Electronic file encryption method and device and electronic equipment

Abstract

The invention relates to an electronic file encryption method and device and electronic equipment, and belongs to the technical field of computers. The method comprises the steps that the format type of an electronic file is acquired; determining an attribute domain region according to the format type; wherein the attribute domain region does not influence the content of the electronic file and the opening, reading and writing of the electronic file, and the information of the attribute domain region is not lost along with the sending, modifying, copying and moving operations of the electronic file; and adding the security level identifier of the electronic file to the attribute domain region. According to the invention, the encryption of the electronic file is separated from the dependence on the system, and the encryption of the electronic file does not influence the operation of the electronic file.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, and electronic device for marking electronic documents with confidentiality. Background Technology

[0002] Electronic document classification management is a core aspect of information security. Electronic document classification involves processes such as formal classification and classification change. Once an electronic document is formally classified, its content cannot be modified, otherwise it may cause a discrepancy between the classified classification and the actual classification.

[0003] There is a method for monitoring changes to the security classification of electronic documents. A client is installed on the terminal to monitor whether the security classification of the electronic document has been modified. If a modification is detected, the security classification will be forcibly changed back to the original level, and this record will be stored in a database. This method is highly dependent on the client. Without the client program, it is impossible to monitor changes to the security classification of electronic documents. Furthermore, this method requires real-time monitoring of electronic documents, which will have a certain impact on the reading and writing of electronic documents.

[0004] Another existing electronic document classification system and method involves creating a database electronic file on the computer's hard drive, which is installed on an operating system platform. When classifying electronic documents, the database stores the classification time, file name, full path, and classification level of the electronic document. This method is also highly dependent on the system. If the electronic document is disconnected from the system, such as when it is sent to a terminal without the system installed, the classification level identifier will be lost.

[0005] It is evident that existing methods for classifying electronic documents suffer from system dependency and disruptions to document operations. Summary of the Invention

[0006] Based on the above analysis, the embodiments of the present invention aim to provide an electronic document encryption method, apparatus, and electronic device to solve the problems of existing electronic document encryption methods having system dependence on electronic document encryption and electronic document encryption affecting electronic document operations.

[0007] On one hand, embodiments of the present invention provide a method for classifying electronic documents, the method comprising: obtaining the format type of the electronic document; determining an attribute field region based on the format type; wherein the attribute field region does not affect the content of the electronic document, the opening and reading / writing of the electronic document, and the information in the attribute field region is not lost during the sending, modification, copying and moving of the electronic document; and adding the security classification identifier of the electronic document to the attribute field region.

[0008] The beneficial effects of the above technical solution are as follows: it enables the encryption of electronic documents to be independent of the system, and it ensures that the encryption of electronic documents does not affect the operation of electronic documents.

[0009] Based on a further improvement of the above method, before adding the security classification identifier of the electronic document to the attribute field area, the method further includes: obtaining the security classification identifier attribute data of the electronic document; wherein, the security classification identifier attribute data includes the protocol version number of the electronic document, the security classification of the electronic document, the creation time of the electronic document, and the last modification time of the electronic document; generating the security classification identifier according to the security classification identifier attribute data, and encrypting the security classification identifier according to a preset encryption method.

[0010] The beneficial effects of the above-mentioned further improvement scheme are: it realizes the generation of security classification identifiers, prevents direct modification of security classification identifiers by encrypting them, and provides a basis for security monitoring using security classification identifiers by reasonably setting the attribute data of security classification identifiers.

[0011] A further improvement to the above method is that generating the security level identifier based on the security level identifier attribute data includes: processing the security level identifier attribute data into JSON format data to obtain the security level identifier.

[0012] The beneficial effect of the above-mentioned further improvement scheme is that by processing the security classification attribute data into JSON format, the security classification identifier is obtained, which facilitates the viewing and processing of the security classification identifier.

[0013] Based on a further improvement of the above method, the step of encrypting the security level identifier according to a preset encryption method includes: first encrypting the security level identifier in JSON format using AES-256, and then performing a second encryption using Base64URL encoding.

[0014] The beneficial effects of the above-mentioned further improvement scheme are: it improves the security of the security classification label and prevents direct modification of the security classification label.

