Enterprise terminal leakage prevention method and system based on kernel encryption and file redirection

Abstract

This invention relates to the field of data encryption, specifically disclosing a method and system for preventing data leakage on enterprise terminals based on kernel encryption and file redirection. The method includes the following steps: S1. At the terminal layer, a secure terminal is deployed, and the C-Y drives of the terminal hard drive are fully encrypted using the VeraCrypt kernel driver. An isolated, unencrypted Z drive is created as a dedicated external network drive. S2. On the secure terminal, kernel-level permission control is executed through the loaded MiniFilter file system filtering driver, including: intercepting and verifying software installation and execution requests, and only allowing software within the whitelist issued by the policy server to start. This invention significantly improves the security of enterprise terminal data by deploying hard drive encryption and partition creation technology based on the VeraCrypt kernel driver on the enterprise terminal. Full encryption of some partitions on the terminal hard drive and the creation of an isolated dedicated external network drive effectively isolate sensitive internal network data from potentially risky external network environments.

Description

Technical Field

[0001] This invention belongs to the field of data encryption, specifically a method and system for preventing data leakage in enterprise terminals based on kernel encryption and file redirection. Background Technology

[0002] Data encryption is one of the core means of ensuring data security. It encodes and transforms data so that only authorized parties with the correct key can decrypt and read it. Common encryption algorithms are divided into symmetric and asymmetric encryption algorithms. Symmetric encryption algorithms, such as the Chinese national standard SM4, use the same key for both encryption and decryption, offering high speed and efficiency, suitable for encrypting large amounts of data. Asymmetric encryption algorithms use a public and private key pair; the public key is used for encryption, and the private key for decryption. This provides higher security, but the encryption and decryption speeds are relatively slower. In the field of enterprise data security, encryption technology can be applied to various scenarios such as hard drive encryption, file encryption, and network data transmission encryption, effectively preventing data from being stolen or tampered with during storage and transmission.

[0003] Existing enterprise endpoint data security solutions often have shortcomings. Regarding data encryption, some solutions only encrypt certain critical files, neglecting the overall encryption of the endpoint's hard drive. This leaves data on other unencrypted partitions still at risk of leakage. For example, some enterprises only encrypt specific folders storing important business documents, but data in the endpoint's system partition or user-defined partitions may be stolen due to system vulnerabilities or human error. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides an enterprise terminal anti-leakage method based on kernel encryption and file redirection, which solves the problems in the prior art where overall encryption of the terminal hard drive is missing and unencrypted partition data is easily leaked due to system vulnerabilities and human error.

[0005] An enterprise endpoint anti-leakage method based on kernel encryption and file redirection includes the following steps:

[0006] S1. At the terminal layer, deploy a secure terminal, use the VeraCrypt kernel driver to fully encrypt the terminal's hard drive CY disk, and create an isolated, unencrypted Z disk as a dedicated disk for the external network.

[0007] S2. On the secure terminal, kernel-level permission control is performed through the loaded MiniFilter file system filter driver, including:

[0008] Intercept and verify software installation and execution requests, and only allow software on the whitelist issued by the policy server to start;

[0009] Intercept and control file read and write requests from peripheral devices, and dynamically manage the read and write permissions of peripheral devices according to the policy server configuration;

[0010] Intercept file printing and copying requests, verify whether the multi-level approval process is completed, and only allow approved files to be operated on within the controlled directory of the approval server;

[0011] Intercept process data write requests, implement data flow control based on the partition to which the process belongs, only allow Z drive processes to write data to non-Z drive, and block non-Z drive processes from writing data to Z drive;

[0012] S3. At the server layer, a globally unique encryption key factor is generated through the policy server, a dynamic MAC-IP whitelist is managed, and terminal file backups and operation logs are stored through the backup and log server. The multi-level approval process for file printing and copying is managed through the approval server.

[0013] During transmission, whitelisted terminals on the intranet exchange data in plaintext, while data transmission over the external network is encrypted using the SM4 algorithm based on the encryption key factor. File redirection technology is used to achieve directional conversion between encrypted output over the external network and plaintext import over the intranet.

