page, and the script locates the operation option according to the design of the operation option.

[0034] Optionally, modifying the operation options on the page that lead to data leakage into invalid operation options can be done in one of the following ways:

[0035] Delete the operation option;

[0036] Set the operation option to be inoperable;

[0037] After capturing the operation event of the operation option, an alarm message is displayed, and the operation option is set to be inoperable.

[0038] Optional, also includes:

[0039] Obtain at least one of the following configuration information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts;

[0040] The script modifies the operation options on the page that could lead to data leakage into invalid operation options based on the configuration information.

[0041] This application also provides a data security protection method, including:

[0042] Monitor application launch events, including browser-based applications;

[0043] If the launch event is detected, inject the client device into the application's user interface (UI) process;

[0044] The client device injects scripts into the page obtained by the UI process;

[0045] The application's rendering process renders the page into which the script is injected;

[0046] The script detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

[0047] Optional, also includes:

[0048] Obtain rules for identifying risky content;

[0049] The script determines whether the page contains the risky content based on the identification rules.

[0050] This application also provides a data security protection method, including:

[0051] Monitor the startup events of instant messaging tools;

[0052] If the startup event is detected, the client device is injected into the user interface (UI) process of the instant messaging tool;

[0053] The client device injects a script into the chat page obtained by the UI process;

[0054] The rendering process of the instant messaging tool renders the chat page into which the script is injected;

[0055] The script detects whether the received messages on the chat page contain risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

[0056] This application also provides a data security protection method, including:

[0057] Monitor browser startup events;

[0058] If the startup event is detected, the client device is injected into the browser's user interface (UI) process;

[0059] The client device injects a script into the webpage obtained by the UI process;

[0060] The browser's rendering process renders the webpage into which the script is injected;

[0061] The script detects whether the webpage contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

[0062] This application also provides a data breach prevention method, including:

[0063] Monitor browser startup events;

[0064] If the startup event is detected, the client device is injected into the browser's user interface (UI) process;

[0065] The client device injects scripts into the page obtained by the UI process;

[0066] The browser's rendering process renders the page into which the script is injected;

[0067] The script modifies the operation options on the page that could lead to data leakage into invalid operation options.

[0068] Optionally, the page includes a cloud storage page;

[0069] The script modifies the file upload option on the cloud drive page to an invalid option.

[0070] Optionally, the page includes a compose email page;

[0071] The script modifies the upload attachment option in the email compose page to an invalid option.

[0072] Optionally, the page includes a compose email page;

[0073] The script determines whether the email compose page contains sensitive content;

[0074] If the script determines that the compose email page contains sensitive content, it will modify the send email operation option on the compose email page to an invalid operation option.

[0075] Optionally, the page includes a forum posting page;

[0076] The script determines whether the forum posting page contains sensitive content;

[0077] If the script determines that the forum posting page contains sensitive content, it will modify the send email option on the forum posting page to an invalid option.

[0078] Optionally, the page includes a chat page;

[0079] The script modifies the file upload option on the chat page to an invalid option.

[0080] Optional pages include chat pages;

[0081] The script determines whether the chat page contains sensitive content;

[0082] If the script determines that the chat page contains sensitive content, it will modify the send operation option in the chat page to an invalid operation option.

[0083] This application also provides a data breach prevention method, including:

[0084] Monitor cloud storage client startup events;

[0085] If the startup event is detected, the client device is injected into the user interface (UI) process of the cloud storage client;

[0086] The client device injects a script into the cloud storage page obtained by the UI process;

[0087] The browser's rendering process renders the cloud storage page into which the script is injected;

[0088] The script modifies the file upload option on the cloud drive page to an invalid option.

[0089] This application also provides a data breach prevention method, including:

[0090] Monitor the startup events of instant messaging tools;

[0091] If the startup event is detected, the client device is injected into the user interface (UI) process of the instant messaging tool;

[0092] The client device injects a script into the chat page obtained by the UI process;

[0093] The browser's rendering process renders the chat page into which the script is injected;

[0094] The script modifies the operation options in the chat page that could lead to data leakage into invalid operation options.

[0095] This application also provides an information configuration method, including:

[0096] Set at least one of the following: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts, for use in the above data leakage prevention methods;

[0097] Alternatively, rules for identifying potentially risky content can be set up for use in the aforementioned data security protection methods.

[0098] This application also provides a data breach protection device, including:

[0099] A monitoring unit is used to monitor application launch events, including applications based on a browser kernel.

[0100] A client device injection unit is used to inject a client device into the user interface (UI) process of the application if the startup event is detected.

[0101] A script injection unit is used to inject scripts from the client device into the page obtained by the UI process.