[0015] Based on a further improvement of the above method, after adding the security classification identifier of the electronic document to the attribute domain area, the method further includes: extracting the encrypted security classification identifier from the attribute domain area; decrypting the encrypted security classification identifier according to the decryption method corresponding to the encryption method; extracting the creation time of the electronic document based on the decrypted security classification identifier; comparing the extracted creation time of the electronic document with the actual creation time of the electronic document; if the extracted creation time of the electronic document is consistent with the actual creation time of the electronic document, it is determined that the security classification identifier has not been tampered with; if the extracted creation time of the electronic document is inconsistent with the actual creation time of the electronic document, it is determined that the security classification identifier has been tampered with.

[0016] The beneficial effects of the above-mentioned further improvement scheme are: it enables the identification of the risk scenario where the encrypted security level identifier is completely replaced, thereby improving the security of the security level identifier.

[0017] Based on a further improvement of the above method, after adding the security classification identifier of the electronic document to the attribute domain area, the method further includes: extracting the encrypted security classification identifier from the attribute domain area; decrypting the encrypted security classification identifier according to the decryption method corresponding to the encryption method; extracting the last modification time of the electronic document based on the decrypted security classification identifier; comparing the extracted last modification time of the electronic document with the actual last modification time of the electronic document; if the extracted last modification time of the electronic document is consistent with the actual last modification time of the electronic document, it is determined that the content of the electronic document has not been modified; if the extracted last modification time of the electronic document is inconsistent with the actual last modification time of the electronic document, it is determined that the content of the electronic document has been modified.

[0018] The beneficial effects of the above-mentioned further improvement scheme are: it enables the identification of the risk of document content being modified after electronic documents are classified, thereby improving the security of classification labels.

[0019] Based on a further improvement of the above method, obtaining the format type of the electronic file includes: in response to the electronic file's PK header containing 50 4B 03 04, the electronic file is determined to be a DOCX, XLSX, or PPTX format file; in response to the electronic file's first 8 bytes being D0 CF 11E0 A1 B1 1A E1, the electronic file is determined to be a DOC, WPS, XLS, ET, PPT, or DPS format file; in response to the electronic file's header containing %PDF-version number, the electronic file is determined to be a PDF format file; and in response to the electronic file including an ofd.xml file, the electronic file is determined to be an OFD format file.

[0020] The beneficial effect of the above-mentioned further improvement scheme is that it enables the recognition of the format types of mainstream electronic documents.

[0021] Further improvements to the above method involve adding the security classification identifier of the electronic document to the attribute domain area, including: for DOCX, XLSX, or PPTX format files, adding the security classification identifier of the electronic document to the Custom.xml node; for DOC, WPS, XLS, ET, PPT, or DPS format files, adding the security classification identifier of the electronic document to the CustomDocumentProperties storage area; for PDF format files, adding the security classification identifier of the electronic document to the Info dictionary; and for OFD format files, adding the security classification identifier of the electronic document to the OFD metadata area.

[0022] The beneficial effect of the above-mentioned further improvement scheme is that it enables the addition of security classification identifiers in the attribute field area of ​​mainstream electronic documents.

[0023] On the other hand, embodiments of the present invention provide an electronic document security labeling device, which includes: an acquisition module for: acquiring the format type of the electronic document; a determination module for: determining an attribute field area based on the format type; wherein the attribute field area does not affect the content of the electronic document, the opening and reading / writing of the electronic document, and the information in the attribute field area is not lost during the sending, modification, copying, and moving of the electronic document; and an adding module for: adding the security classification identifier of the electronic document to the attribute field area.

[0024] The beneficial effects of the above technical solution are as follows: it enables the encryption of electronic documents to be independent of the system, and it ensures that the encryption of electronic documents does not affect the operation of electronic documents.

[0025] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the electronic document encryption method described above.

[0026] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the electronic document encryption method described above.

[0027] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the electronic document encryption method described above.

[0028] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0029] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0030] Figure 1 This is one of the flowcharts illustrating the electronic document encryption method provided by the present invention.

[0031] Figure 2 This is the second flowchart illustrating the electronic document encryption method provided by the present invention.

[0032] Figure 3 This is the third flowchart of the electronic document encryption method provided by the present invention.

[0033] Figure 4 This is a schematic diagram of the electronic document marking device provided by the present invention.