[0014] Preferably, the step of generating the encryption key factor includes:

[0015] A unique identifier for the terminal is generated by the policy server. The unique identifier includes at least a computer security identifier (SID) generated based on the terminal hardware information and a computer name with a unique prefix.

[0016] Collect the core hardware information of the terminal and generate a hardware information file;

[0017] The unique identifier is combined with the content of the hardware information file, a randomly generated salt value is inserted, and a 256-bit server fingerprint is generated using the national cryptographic SM3 hash algorithm.

[0018] The first 128 bits of the server fingerprint are used as the encryption key for the SM4 algorithm.

[0019] Preferably, the collaborative working mode between the MiniFilter driver and the VeraCrypt driver is as follows:

[0020] When a file operation request is made by the terminal, the MiniFilter driver will intercept it first and verify the operation permission.

[0021] If the permission verification is successful, the request will be passed to the VeraCrypt driver for encryption and decryption.

[0022] If permission verification fails, the MiniFilter driver will directly block the request.

[0023] Preferably, the multi-level approval process for printing and copying documents includes:

[0024] Employees submit documents and applications to approvers via intranet communication tools;

[0025] After the approver approves the document, they log in to the approval server and save the document to their dedicated data management directory.

[0026] The approver triggers the submission operation in their own directory, pushing the file to the controlled operation directory of the approval server;

[0027] Employees remotely log in to the approval server and perform the final print or file copy operation within the controlled operation directory.

[0028] Preferably, it also includes data backup and traceability steps:

[0029] Back up the terminal files to the directory on the backup server corresponding to the terminal's MAC address;

[0030] The MiniFilter driver collects file operation logs on the terminal and stores them synchronously on the terminal and on a backup server.

[0031] The policy server sends a remote destruction command to a specified terminal, triggering the terminal's local data shredding program to completely destroy the data.

[0032] An enterprise endpoint anti-leakage system based on kernel encryption and file redirection is used to implement the above methods, including:

[0033] Terminal modules, deployed across various enterprise terminals, include:

[0034] VeraCrypt encryption unit is used to encrypt the entire CY disk of the terminal hard drive;

[0035] MiniFilter permission control unit is used to intercept and verify file operations, software operation, peripheral access and network data flow requests at the kernel level;

[0036] The file redirection unit is used to manage the data flow between the Z drive and non-Z drives;

[0037] The log recording unit is used to record local operation logs;

[0038] The server module includes:

[0039] The policy server is used to generate and manage encryption key factors, manage dynamic MAC-IP whitelists, and store administrator passwords;

[0040] Backup and log server, used to store terminal file backups and aggregated operation logs;

[0041] An approval server is used to provide multi-level approval process support and a controlled operating environment for document printing and copying.

[0042] The transmission security module is used for plaintext secure transmission based on a whitelist in an intranet environment, and for ciphertext secure transmission based on SM4 encryption and file redirection in an extranet environment.

[0043] Preferably, the policy server is further configured to:

[0044] Generate a unique identifier for the terminal and collect hardware information;

[0045] Based on the unique identifier, hardware information, and random salt value, a server fingerprint is generated using the SM3 hash algorithm, from which an SM4 encryption key is derived.

[0046] Preferably, the MiniFilter permission control unit is further configured to:

[0047] Register as a file system filter to intercept IRP_MJ_CREATE, IRP_MJ_READ, and IRP_MJ_WRITE operation requests;

[0048] The intercepted requests are compared with the policies issued by the policy server to determine whether to allow or block them, and corresponding operation logs are generated.

[0049] Preferably, the approval server is divided into at least three logical partitions:

[0050] The D partition is used to store the dedicated data management directory for each approval account;

[0051] The E partition is used to store controlled directories that have been approved for printing or copying.

[0052] System partition.

[0053] Preferably, the system supports deployment in multiple branches, and the policy servers of subsequent branches can import the authorization file generated by the first policy server to achieve unified management of encryption key factors and whitelists.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] By deploying hard drive encryption and partition creation technology based on the VeraCrypt kernel driver on enterprise terminals, the security of enterprise terminal data is greatly enhanced. Full-disk encryption is applied to certain partitions of the terminal hard drive, and an isolated dedicated external network disk is created, effectively isolating sensitive internal network data from potentially risky external environments. Even if the external network environment is attacked or there is a risk of data leakage, the data in the encrypted internal network partitions is difficult to steal or tamper with due to the encryption mechanism, fundamentally ensuring the storage security of core enterprise data at the terminal level and reducing the risk of economic losses and reputational damage to the enterprise due to terminal data loss or leakage.