[0102] A page rendering unit is used by the application's rendering process to render the page into which the script is injected.

[0103] An operation option modification unit is used by the script to modify operation options on the page that cause data leakage into invalid operation options.

[0104] This application also provides a data security protection device, including:

[0105] A monitoring unit is used to monitor application launch events, including applications based on a browser kernel.

[0106] A client device injection unit is used to inject a client device into the user interface (UI) process of the application if the startup event is detected.

[0107] A script injection unit is used to inject scripts from the client device into the page obtained by the UI process.

[0108] A page rendering unit is used by the application's rendering process to render the page into which the script is injected.

[0109] A risk detection unit is used by the script to detect whether the page contains risky content;

[0110] The risk handling unit is used to display an alarm message and / or prohibit operation of the risky content if the page is detected to contain risky content.

[0111] This application also provides a toolkit, including:

[0112] A service module is used to monitor application startup events, including applications based on a browser kernel; if the startup event is detected, a client device is injected into the application's user interface (UI) process.

[0113] The client module is used to inject scripts into the page obtained by the UI process, the scripts including at least one of the following processes:

[0114] Modify the operation options on the page that lead to data leakage to invalid operation options;

[0115] The system detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

[0116] This application also provides a system, including:

[0117] A service device is used to monitor application launch events, including applications based on a browser kernel; if the launch event is detected, a client device is injected into the user interface (UI) process of the application.

[0118] A client device is configured to inject a script into a page obtained by the UI process, the script comprising at least one of the following processes:

[0119] Modify the operation options on the page that lead to data leakage to invalid operation options;

[0120] The system detects whether the page contains risky content; if the result is yes, it displays an alarm message and / or prohibits operation on the risky content.

[0121] This application also provides an electronic device, including: a processor; and a memory for storing a program for implementing the method according to any one of the preceding claims, wherein the device is powered on and the program for running the method via the processor.

[0122] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the various methods described above.

[0123] This application also provides a computer program product including instructions that, when run on a computer, cause the computer to perform the various methods described above.

[0124] Compared with the prior art, this application has the following advantages:

[0125] The data leakage prevention method provided in this application embodiment monitors application startup events, including applications based on browser kernels. If the startup event is detected, a client device is injected into the application's user interface (UI) process. The client device then injects a script into a page obtained by the UI process. The application's rendering process renders the page with the injected script. The script modifies operation options on the page that could lead to data leakage into invalid operation options. This approach achieves page element-level data leakage prevention while allowing users to simultaneously access information from the page; therefore, it effectively balances data leakage prevention and information access from the internet.

[0126] The data security protection method provided in this application embodiment monitors application startup events, including applications based on browser kernels. If the startup event is detected, a client device is injected into the application's user interface (UI) process. The client device then injects a script into a page obtained by the UI process. The application's rendering process renders the page with the injected script. The script detects whether the page contains risky content. If risky content is detected, an alarm message is displayed and / or operation on the risky content is prohibited. This approach achieves page content-level data security protection while allowing users to simultaneously access information from the page; therefore, it effectively balances data security protection and information access from the internet. Attached Figure Description

[0127] Figure 1 A flowchart illustrating an embodiment of the data leakage prevention method provided in this application;

[0128] Figure 2A detailed flowchart illustrating an embodiment of the data leakage prevention method provided in this application;

[0129] Figure 3 This application provides an illustration of an application scenario for the data leakage prevention method.

[0130] Figure 4 A flowchart illustrating an embodiment of the data security protection method provided in this application. Detailed Implementation

[0131] Many specific details are set forth in the following description to provide a full understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application; therefore, this application is not limited to the specific embodiments disclosed below.

[0132] This application provides image processing methods, apparatus, and systems, as well as electronic devices. The various solutions are described in detail below in each embodiment.

[0133] It should be noted that the embodiments of this application may involve the use of user data. In practical applications, user-specific personal data may be used in the scheme described herein within the scope permitted by applicable laws and regulations, provided that it complies with the applicable laws and regulations of the country (e.g., with the user's explicit consent, with the user being properly notified, etc.).

[0134] First Embodiment

[0135] Please refer to Figure 1 This is a flowchart of the data leakage prevention method of this application. In this embodiment, the method may include the following steps:

[0136] Step S101: Monitor application launch events, where the application includes applications based on a browser kernel.

[0137] The execution subject of the method provided in this application embodiment includes, but is not limited to, terminal devices, and may also be devices such as servers. The terminal device may be a personal computer, laptop, smartphone, tablet, etc. The method provided in this application embodiment will be described below using an office terminal device as an example.