[0034] Figure 5 A schematic diagram of the physical structure of an electronic device is provided. Detailed Implementation

[0035] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0036] Figure 1 This is one of the flowcharts illustrating the electronic document encryption method provided by this invention. For example... Figure 1 As shown, the method includes:

[0037] Step S1: Obtain the format type of the electronic file.

[0038] Electronic files include 11 formats: DOCX, XLSX, PPTX, DOC, WPS, XLS, ET, PPT, DPS, PDF, and OFD. Different formats have different structures. When classifying a file, the first step is to determine its format type, which can be identified through the file header.

[0039] Step S2: Determine the attribute field area according to the format type; wherein, the attribute field area will not affect the content of the electronic file, the opening and reading / writing of the electronic file, and the information in the attribute field area will not be lost during the sending, modification, copying and moving of the electronic file.

[0040] Attribute fields do not affect the content of electronic documents, nor do they affect the opening, reading, or writing of electronic documents. Information in attribute fields is not lost during the sending, modification, copying, or moving of electronic documents. Different electronic documents have different attribute fields and methods for adding attribute values. Therefore, after obtaining the format type of the electronic document, the attribute fields should be determined according to the format type.

[0041] Step S3: Add the security classification identifier of the electronic document to the attribute field area.

[0042] After determining the attribute field area of ​​the electronic document, the security classification identifier of the electronic document is added to the attribute field area to realize the security classification processing of the electronic document.

[0043] This invention adds a security classification identifier to the attribute field area. This addition of the security classification identifier does not affect the content of the electronic document, nor does it affect the opening, reading, or writing of the document. Furthermore, the security classification identifier added to the attribute field area will not be lost during the sending, modification, copying, or moving of the electronic document. Therefore, it is possible to embed a security classification identifier into a file without damaging the file structure. This allows the file to be used normally even when it is not part of the system file, solving the problem of file security classification depending on the system, and ensuring that file security classification does not affect the reading and writing of the electronic document.

[0044] The electronic document confidentiality marking method provided by this invention obtains the format type of the electronic document, determines the attribute field area based on the format type, and adds the confidentiality level identifier of the electronic document to the attribute field area. This achieves that the confidentiality marking of electronic documents is independent of the system and that the confidentiality marking of electronic documents does not affect the operation of electronic documents.

[0045] According to a method for classifying electronic documents provided by the present invention, before adding the classification identifier of the electronic document to the attribute field area, the method further includes: obtaining classification identifier attribute data of the electronic document; wherein, the classification identifier attribute data includes the protocol version number of the electronic document, the classification level of the electronic document, the creation time of the electronic document, and the last modification time of the electronic document; generating the classification identifier according to the classification identifier attribute data, and encrypting the classification identifier according to a preset encryption method.

[0046] Before adding the security classification identifier to the attribute field of an electronic document, the security classification identifier needs to be generated in advance. The security classification identifier is generated based on custom security classification identifier attribute data. This attribute data includes the electronic document's protocol version number, security classification, creation time, and last modification time. The creation time is written when the document is created and will not be changed afterward; the time is specified to the second. The last modification time is reset to the current time when the document is modified and saved; the time is also specified to the second.

[0047] When generating a security classification identifier, the security classification identifier attribute data of the electronic document is obtained, and the security classification identifier is generated based on the security classification identifier attribute data of the electronic document. In order to prevent the security classification identifier from being tampered with, the security classification identifier is encrypted according to a preset encryption method before being embedded into the electronic document.

[0048] The electronic document classification method provided by this invention obtains the classification identifier attribute data of the electronic document, which includes the protocol version number, classification level, creation time, and last modification time of the electronic document. A classification identifier is generated based on the classification identifier attribute data, and then encrypted using a preset encryption method. This process generates the classification identifier and prevents direct modification of it. By reasonably setting the classification identifier attribute data, a foundation is provided for security monitoring using the classification identifier.

[0049] According to a method for classifying electronic documents provided by the present invention, the step of generating the classification identifier based on the classification identifier attribute data includes: processing the classification identifier attribute data into JSON format data to obtain the classification identifier.

[0050] After obtaining the security classification attribute data, including the protocol version number, security classification level, creation time, and last modification time of the electronic document, the security classification attribute data is processed into JSON format to obtain the security classification identifier. The specific format is as follows:

[0051]

[0052] The electronic document classification method provided by this invention obtains the classification identifier by processing the classification identifier attribute data into JSON format, which facilitates the viewing and processing of the classification identifier.