[0056] By leveraging the loaded MiniFilter file system filter driver to perform kernel-level permission control, fine-grained and real-time management is achieved for operations such as terminal software installation and execution, peripheral file reading and writing, file printing and copying, and process data writing. It can accurately intercept illegal operations and flexibly handle them according to preset policies, effectively preventing data leaks caused by illegal software installation and unauthorized peripheral reading and writing, ensuring the security and compliance of enterprise data during terminal use.

[0057] By leveraging the collaborative work of server-layer policy servers, backup and log servers, and approval servers, along with encryption and file redirection technologies during transmission, enterprise data management is enhanced throughout its entire lifecycle. This achieves centralized data backup, comprehensive recording of operation logs, and strict control over approval processes, while ensuring the security of data transmission between internal and external networks, thus building a comprehensive, multi-layered data security protection system for enterprises. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0059] Figure 2 This is a diagram of the core architecture for preventing leakage at enterprise terminals in this invention.

[0060] Figure 3 This is an approval flowchart for the enterprise terminal anti-leakage method of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] like Figure 1 As shown:

[0063] Example:

[0064] The core of this invention lies in constructing a three-layer security protection system of "terminal-server-transmission link". VeraCrypt ensures storage encryption security, MiniFilter ensures kernel permission and operation security, and file redirection ensures transmission security. The specific architecture is as follows:

[0065] Terminal layer: Deploy secure terminals, support full hard drive encryption (CY drive) and external network drive isolation (Z drive, unencrypted), and have built-in MiniFilter kernel permission control module and file operation log module. MiniFilter intercepts file operation requests, manages software running permissions, allows only authorized software to start, and records all data operation behaviors synchronously.

[0066] Server layer: Includes policy server, backup and log server, and approval server. The policy server stores administrator passwords, generates globally unique key factors, and manages MAC-IP whitelists; the backup and log server stores terminal file backups, operation logs, and email copy content; the approval server is responsible for multi-level approval and controlled storage of file printing / copying.

[0067] Transmission link layer: Internal network terminal authentication is achieved through dynamic MAC whitelist to ensure the security of plaintext transmission within the internal network; external network transmission uses SM4 algorithm encryption, combined with file redirection technology to achieve directional conversion of "external network ciphertext output - internal network plaintext import", preventing data leakage during transmission.

[0068] Key features:

[0069] MiniFilter kernel-level permission control:

[0070] Software control: By registering file system filtering callback functions through the MiniFilter driver, the creation and execution requests of software installation packages (such as .exe, .msi) are intercepted. Only software in the policy server whitelist (such as intranet office software, Z drive external network communication tools) are allowed to pass verification and start. Unauthorized software requests are directly blocked by MiniFilter, and a "software interception log" (including software name, request time, operation path) is generated and synchronized to the local log directory and backup server.

[0071] Peripheral device management: MiniFilter drives the system's device management interface to intercept file read / write requests from peripherals such as USB ports and CD-ROMs in real time. By default, USB ports block "write operations" (allowing only reads) through MiniFilter. Authorized roles (such as department heads) need to remotely grant permissions through the policy server before MiniFilter allows write requests. All USB copying activities are logged by MiniFilter (including device identifier, file path, and operation time). The CD-ROM management logic is consistent with USB, supporting dynamic switching of read / write permissions and operation traceability.

[0072] Data operation control: File printing / copying operation requests must first pass the MiniFilter to verify permissions. Requests without approval authorization are directly blocked. After approval, MiniFilter only allows file operations within the controlled directory of the approval server (the "Print" / "Copy" directory on drive E) to prevent unauthorized cross-directory transmission. At the same time, MiniFilter collects full operation information to form a traceable log.