[0138] In this embodiment, the terminal device can monitor the startup event of applications based on a browser kernel. After the browser kernel starts, the corresponding processes include a user interface (UI) process, a network process, and a rendering process. In specific implementations, the browser kernel can be the Chromium browser kernel or other browser kernels, as long as it includes a UI process and a rendering process.

[0139] In practical applications, browser-based applications include, but are not limited to: browsers, cloud storage clients, instant messaging tools, and so on. After a browser-based application starts, its corresponding processes include a UI process and a rendering process, and may also include a network process.

[0140] In one example, the method provided in this application embodiment further includes the following step: starting a service device; step S101 can be implemented as follows: monitoring the application startup event through the service device. Specifically, the service device can be used as an automatic startup item for the terminal device, so that the service device starts automatically when the terminal device starts, or the user can manually start the service device as needed. After the service device is started in the terminal device, the thread corresponding to the service device is a service process, which monitors the startup event of applications based on the browser kernel. This method of monitoring application startup events through a service device eliminates the need to modify the terminal device's operating system; therefore, it can effectively ensure the stability of device operation.

[0141] Step S103: If the startup event is detected, inject the client device into the application's user interface (UI) process.

[0142] In this embodiment, after the service device detects the launch event of a browser kernel-based application, it injects a client device, also known as a client module in the UI process, into the UI process of that launched application. The terminal device can launch multiple browser kernel-based applications, and the service device will inject a client device into the UI process of each of these applications.

[0143] Step S105: The client device injects a script into the page obtained by the UI process.

[0144] After the UI process receives the page to be displayed, before handing it over to the rendering process, it injects a script into the page through the client device. This means modifying the page content by writing a pre-written script into the page, which includes code to prevent data leakage. Scripting languages ​​include, but are not limited to, JavaScript.

[0145] In one example, the client device can identify the behavior of the UI process obtaining the page, and after the client device discovers that the UI process has obtained the page, it injects a script into the page.

[0146] In practical applications, the process of a browser-based application displaying a webpage is as follows: the UI process sends a page access request to the server via the network process; the network process sends the page returned by the server to the UI process; the UI process sends the page content and content length to the rendering process; and the rendering process renders the page based on the page content and content length. The client device can determine whether the UI process has obtained the page based on the communication content between the UI process and the network process.

[0147] In practice, the client device can focus on (e.g., hook) the application programming interface (API) used to obtain the page. The parameters of this API include the communication content between the UI process and the network process, thereby determining whether the UI process has obtained the page.

[0148] In practical applications, the design of operation options that could lead to data leaks can be the same or different across pages on different websites. For example, the ID and style of the file upload button on cloud storage A and cloud storage B may be different. If pages on different websites have different designs for operation options that could lead to data leaks, and you want to disable these operation options using scripts, you need to write different scripts for each website's pages. Each script should locate these operation options based on the design of the data leak-causing operation options on its corresponding website page.

[0149] In practical applications, all pages within the same website that have operation options that could lead to the leakage of sensitive data often adopt the same design approach. Therefore, client devices can inject the same scripts into all pages within the same website, and these scripts use the same method to locate such operation options.

[0150] In one example, step S105 can be implemented as follows: the client device obtains the script corresponding to the page based on the correspondence between the page URL and the script; the corresponding script is injected into the page, and the script locates the operation option based on the design of the operation option. This approach allows pages at different URLs to locate such operation options based on the characteristics of the operation options that could lead to data leakage through different scripts, thereby expanding the range of pages to which this solution can be applied.

[0151] Step S105: The application's rendering process renders the page into which the script is injected.

[0152] The UI process initially obtains the original page content, and the client device injects a script into this original content. The rendering process renders the page based on the page content and page length. In this embodiment, the method may further include the following steps: the UI process obtains the page content and content length after the script is injected, and provides the page content and content length to the rendering process; the rendering process renders the page with the injected script based on the page content and content length, so that the rendered page includes the script.

[0153] Step S107: The script modifies the operation options on the page that cause data leakage into invalid operation options.

[0154] Applications based on the browser kernel display the injected script on the page. The script disables operation options on the page that could lead to data leakage, thus preventing the leakage of sensitive internal data through the page.

[0155] In specific implementation, step S107 can be implemented in one of the following ways: 1) Delete the operation option so that the operation option is not included on the page; 2) Set the operation option to be inoperable, such as setting the file upload button to an inoperable state; 3) After capturing the operation event of the operation option, display alarm information, and then set the operation option to be inoperable. For example, the page normally displays the file upload button, but when the script captures the click event of the button, it will first display alarm information prohibiting file upload, such as a pop-up or directly displaying alarm information on the page, and then set the upload file button to an inoperable state.