[0053] According to the present invention, an electronic document encryption method is provided, wherein encrypting the security level identifier according to a preset encryption method includes: first encrypting the security level identifier in JSON format using AES-256, and then performing a second encryption using Base64URL encoding.

[0054] To prevent users from tampering with the security classification identifier or its attribute data, this invention applies two layers of reversible encryption to the security classification identifier. After these two layers of encryption, users cannot directly modify the security classification identifier; otherwise, the security classification identifier attribute data will be destroyed, and the file security classification will be unrecognizable.

[0055] This invention performs secondary encryption on the security level identifier using a preset encryption method. First, the JSON format is encrypted using AES-256 with CBC (Cryptographic Block Chaining) mode. An initialization vector (IV) is randomly generated as a 16-byte initialization vector. Then, it is encoded using Base64URL, removing the '=' padding character, replacing '+' with '-', and ' / ' with '_'. After these two layers of encryption, the security level identifier is added to the attribute field area.

[0056] The electronic document security classification method provided by this invention improves the security of the security classification identifier by first encrypting it with AES-256 and then with Base64URL encoding, thereby preventing direct modification of the security classification identifier.

[0057] According to a method for classifying electronic documents provided by the present invention, after adding the classification identifier of the electronic document to the attribute field region, the method further includes: extracting the encrypted classification identifier from the attribute field region; decrypting the encrypted classification identifier according to the decryption method corresponding to the encryption method; extracting the creation time of the electronic document according to the decrypted classification identifier; comparing the extracted creation time of the electronic document with the actual creation time of the electronic document; if the extracted creation time of the electronic document is consistent with the actual creation time of the electronic document, it is determined that the classification identifier has not been tampered with; if the extracted creation time of the electronic document is inconsistent with the actual creation time of the electronic document, it is determined that the classification identifier has been tampered with.

[0058] While encrypting the security classification identifier prevents direct modification of it, there is still a way to tamper with it: by copying the security classification identifier of another file and replacing the security classification identifier of the current file entirely. This would result in unauthorized modification of the security classification identifier.

[0059] To identify such risk scenarios, this invention includes the electronic document creation time in the security classification attribute data. The electronic document creation time in a properly added security classification identifier matches the actual creation time of the electronic document, while the electronic document creation time in an illegally tampered security classification identifier does not match the actual creation time. Therefore, by extracting the electronic document creation time from the security classification identifier and comparing it with the actual creation time of the electronic document, it can be determined whether the security classification identifier has been tampered with.

[0060] The electronic document classification method provided by this invention determines whether the classification identifier has been tampered with by comparing the extracted electronic document creation time with the actual creation time of the electronic document. This enables the identification of the risk of the encrypted classification identifier being completely replaced, thereby improving the security of the classification identifier.

[0061] According to a method for classifying electronic documents provided by the present invention, after adding the classification identifier of the electronic document to the attribute field area, the method further includes: extracting the encrypted classification identifier from the attribute field area; decrypting the encrypted classification identifier according to the decryption method corresponding to the encryption method; extracting the last modification time of the electronic document according to the decrypted classification identifier; comparing the extracted last modification time of the electronic document with the actual last modification time of the electronic document; if the extracted last modification time of the electronic document is consistent with the actual last modification time of the electronic document, it is determined that the content of the electronic document has not been modified; if the extracted last modification time of the electronic document is inconsistent with the actual last modification time of the electronic document, it is determined that the content of the electronic document has been modified.

[0062] Once an electronic document is officially classified, its content cannot be modified; otherwise, a discrepancy may arise between the marked classification and the actual classification. To identify whether the content of an electronic document has been modified, this invention sets the last modification time of the electronic document in the classification identifier attribute data. The last modification time of the electronic document in the classification identifier attribute data is the last modification time of the electronic document up to the time it was classified. If the content of the electronic document is modified after it has been classified, the last modification time of the electronic document changes. Therefore, by extracting the last modification time of the electronic document from the classification identifier and comparing it with the actual last modification time of the electronic document, it is possible to identify whether the content of the electronic document has been tampered with after it has been classified.