[0073] Network control: The MiniFilter driver targets and intercepts data interaction requests between processes on the Z drive (external network) and non-Z drive (internal network): it only allows Z drive processes to copy data to non-Z drive (the request is allowed after verification by MiniFilter), and prohibits non-Z drive processes from pasting data to Z drive (MiniFilter directly blocks the request and returns an "insufficient permissions" message), thus blocking unencrypted internal network data from flowing into the external network from the kernel level.

[0074] Secure Data Interaction in Hybrid Office Environments:

[0075] Intranet interaction: Supports the operation of all application software, and data is transmitted in plaintext between whitelisted terminals to meet the needs of efficient internal collaboration within enterprises;

[0076] External network interaction: External network communication tools (QQ / WeChat / DingTalk / browser) are only installed on the Z drive. Processes on the Z drive can copy data to non-Z drive (internal network), but data from non-Z drive processes cannot be pasted back to the Z drive. Files dragged and dropped to the Z drive are automatically encrypted using the policy server's unique key factor to ensure that data transmitted over the external network is encrypted. Terminals in different branches can use this encrypted data to achieve secure interaction.

[0077] Email control: Outgoing emails are automatically copied to the company email address and backed up to the backup server to prevent data leakage from email channels.

[0078] Data backup and traceability:

[0079] Backup mechanism: Supports plaintext and encrypted backup of terminal files, and backup files are stored in the MAC directory of the corresponding terminal on the backup server;

[0080] Log traceability: Terminal operation logs (file copy-in / copy-out, printing, email sending) are stored locally in real time (C:\Program Files\sax_whand\log) and uploaded to the backup server daily. The logs contain information such as operation time, operator, file path, and operation type, which can accurately locate data operation nodes.

[0081] Remote Destruction: The policy server can send encrypted commands to the terminal to trigger a local data shredding program (compliant with the Data Security Law, which achieves complete destruction by writing random data to the sector). The offline terminal will automatically execute the destruction command after connecting to the network to prevent data leakage due to terminal loss.

[0082] Multi-level approval and compatibility:

[0083] Approval process: Document printing / copying requires "employee submission → department head review → final review by approval administrator". After final review, the document can only be operated on in the controlled directory of the approval server to prevent unauthorized output.

[0084] Compatibility and Adaptation: Supports Win10 x64 Enterprise / Professional terminals and WinServer 2016 and above servers; adaptable to single-region enterprises and multi-branch remote office scenarios. Multi-branch offices can achieve unified key management by importing the fingerprint of the first policy server, as follows: Figure 2 As shown.

[0085] Technical details:

[0086] Encryption technology:

[0087] Encryption Algorithm: The national commercial cryptography standard SM4 algorithm is adopted. Sector-level hard disk encryption is implemented based on the VeraCrypt kernel driver. After the VeraCrypt driver intercepts the hard disk I / O request of the CY disk, it calls the SM4 algorithm to complete real-time encryption and decryption. The encryption mode adopts CBC (Cipher Block Chaining) mode. The initialization vector (IV) is dynamically issued by the policy server. The IV is received and stored through the key management module built into the VeraCrypt driver to ensure the randomness and security of the encryption process.

[0088] The encryption key factor is derived from a globally unique identifier (hereinafter referred to as "server fingerprint") generated by the policy server. This identifier is a 256-bit hash value, stored in the policy server's "data storage path / important configuration" directory (e.g., G:\dat00\important configuration\server_fingerprint.dat), and is ensured to be tamper-proof through digital signature.

[0089] Key management: Administrator passwords are stored on the policy server, while user passwords are kept by the user and automatically uploaded to the backup server after modification (path: G:\data\Important Configuration\Terminal MAC Directory\Key_000002.txt), ensuring password security and traceability.

[0090] Encryption key factor generation rules:

[0091] Upon initial startup, the policy server automatically performs the following steps to generate a "server fingerprint" (i.e., the basic data for encryption key factors):

[0092] Generate a unique terminal identifier: a. Generate a new computer security identifier (SID) by calling the Windows system API GenerateSid. This SID contains the terminal motherboard serial number field (obtained through the WMI interface Win32_BaseBoard.SerialNumber), ensuring that the SID is strongly bound to the terminal hardware and avoiding SID duplication; b. Generate a new computer name, with the naming rule 'DWC-Enterprise ID-Last 6 digits of hardware serial number' (e.g., 'DWC-001-3F4CD7'). The Enterprise ID is manually entered during the policy server installation to ensure that the prefix of different enterprise computer names is unique.