[0156] Please refer to Figure 2 This is a flowchart illustrating the data leakage prevention method of this application. In one example, the method provided in this embodiment may further include the following step S201 before step S107: the script detects whether the page contains sensitive content; correspondingly, step S107 can be implemented as follows: if the script detects that the page contains sensitive content, it modifies the operation option to an invalid operation option. This approach ensures that the operation option is only modified to an invalid operation option when sensitive content is detected on the page; for non-sensitive content, the page functions can be used normally, thus achieving page element-level data leakage prevention based on sensitive content screening.

[0157] There are various ways a page can contain sensitive content, such as text containing sensitive content, images containing sensitive content, videos containing sensitive content, files containing sensitive content, or links to pages containing sensitive content. Scripts injected into the page can individually detect whether various page elements contain sensitive content and will modify the options for sending outgoing messages containing such sensitive content to invalid options.

[0158] In one example, the script detects whether the page contains sensitive content, which can be achieved in the following way: the script detects whether the page contains sensitive content based on preset sensitive content or sensitive content identification rules.

[0159] The preset sensitive content is specific content, such as "Alibaba". If the script detects that the content to be sent contains the words "Alibaba" or text with the same or similar meaning as "Alibaba", it can determine that the page contains sensitive content.

[0160] Sensitive content identification rules can be prefixes or suffixes in filenames, specified text included in file titles, and so on. In practice, sensitive content identification rules can be set according to application requirements; this application does not limit the specific form of sensitive content identification rules.

[0161] In one example, the method provided in this application embodiment may further include the following steps: obtaining at least one of the following configuration information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts; the script, based on the configuration information, modifies the operation options in the page that lead to data leakage into invalid operation options. This processing method eliminates the need for configuration information within the client device; only the service device maintains a unified set of configuration information. When the service device injects the client device into a launched browser-based application, it also provides a set of configuration information. Therefore, it can effectively improve the management efficiency of configuration information.

[0162] In one example, the method provided in this application embodiment may further include the following steps: the client device records sensitive data leakage operation information. Specifically, the client device obtains interception information for the sensitive data leakage operation and sends the interception information to the service device. The interception information may include the data content to be leaked, user information, etc.; the service device records the interception information, such as recording it in the log file of a log server. This processing method makes it possible to trace information about sensitive data leakage operations, facilitating internal management.

[0163] Please see Figure 3This is a schematic diagram illustrating an application scenario of the data leakage prevention method of this application. The method provided in this embodiment can be applied to terminal devices, such as personal computers and laptops. In this embodiment, the terminal device starts a service device, which monitors the startup events of applications based on the browser. After detecting the startup event, the service device injects the client device into the UI process of the application. The application can be a browser, a cloud storage client, an instant messaging tool, or other browser-based applications. Browser-based applications include a UI process, a network process, and a rendering process. The UI process sends a page retrieval request to the server through the network process; the network process sends the page returned by the server to the UI process. The client device can determine that the UI process has obtained the page based on the communication content between the UI process and the network process. After discovering that the UI process has obtained the page, the client device injects the JS script corresponding to the page URL into the page. The UI process obtains the page content and content length after the script is injected, and provides the page content and content length to the rendering process; the rendering process renders the page with the injected script based on the page content and content length, so that the rendered page includes the script. This script can locate the operation options that lead to data leakage, and then set those operation options to invalid options, such as the delete operation option, or set the operation option to be inoperable, so that users cannot send internal sensitive data to the external network.

[0164] In one example, the application based on the browser kernel is a browser. The method provided in this application includes the following steps: monitoring browser startup events; if the startup event is detected, injecting a client device into the browser's user interface (UI) process; the client device injecting a script into the page obtained by the UI process; the browser's rendering process rendering the page with the injected script; and the script modifying operation options in the page that cause data leakage into invalid operation options.

[0165] For example, if a browser opens a cloud storage page, the script injected into the cloud storage page will disable the upload file button on the cloud storage page.

[0166] For example, if the browser opens the email compose page, the script injected into the email compose page will disable the upload attachment button in the email compose page.

[0167] For example, if a browser opens an online chat page, a script injected into the online chat page can disable the file upload button.

[0168] In practice, the script injected into the webpage can also detect whether the webpage contains sensitive content; if sensitive content is detected, the operation options that could lead to data leakage will be modified to invalid operation options.

[0169] For example, if a browser opens an email compose page, the script injected into the email compose page can detect whether there is sensitive content in the email body, such as text containing the words "Alibaba". If sensitive content is detected, the send email button in the email compose page will be disabled.

[0170] For example, if a browser opens a forum posting page, the script injected into the forum posting page can detect whether the posting content includes sensitive content. If sensitive content is detected, the posting button will be disabled.