[0063] Since the security classification identifier provided by this invention does not depend on the system, if the file is removed from the system, the file content will be detected as to whether it has been tampered with when the security classification identifier is read again.

[0064] The electronic document classification method provided by this invention determines whether the content of the electronic document has been modified by comparing the extracted last modification time of the electronic document with the actual last modification time of the electronic document. This realizes the identification of the risk of the document content being modified after being classified, and improves the security of classification.

[0065] According to a method for classifying electronic documents provided by the present invention, the method for obtaining the format type of the electronic document includes: determining that the electronic document is a DOCX, XLSX, or PPTX format file if the PK header of the electronic document contains 50 4B 03 04; determining that the electronic document is a DOC, WPS, XLS, ET, PPT, or DPS format file if the first 8 bytes of the electronic document are D0 CF 11E0 A1 B1 1A E1; determining that the electronic document is a PDF format file if the file header of the electronic document contains %PDF-version number; and determining that the electronic document is an OFD format file if the electronic document includes an ofd.xml file.

[0066] This invention can add security classification labels to 11 mainstream electronic documents, automatically identify the file format, and add security classification labels to the attribute field area of ​​the file for different formats. The security classification labels will not be lost during the copying, cutting, modification and transmission of the file. At the same time, the user's opening, reading and writing process is the same as that without the added security classification labels, without changing the user's usage habits.

[0067] Different file formats have different structures. When decrypting a file, the first step is to determine its format type, which is distinguished by the file header. Files can be classified into the following categories according to their structure:

[0068] DOCX, XLSX, PPTX: PK header files containing 50 4B 03 04 indicate that the file belongs to this format;

[0069] DOC, WPS, XLS, ET, PPT, DPS: The first 8 bytes of the file are D0 CF 11E0A1 B1 1A E1, indicating that the file belongs to this format;

[0070] PDF: The file header is %PDF-version number, indicating that the file belongs to this format;

[0071] OFD: OFD is actually a compressed file. Check if there is an ofd.xml file in the compressed file. If the file is there, it means that the file belongs to this format. Specifically, you can check if there is an ofd.xml file by checking the ofd:OFD XML declaration.

[0072] The electronic document encryption method provided by this invention enables the identification of mainstream electronic document format types.

[0073] According to a method for classifying electronic documents provided by the present invention, the classification identifier of the electronic document is added to the attribute domain area, including: for DOCX, XLSX, or PPTX format files, adding the classification identifier of the electronic document to the Custom.xml node; for DOC, WPS, XLS, ET, PPT, or DPS format files, adding the classification identifier of the electronic document to the CustomDocumentProperties storage area; for PDF format files, adding the classification identifier of the electronic document to the Info dictionary; and for OFD format files, adding the classification identifier of the electronic document to the OFD metadata area.

[0074] For DOCX, XLSX, or PPTX format files, the attribute field area is the Custom.xml node; for DOC, WPS, XLS, ET, PPT, or DPS format files, the attribute field area is the CustomDocumentProperties storage area; for PDF format files, the attribute field area is the Info dictionary; for OFD format files, the attribute field area is the OFD metadata area. Security level identifiers are added to the corresponding attribute field areas for different file format types.

[0075] Eleven types of electronic documents have unique file structures, including attribute fields. Adding attribute values ​​to these fields will not affect the file; the file can be opened directly without processing and will not be lost during file sending, modification, copying, or moving. For CFB structure files (including DOC, WPS, XLS, ET, PPT, or DPS formats), attribute values ​​are added to the CustomDocumentProperties storage area with the key name _SecTag and the value being the attribute value. This is done by parsing the file structure and adding the values ​​to the corresponding locations. For DOCX, XLSX, and PPTX formats, the XML file is written to the Custom.xml node. For PDF files, new entries are added to the Info dictionary using the PDF dictionary object. For OFD format, attribute values ​​are added to the OFD metadata area, as shown in Table 1.

[0076] Table 1

[0077]

[0078] The electronic document security marking method provided by this invention enables the addition of security level identifiers to the attribute field area in mainstream electronic documents.

[0079] Figure 2 This is the second flowchart illustrating the electronic document encryption method provided by this invention. For example... Figure 2 As shown, the method includes:

[0080] Obtain the creation time and last modification time of the electronic document;

[0081] The security classification attribute data is processed to obtain the security classification identifier; for example, the security classification attribute data, including the protocol version number of the electronic document, the security classification of the electronic document, the creation time of the electronic document, and the last modification time of the electronic document, is processed into JSON format data to obtain the security classification identifier.