[0093] Hardware detection and driver adaptation: The policy server re-detects the terminal's core hardware through the Device Manager interface, including but not limited to: motherboard MAC address (wireless / wired network card), hard drive physical serial number (obtained via Win32_PhysicalMedia.SerialNumber), and CPU model (Win32_Processor.Name). The detection results generate a hardware_info.xml file and store it locally on the server. At the same time, it automatically installs the adapted hard drive controller driver (which must be Microsoft WHQL certified) to ensure that the kernel driver can normally intercept sector read and write requests, avoiding encryption failures caused by driver incompatibility.

[0094] The server fingerprint is generated by salting and hashing: a. Integrate the 'SID + computer name' from step 1) with the content of 'hardware_info.xml' from step 2) to form a raw data string of 512-1024 bits; b. Generate a 16-bit random salt value (generated via the CryptGenRandom API, which has cryptographic security), and insert the salt value into the middle of the raw data string to form a salted data string; c. Calculate the salted data string using the national cryptographic SM3 hash algorithm to generate a 256-bit hash value, which is the 'server fingerprint'; When the terminal is encrypted subsequently, the VeraCrypt driver obtains this fingerprint from the policy server, extracts the first 128 bits as the encryption key for the SM4 algorithm, and stores the key in the secure storage unit (not plaintext storage in memory) of the VeraCrypt driver to prevent key leakage.

[0095] VeraCrypt and MiniFilter collaboration mechanism: When a file operation occurs on the terminal, the MiniFilter driver first intercepts the request and verifies the operation permissions (such as whether it is authorized software and whether it conforms to data flow rules); after the permission verification is successful, the request is passed to the VeraCrypt driver, which completes the encryption and decryption processing of the IO request; if the permission verification fails, the MiniFilter directly blocks the request without the need for the VeraCrypt driver to participate, thus achieving dual security protection of "permission control first, encryption processing later".

[0096] MiniFilter kernel permission control technology:

[0097] Driver Registration and Loading: The MiniFilter driver is developed based on the Windows Kernel Mode Driver Framework (KMDF). It is loaded into the system kernel via the fltmc load command and registered as a file system filter (filtering critical file operations such as IRP_MJ_CREATE, IRP_MJ_READ, and IRP_MJ_WRITE). Before loading, the driver must be verified by Microsoft's digital signature (WHQL certification is required in some scenarios) to ensure that the driver has not been tampered with and to avoid kernel-level security risks.

[0098] Software operation control: The MiniFilter driver intercepts IRP_MJ_CREATE requests (file creation / execution requests), extracts the software path and name corresponding to the request, and compares them with the "software whitelist" issued by the policy server; if it is in the whitelist, the request is allowed; if it is not in the whitelist, the request is blocked and an interception log is generated.

[0099] Data flow control: Intercept IRP_MJ_WRITE requests (data write requests) and determine the partition (Z drive / non-Z drive) to which the requesting process belongs: When a non-Z drive process writes data to the Z drive, the request is blocked directly; when a Z drive process writes data to a non-Z drive, the process is verified to be an authorized communication tool (such as QQ, WeChat), and if the verification is successful, the process is allowed.

[0100] Peripheral operation control: By using MiniFilter to drive associated system device objects (such as USB storage devices and CDROM devices), intercept the peripheral's IRP_MJ_READ / WRITE requests, decide whether to allow them based on the peripheral permissions (read-only / read-write / disabled) configured on the policy server, and collect peripheral identifiers (such as USB device serial numbers) and write them to the operation log;

[0101] Log collection and synchronization: The MiniFilter driver has a built-in logging module. For each intercepted or allowed request, it automatically records information such as "operation time, process ID, file path, request type, and processing result". The logs are synchronized to the local log directory (C:\Program Files\sax_whand\log) through a secure channel from kernel space to user space (to prevent tampering). The logs are uploaded to the backup server daily by the terminal log module.