[0171] For example, if a browser opens an online chat page, the script injected into the online chat page can detect whether the local user's chat messages contain sensitive content. If sensitive content is detected, the send button will be disabled.

[0172] In one example, the application based on the browser kernel is a cloud storage client. The method provided in this application embodiment includes the following steps: monitoring the cloud storage client startup event; if the startup event is detected, injecting a client device into the user interface (UI) process of the cloud storage client; the client device injecting a script into the cloud storage page obtained by the UI process; the browser's rendering process rendering the cloud storage page injected with the script; the script modifying the operation options in the cloud storage page that cause data leakage into invalid operation options.

[0173] In one example, the browser-based application is an instant messaging tool (such as DingTalk). The method provided in this application includes the following steps: monitoring the startup event of the instant messaging tool; if the startup event is detected, injecting a client device into the UI process of the instant messaging tool; the client device injecting a script into the chat page obtained by the UI process; the browser's rendering process rendering the chat page injected with the script; the script modifying the operation options in the chat page that cause data leakage into invalid operation options.

[0174] As can be seen from the above embodiments, the data leakage prevention method provided in this application monitors application startup events, including applications based on browser kernels; if the startup event is detected, a client device is injected into the application's user interface (UI) process; the client device injects a script into the page obtained by the UI process; the application's rendering process renders the page with the injected script; the script modifies operation options on the page that could lead to data leakage into invalid operation options. This approach achieves page element-level data leakage prevention, while allowing users to simultaneously obtain information from the page; therefore, it effectively balances data leakage prevention and information access from the internet.

[0175] Second Embodiment

[0176] In the above embodiments, a data leakage prevention method is provided. Correspondingly, this application also provides a data leakage prevention device. This device corresponds to the above method embodiments. Since the device embodiments are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. The device embodiments described below are merely illustrative.

[0177] In this embodiment, the data leakage protection device may include: a monitoring unit, a client device injection unit, a script injection unit, a page rendering unit, and an operation option modification unit.

[0178] The system includes: a monitoring unit for monitoring application launch events, wherein the application includes applications based on a browser kernel; a client device injection unit for injecting a client device into the application's user interface (UI) process if the launch event is detected; a script injection unit for injecting a script from the client device into a page obtained by the UI process; a page rendering unit for rendering the page containing the injected script by the application's rendering process; and an operation option modification unit for modifying operation options on the page that could lead to data leakage into invalid operation options using the script.

[0179] Optionally, the device may further include: a service device startup unit for starting a service device; and a monitoring unit specifically for monitoring the application startup event through the service device.

[0180] Optionally, the device may further include: a request sending unit, a page sending unit, and a judgment unit.

[0181] The system includes a request sending unit for the UI process to send a page access request to the server via a network process; a page sending unit for the network process to send the page returned by the server to the UI process; and a judgment unit for the client device to determine, based on the communication content between the UI process and the network process, that the UI process has obtained the page.

[0182] Optionally, the apparatus may further include: a rendering preparation unit, used by the UI process to obtain the page content and content length after the script is injected, and to provide the page content and content length to the rendering process; and a page rendering unit, specifically used by the rendering process to render the page with the script injected according to the page content and content length.

[0183] Optionally, the device may further include: a sensitive content detection unit, used by the script to detect whether the page contains sensitive content; and an operation option modification unit, specifically used by the script to modify the operation option to an invalid operation option if it detects that the page contains sensitive content.

[0184] Optionally, the sensitive content detection unit is specifically used by the script to determine whether the page contains sensitive content based on preset sensitive content or sensitive content identification rules.

[0185] Optionally, the device may further include: a data leakage operation recording unit, used by the client device to record sensitive data leakage operation information.

[0186] Optionally, the script injection unit is specifically used for the client device to obtain the script corresponding to the page based on the correspondence between the page URL and the script, wherein the positioning method of the operation option is different in different pages; and to inject the corresponding script into the page, wherein the script positions the operation option according to the design method of the operation option.

[0187] Optionally, the step of modifying the operation option on the page that leads to data leakage into an invalid operation option can be achieved by one of the following methods: deleting the operation option; setting the operation option to be inoperable; or displaying an alarm message and setting the operation option to be inoperable after capturing the operation event of the operation option.

[0188] Optionally, the device may further include: a configuration information acquisition unit, used to acquire at least one of the following configuration information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts; and an operation option modification unit, specifically used by the script to modify the operation options in the page that cause data leakage to invalid operation options according to the configuration information.