[0102] File redirection technique:

[0103] Redirection logic: File operation redirection is implemented based on kernel driver. Operations of Z drive (external network drive) processes on non-Z drive (internal network drive) are automatically redirected to Z drive. Operations of non-Z drive processes on Z drive are only allowed to "encrypted import" (which needs to be decrypted and stored in the internal network drive), and "plaintext export" is prohibited to prevent internal network data from flowing into the external network without encryption.

[0104] Integrity Guarantee: During the redirection process, a data verification mechanism is used to ensure file integrity and prevent data corruption during transmission.

[0105] Whitelist management:

[0106] Dynamic MAC-IP whitelist: The policy server maintains a whitelist through tools, which includes terminal MAC addresses (including wireless network cards), printer MAC addresses, and server MAC addresses. Only devices on the whitelist can access the intranet. When adding a new terminal, the MAC address must be entered into the whitelist and the policy server network driver must be restarted to ensure intranet access security.

[0107] Multi-branch adaptation: The first branch office's policy server selects "Generate random fingerprint locally," while other branches select "Import random fingerprint from other machines," generating a unified whitelist and key management by importing the .fig authorization file from the first server.

[0108] Daily usage procedure:

[0109] Document approval (printing / copying):

[0110] File authorization for printing / copying control, such as Figure 3 :

[0111] The document approval process relies on an approval server (divided into three partitions: C, D, and E, where D is the data management partition and E is the controlled partition for printing / copying out) and "Internal Network Communication". Specifically, it consists of four steps: "employee submission - hierarchical review - final review push - execution operation". The printing and copying out processes are logically consistent, only the final execution directory is different (printing corresponds to E:\printing, and copying out corresponds to E:\copying out).

[0112] Step 1: Ordinary employees submit documents and approval applications

[0113] Regular employees (without approval authority) need to initiate an application through the "Internal Network Communication" system first. The specific steps are as follows:

[0114] Employees organize the documents to be printed / copied locally on their terminals. After confirming that the document content is correct, they open "Intranet Communication", select a contact person (each terminal has a user number, such as 000001~000999, select 000001 or 000003), attach a "Print / Copy Request Instructions" (including document purpose, receiving device, etc.), and transfer the document to the terminal 000001 or 000003 via Intranet Communication.

[0115] After receiving the file, 000001 or 000003 reviews the file content locally on the terminal (e.g., confirming whether it is core enterprise data and whether it complies with external distribution standards). If initially approved, the approval process is initiated; if not approved, feedback is provided to the employee via the intranet with reasons.

[0116] Step 2: Hierarchical review (000003 initial review → 000002 final review, or 000001 direct review)

[0117] Depending on the receiving account, the review process is divided into two paths: "000002 Intermediate Review" and "000001 Direct Review," as detailed below:

[0118] Path A: Initial review by 000003 → Final review by 000002 (applicable to scenarios where employees submit to 000003):

[0119] After 000003 (Department Head A) approves the document, log in to the approval server via "Remote Desktop" and copy the approved document to the D:\000003 directory on the approval server (this directory is 000003's exclusive data management directory, and other accounts do not have access).

[0120] In the approval server directory D:\000003, right-click the target file and select "Submit Print" or "Submit Copy" from the pop-up menu. The system will automatically push the file to the approval server directory D:\000002 (000002 exclusive review directory).

[0121] Department Head B (000002) logs into the approval server via remote desktop, accesses the D:\000002 directory, and views the documents to be reviewed and the "Preliminary Review Comments" attached to 000003. If the documents are confirmed to meet the printing / copying specifications (e.g., no sensitive data, reasonable application reasons), they proceed to the final review push stage; if they do not meet the specifications, feedback is sent to 000003 via the intranet, who then provides further feedback to the employee.

[0122] Path B: Direct review by 000001 (applicable to scenarios where employees submit to 000001):

[0123] After the document is approved by 000001 (the highest level of management), no intermediate steps are needed. Log in to the approval server directly via remote desktop and copy the file to the D:\000001 directory (000001's dedicated data management directory) on the approval server.