[0189] Third Embodiment

[0190] In the above embodiments, a data leakage prevention method is provided. Correspondingly, this application also provides a data security protection method. This method corresponds to the above method embodiments, so it is described simply. For relevant details, please refer to the descriptions of the above method embodiments. The method embodiments described below are merely illustrative.

[0191] In this embodiment, the data security protection method may include the following steps:

[0192] Step S401: Monitor application launch events, where the application includes browser-based applications.

[0193] Step S403: If the startup event is detected, inject the client device into the application's user interface (UI) process.

[0194] Step S405: The client device injects a script into the page obtained by the UI process.

[0195] Step S407: The application's rendering process renders the page into which the script is injected.

[0196] Step S409: The script detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

[0197] The steps S401 to S407 described above correspond to steps S101 to S107 in the first embodiment described above. For related explanations, please refer to steps S101 to S107 in the first embodiment, which will not be repeated here.

[0198] Step S409 corresponds to step S201 in Embodiment 1 above. However, step S201 detects the content to be sent outward, while step S409 detects the content contained in the page itself to be obtained from the server, or the received messages in the chat page. In other words, the method provided in this application embodiment detects whether externally provided content is risky. If the externally provided content is detected to be risky, an alarm message indicating that the content is risky is displayed, or the risky content is made inoperable.

[0199] In one example, the method provided in this application embodiment may further include the following steps: obtaining identification rules for risky content; the script determining whether the page includes the risky content based on the identification rules. This processing method enables the identification of risky content according to rules; therefore, it can improve the flexibility and scalability of data security protection.

[0200] In one example, the application based on the browser kernel is a browser. The method provided in this application includes the following steps: monitoring browser startup events; if the startup event is detected, injecting a client device into the browser's user interface (UI) process; the client device injecting a script into a webpage obtained by the UI process; the browser's rendering process rendering the webpage with the injected script; the script detecting whether the webpage contains risky content; if the page contains risky content, displaying an alarm message and / or prohibiting operation of the risky content.

[0201] For example, if a message received on an online chat page includes a website link, and the script detects that the link is a phishing website link, it will prevent the user from clicking the link.

[0202] For example, if a video page contains links to inappropriate videos, the script can prevent users from opening and watching them if it detects such videos. In practice, this can be done by determining whether the user is a minor and preventing minors from accessing inappropriate videos.

[0203] For example, if the email receiving page includes a virus file as an attachment, the script will prevent the user from downloading the virus file after detecting it.

[0204] In one example, the browser-based application is a video client. The method provided in this application includes the following steps: monitoring a video client startup event; if the startup event is detected, injecting a client device into the user interface (UI) process of the video client; the client device injecting a script into the video display page obtained by the UI process; the browser's rendering process rendering the video display page with the injected script; the script detecting whether the video display page contains risky content; if the video display page contains risky content, displaying an alarm message and / or prohibiting operation of the risky content.

[0205] In one example, the browser-based application is an instant messaging tool. The method provided in this application includes the following steps: monitoring the startup event of the instant messaging tool; if the startup event is detected, injecting a client device into the user interface (UI) process of the instant messaging tool; the client device injecting a script into the chat page obtained by the UI process; the browser's rendering process rendering the chat page with the injected script; the script detecting whether the received messages in the chat page contain risky content; if the received messages contain risky content, displaying an alarm message and / or prohibiting operation on the risky content.

[0206] As can be seen from the above embodiments, the data security protection method provided in this application monitors application startup events, including applications based on browser kernels; if the startup event is detected, a client device is injected into the application's user interface (UI) process; the client device injects a script into the page obtained by the UI process; the application's rendering process renders the page with the injected script; the script detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or operation on the risky content is prohibited. This approach achieves page content-level data security protection, while allowing users to simultaneously obtain information from the page; therefore, it effectively balances data security protection and information access from the internet.

[0207] Fourth embodiment

[0208] In the above embodiments, a data security protection method is provided. Correspondingly, this application also provides a data security protection device. This device corresponds to the third embodiment of the method described above. Since the device embodiment is basically similar to the method embodiment, it is described simply. For relevant details, please refer to the description of the method embodiment. The device embodiment described below is merely illustrative.

[0209] In this embodiment, the data security protection device may include: a monitoring unit, a client device injection unit, a script injection unit, a page rendering unit, and an operation option modification unit.

[0210] The system includes: a monitoring unit for monitoring application launch events, whereby the application includes browser-based applications; a client device injection unit for injecting a client device into the application's user interface (UI) process if the launch event is detected; a script injection unit for injecting a script from the client device into a page obtained by the UI process; a page rendering unit for rendering the page with the injected script by the application's rendering process; a risk detection unit for detecting whether the page contains risky content; and a risk handling unit for displaying alarm information and / or prohibiting operation on the risky content if the page is detected to contain risky content.