[0124] In the D:\000001 directory, right-click on the file and select "Submit for Print" or "Submit for Copy". The system will directly push the file to the E:\Print or E:\Copy directory on the approval server (skipping the final review stage of 000002, since 000001 has the highest privileges). At the same time, an "Approval Log" (including approver, approval time, and file information) will be generated and stored in the D:\log directory on the approval server.

[0125] Step 3: Final Review Push (000002 Pushes the file to the controlled directory):

[0126] For path A (000003 initial review → 000002 final review):

[0127] After approving a file in the approval server directory D:\000002, department head B (000002) right-clicks the file and selects "Submit for Print" or "Submit for Copy". The system automatically pushes the file from the D:\000002 directory to a subdirectory automatically created according to the current date in the E:\Print (printing scenario) or E:\Copy (copying scenario) directory (e.g., E:\Print\20250110), completing the final approval push.

[0128] Common operations:

[0129] After each final review push (path A) or direct push (path B), the system automatically records the operation log (including push time, target path, operation type, and approver information) and stores it synchronously in the approval server's D:\log directory and the backup server's "Terminal Log" directory for traceability.

[0130] Step 4: Regular employees perform the print / copy operation:

[0131] After the file is pushed to the controlled directory on drive E, regular employees need to perform operations via remote login, as follows:

[0132] Employees can log in to the approval server via remote desktop (temporary login permissions must be granted in advance using 000001 or 000003), navigate to the E:\Print\Date subdirectory (for printing scenarios) or the E:\Copyout\Date subdirectory (for copyout scenarios), and locate the target file.

[0133] Printing scenario: Employees directly open the file, connect to the printer configured on the approval server, and perform the printing operation. During the printing process, the system automatically records the "printing log" (including printing time, number of pages printed, and printer number).

[0134] Copying scenario: Employees connect a USB drive to the approval server (it is necessary to confirm in advance that the USB drive has been authorized and the USB port has read / write permissions enabled), right-click on the files in the E:\ copy directory, select "Submit Copy", and the system will automatically export the files to the USB drive and record the "Copy Log" (including copy time, USB drive identifier, and file size).

[0135] After the operation is completed, the employee needs to log out of the remote login. 000001 or 000003 can view the operation log through the backup server to confirm the compliance of the operation.

[0136] Internal and external network data interaction:

[0137] Intranet Interaction: Whitelisted terminals transmit data in plaintext via intranet communication, supporting all office software.

[0138] External network interaction: When sending files via Z drive communication tools, the files are automatically encrypted; when receiving encrypted files from the external network, the files are saved to the Z:\export directory, right-click and select "Decrypt and Import", and the decrypted files are automatically saved to the C:\import directory (administrator privileges are required to modify directory permissions).

[0139] C Log and Backup Management:

[0140] Log viewing: Security operations and maintenance personnel can view historical operation logs through the backup server's "Terminal Logs" directory (categorized by terminal MAC address); local terminal logs are stored in C:\Program Files\sax_whand\log (ordinary users do not have access rights);

[0141] File backup: Terminal files are automatically backed up to the corresponding MAC directory on the backup server.

[0142] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0143] The accompanying drawings of the embodiments disclosed in this invention only involve structures relevant to the embodiments disclosed in this invention. Other structures can be referred to with common designs. Unless otherwise specified, the same embodiment and different embodiments of this invention can be combined with each other.