[0211] Optionally, the device may further include: a risk identification rule acquisition unit, used to acquire identification rules for risky content; and a risk detection unit, specifically used by the script to determine whether the page includes the risky content based on the identification rules.

[0212] Fifth Embodiment

[0213] In the above embodiments, a data leakage prevention method and a security protection method are provided. Correspondingly, this application also provides an information configuration method. This method may include the following steps: setting at least one of the following information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts, for use in the data leakage prevention method provided in Embodiment 1 above; or, setting identification rules for the existence of risky content, for use in the data leakage prevention method provided in Embodiment 3 above.

[0214] In practice, various configuration information can be set through the configuration client, and a configuration information setting request can be sent to the server; the server stores the configuration information according to the configuration information setting request.

[0215] As can be seen from the above embodiments, the information configuration method provided in this application can effectively improve the flexibility and scalability of the above methods by setting at least one of the following information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts; or, setting identification rules for the existence of risky content for the data leakage prevention method provided in the above embodiment 3.

[0216] Sixth Embodiment

[0217] In the above embodiments, an information configuration method is provided. Correspondingly, this application also provides an information configuration device. This device corresponds to the embodiments of the method described above. Since the device embodiments are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. The device embodiments described below are merely illustrative.

[0218] This application also provides an information configuration device, including: a setting unit, used to set at least one of the following information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts, for use in the data leakage prevention method provided in Embodiment 1 above; or, setting identification rules for the existence of risky content, for use in the data leakage prevention method provided in Embodiment 3 above.

[0219] Seventh Embodiment

[0220] In the above embodiments, a data leakage prevention method and a data security protection method are provided. Correspondingly, this application also provides a toolkit. This toolkit corresponds to the embodiments of the above methods. Since the toolkit embodiments are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. The toolkit embodiments described below are merely illustrative.

[0221] This application also provides a toolkit, which may include a service module and a client module. The service module monitors application startup events, including browser-based applications. If a startup event is detected, a client device is injected into the application's user interface (UI) process. The client module injects scripts into pages obtained by the UI process. These scripts include at least one of the following processes: 1) modifying operation options on the page that could lead to data leakage to invalid operation options; 2) detecting whether the page contains risky content; if risky content is detected, displaying an alarm message and / or prohibiting operation on the risky content. This approach allows the service and client devices to be installed on the execution device of the above method by distributing the toolkit, thus effectively improving implementation efficiency.

[0222] Eighth embodiment

[0223] In the above embodiments, a data leakage prevention method and a data security protection method are provided. Correspondingly, this application also provides a system. This system corresponds to the embodiments of the above methods. Since the system embodiments are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. The system embodiments described below are merely illustrative.

[0224] This application also provides a system that may include a service device and a client device. The service device monitors application launch events, including applications based on a browser kernel. If the launch event is detected, the client device is injected into the application's user interface (UI) process. The client device injects a script into a page obtained by the UI process. The script includes at least one of the following processes: 1) modifying operation options on the page that could lead to data leakage to invalid operation options; 2) detecting whether the page contains risky content; if risky content is detected, displaying an alarm message and / or prohibiting operation on the risky content. This approach achieves page element-level data leakage protection and / or data security, while allowing users to simultaneously obtain information from the page. Therefore, it effectively balances data leakage protection and / or data security with information access from the internet.

[0225] Ninth Embodiment

[0226] In the above embodiments, a data leakage prevention method and a data security protection method are provided. Correspondingly, this application also provides an electronic device. This device corresponds to the embodiments of the above methods. Since the device embodiments are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. The device embodiments described below are merely illustrative.

[0227] The electronic device of this embodiment includes: a processor and a memory; the memory is used to store a program for implementing any of the above methods, and the device is powered on and runs the program of the method through the processor.

[0228] Memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0229] In specific implementations, the electronic device may also include one or more of the following components: a power supply component, an input / output (I / O) interface, and a communication component. The power supply component provides power to various components of the electronic device. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device. The I / O interface provides an interface between the processor 503 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. The communication component is configured to facilitate wired or wireless communication between the electronic device and other devices (such as smartphones, tablets, etc.).

[0230] Although this application discloses preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of this application. Therefore, the scope of protection of this application should be determined by the scope defined in the claims of this application.

[0231] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0232] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory. Memory is an example of computer-readable media.

[0233] 1. Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0234] 2. Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A data leakage prevention method, characterized in that, include: Monitor application launch events, including browser-based applications; If the launch event is detected, the client device is injected into the application's user interface (UI) process; The client device injects scripts into the page obtained by the UI process; The application's rendering process renders the page into which the script is injected; The script modifies the operation options on the page that could lead to data leakage into invalid operation options.

2. The method according to claim 1, characterized in that, Also includes: The script detects whether the page contains sensitive content; The script modifies the operation options on the page that could lead to data leakage into invalid operation options, including: If the script detects that the page contains sensitive content, it will modify the operation option to an invalid operation option.

3. A data security protection method, characterized in that, include: Monitor application launch events, including browser-based applications; If the launch event is detected, inject the client device into the application's user interface (UI) process; The client device injects scripts into the page obtained by the UI process; The application's rendering process renders the page into which the script is injected; The script detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

4. A data security protection method, characterized in that, include: Monitor the startup events of instant messaging tools; If the startup event is detected, the client device is injected into the user interface (UI) process of the instant messaging tool; The client device injects a script into the chat page obtained by the UI process; The rendering process of the instant messaging tool renders the chat page into which the script is injected; The script detects whether the received messages on the chat page contain risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

5. A data security protection method, characterized in that, include: Monitor browser startup events; If the startup event is detected, the client device is injected into the browser's user interface (UI) process; The client device injects a script into the webpage obtained by the UI process; The browser's rendering process renders the webpage into which the script is injected; The script detects whether the webpage contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

6. A data leakage prevention method, characterized in that, include: Monitor browser startup events; If the startup event is detected, the client device is injected into the browser's user interface (UI) process; The client device injects scripts into the page obtained by the UI process; The browser's rendering process renders the page into which the script is injected; The script modifies the operation options on the page that could lead to data leakage into invalid operation options.

7. A data leakage prevention method, characterized in that, include: Monitor cloud storage client startup events; If the startup event is detected, the client device is injected into the user interface (UI) process of the cloud storage client; The client device injects a script into the cloud storage page obtained by the UI process; The browser's rendering process renders the cloud storage page into which the script is injected; The script modifies the file upload option on the cloud drive page to an invalid option.

8. A data leakage prevention method, characterized in that, include: Monitor the startup events of instant messaging tools; If the startup event is detected, the client device is injected into the user interface (UI) process of the instant messaging tool; The client device injects a script into the chat page obtained by the UI process; The browser's rendering process renders the chat page into which the script is injected; The script modifies the operation options in the chat page that could lead to data leakage into invalid operation options.

9. An information configuration method, characterized in that, include: Setting at least one of the following information: preset sensitive content or sensitive content identification rules, and the correspondence between page URLs and scripts, for use in the method according to claim 1; Alternatively, rules for identifying risky content can be set for use in the method described in claim 3.

10. A data leakage protection device, characterized in that, include: A monitoring unit is used to monitor application launch events, including applications based on a browser kernel. A client device injection unit is used to inject a client device into the user interface (UI) process of the application if the startup event is detected. A script injection unit is used to inject scripts from the client device into the page obtained by the UI process. A page rendering unit is used by the application's rendering process to render the page into which the script is injected. An operation option modification unit is used by the script to modify operation options on the page that cause data leakage into invalid operation options.

11. A data security protection device, characterized in that, include: A monitoring unit is used to monitor application launch events, including applications based on a browser kernel. A client device injection unit is used to inject a client device into the user interface (UI) process of the application if the startup event is detected. A script injection unit is used to inject scripts from the client device into the page obtained by the UI process. A page rendering unit is used by the application's rendering process to render the page into which the script is injected. A risk detection unit is used by the script to detect whether the page contains risky content; The risk handling unit is used to display an alarm message and / or prohibit operation of the risky content if the page is detected to contain risky content.

12. A toolkit, characterized in that, include: The service module is used to monitor application startup events, including applications based on the browser kernel; If the launch event is detected, the client device is injected into the application's user interface (UI) process; The client module is used to inject scripts into the page obtained by the UI process, the scripts including at least one of the following processes: Modify the operation options on the page that lead to data leakage to invalid operation options; The system detects whether the page contains risky content; if risky content is detected, an alarm message is displayed and / or the operation of the risky content is prohibited.

13. A system, characterized in that, include: A service device for monitoring application launch events, including browser kernel-based applications; If the launch event is detected, the client device is injected into the application's user interface (UI) process; A client device is configured to inject a script into a page obtained by the UI process, the script comprising at least one of the following processes: Modify the operation options on the page that lead to data leakage to invalid operation options; The system detects whether the page contains risky content; if the result is yes, it displays an alarm message and / or prohibits operation on the risky content.

14. An electronic device, characterized in that, include: processor; as well as A memory for storing a program for implementing the method according to any one of claims 1-9, wherein the device is powered on and the program for running the method is executed by the processor.

Images