[0144] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for preventing data leakage in enterprise terminals based on kernel encryption and file redirection, characterized in that: Includes the following steps: S1. At the terminal layer, deploy a secure terminal, use the VeraCrypt kernel driver to fully encrypt the terminal's hard drive CY disk, and create an isolated, unencrypted Z disk as a dedicated disk for the external network. S2. On the secure terminal, kernel-level permission control is performed through the loaded MiniFilter file system filter driver, including: Intercept and verify software installation and execution requests, and only allow software on the whitelist issued by the policy server to start; Intercept and control file read and write requests from peripheral devices, and dynamically manage the read and write permissions of peripheral devices according to the policy server configuration; Intercept file printing and copying requests, verify whether the multi-level approval process is completed, and only allow approved files to be operated on within the controlled directory of the approval server; Intercept process data write requests, implement data flow control based on the partition to which the process belongs, only allow Z drive processes to write data to non-Z drive, and block non-Z drive processes from writing data to Z drive; S3. At the server layer, a globally unique encryption key factor is generated through the policy server, a dynamic MAC-IP whitelist is managed, and terminal file backups and operation logs are stored through the backup and log server. The multi-level approval process for file printing and copying is managed through the approval server. During transmission, whitelisted terminals on the intranet exchange data in plaintext, while data transmission on the external network is encrypted using the SM4 algorithm based on the encryption key factor. File redirection technology is used to achieve directional conversion between encrypted output on the external network and plaintext import on the intranet. The steps for generating the encryption key factor include: A unique identifier for the terminal is generated by the policy server. The unique identifier includes at least a computer security identifier (SID) generated based on the terminal hardware information and a computer name with a unique prefix. Collect the core hardware information of the terminal and generate a hardware information file; The unique identifier is combined with the content of the hardware information file, a randomly generated salt value is inserted, and a 256-bit server fingerprint is generated using the national cryptographic SM3 hash algorithm. The first 128 bits of the server fingerprint are used as the encryption key for the SM4 algorithm; The collaborative working method between the MiniFilter driver and the VeraCrypt driver is as follows: When a file operation request is made by the terminal, the MiniFilter driver will intercept it first and verify the operation permission. If the permission verification is successful, the request will be passed to the VeraCrypt driver for encryption and decryption. If permission verification fails, the MiniFilter driver will directly block the request.

2. The method according to claim 1, characterized in that, The multi-level approval process for printing and copying documents includes: Employees submit documents and applications to approvers via intranet communication tools; After the approver approves the document, they log in to the approval server and save the document to their dedicated data management directory. The approver triggers the submission operation in their own directory, pushing the file to the controlled operation directory of the approval server; Employees remotely log in to the approval server and perform the final print or file copy operation within the controlled operation directory.

3. The method according to claim 1, characterized in that, It also includes data backup and traceability steps: Back up the terminal files to the directory on the backup server corresponding to the terminal's MAC address; The MiniFilter driver collects file operation logs on the terminal and stores them synchronously on the terminal and on a backup server. The policy server sends a remote destruction command to a specified terminal, triggering the terminal's local data shredding program to completely destroy the data.

4. An enterprise terminal anti-leakage system based on kernel encryption and file redirection, used to implement the method of any one of claims 1-3, characterized in that, include: Terminal modules, deployed across various enterprise terminals, include: VeraCrypt encryption unit is used to encrypt the entire CY disk of the terminal hard drive; MiniFilter permission control unit is used to intercept and verify file operations, software operation, peripheral access and network data flow requests at the kernel level; The file redirection unit is used to manage the data flow between the Z drive and non-Z drives; The log recording unit is used to record local operation logs; The server module includes: The policy server is used to generate and manage encryption key factors, manage dynamic MAC-IP whitelists, and store administrator passwords; Backup and log server, used to store terminal file backups and aggregated operation logs; An approval server is used to provide multi-level approval process support and a controlled operating environment for document printing and copying. The transmission security module is used for plaintext secure transmission based on a whitelist in an intranet environment, and for ciphertext secure transmission based on SM4 encryption and file redirection in an extranet environment.

5. The system according to claim 4, characterized in that, The policy server is further configured to: Generate a unique identifier for the terminal and collect hardware information; Based on the unique identifier, hardware information, and random salt value, a server fingerprint is generated using the SM3 hash algorithm, from which an SM4 encryption key is derived.

6. The system according to claim 4, characterized in that, The MiniFilter permission control unit is further configured to: Register as a file system filter to intercept IRP_MJ_CREATE, IRP_MJ_READ, and IRP_MJ_WRITE operation requests; The intercepted requests are compared with the policies issued by the policy server to determine whether to allow or block them, and corresponding operation logs are generated.

7. The system according to claim 4, characterized in that, The approval server is divided into at least three logical partitions: The D partition is used to store the dedicated data management directory for each approval account; The E partition is used to store controlled directories that have been approved for printing or copying. System partition.

8. The system according to claim 4, characterized in that, The system supports deployment in multiple branches. Subsequent branch policy servers can import the authorization file generated by the first policy server to achieve unified management of encryption key factors and whitelists.

Images