[0082] The security level identifier is encrypted and then embedded in the attribute field area of ​​the file.

[0083] Figure 3 This is the third flowchart illustrating the electronic document encryption method provided by this invention. For example... Figure 3 As shown, the method includes:

[0084] When it is necessary to obtain the security classification of a file, the file format is first parsed to obtain the security classification identifier, which includes security classification identifier attribute data. The security classification identifier is decrypted twice, and the data after decryption is parsed to obtain the electronic file's protocol version number, electronic file security classification, electronic file creation time, and electronic file last modification time. The electronic file creation time is compared with the actual electronic file creation time. If the electronic file creation time obtained after decrypting the security classification identifier is inconsistent with the actual electronic file creation time, it means that the security classification identifier (attribute data has been tampered with), and the attribute has been tampered with, and an alarm is triggered. If the electronic file creation time obtained after decrypting the security classification identifier is consistent with the actual electronic file creation time, the electronic file last modification time obtained after decrypting the security classification identifier is further compared with the actual electronic file last modification time. If the electronic file last modification time is inconsistent with the actual electronic file last modification time, it means that the content of the file has been modified after being classified, and the content has been modified, and the file needs to be reclassified. If the electronic file last modification time is consistent with the actual electronic file last modification time, the electronic file security classification is returned.

[0085] The electronic document security labeling method provided by this invention implements a tamper-proof labeling approach. It binds the electronic document's creation time and last modification time to its security level attribute as a security level identifier, embedding this identifier into the file. This ensures the security level is always bound to the file, even when it's not running on the same system. It is also cross-system identifiable and supports verification on both Windows and Linux platforms. The security level attribute uses the file creation time (ct) as the baseline anchor point to prevent file replacement attacks that could lead to the complete replacement of file attributes. The embedded attributes are Base64URL encoded to avoid special characters causing attribute writing or parsing failures. When identifying the file's security level attribute, a security level attribute detection mechanism can determine whether the file has been tampered with after security labeling, preventing leaks of the labeled file.

[0086] The electronic document marking device provided by the present invention is described below. The electronic document marking device described below and the electronic document marking method described above can be referred to in correspondence.

[0087] Figure 4 This is a schematic diagram of the electronic document encryption device provided by the present invention. Figure 4 As shown, the device includes an acquisition module 10, a determination module 20, and an addition module 30, wherein: the acquisition module 10 is used to: acquire the format type of the electronic file; the determination module 20 is used to: determine the attribute field area according to the format type; wherein the attribute field area will not affect the content of the electronic file, the opening and reading / writing of the electronic file, and the information in the attribute field area will not be lost during the sending, modification, copying, and moving of the electronic file; the addition module 30 is used to: add the security classification identifier of the electronic file to the attribute field area.

[0088] The electronic document security marking device provided by the present invention obtains the format type of the electronic document, determines the attribute field area according to the format type, and adds the security level identifier of the electronic document to the attribute field area. This realizes that the security marking of electronic documents is independent of the system and that the security marking of electronic documents does not affect the operation of electronic documents.

[0089] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can invoke logical instructions in the memory 530 to execute an electronic document classification method, which includes: obtaining the format type of the electronic document; determining an attribute field region based on the format type; wherein the attribute field region does not affect the content of the electronic document, the opening and reading / writing of the electronic document, and the information in the attribute field region is not lost during the sending, modification, copying, and moving of the electronic document; and adding the security classification identifier of the electronic document to the attribute field region.

[0090] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0091] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the electronic document classification method provided by the above methods. The method includes: obtaining the format type of the electronic document; determining an attribute field area according to the format type; wherein the attribute field area does not affect the content of the electronic document, the opening and reading / writing of the electronic document, and the information in the attribute field area is not lost during the sending, modification, copying, and moving of the electronic document; and adding the confidentiality identifier of the electronic document to the attribute field area.

[0092] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the electronic document classification method provided by the above methods. The method includes: obtaining the format type of the electronic document; determining an attribute field region based on the format type; wherein the attribute field region does not affect the content of the electronic document, the opening and reading / writing of the electronic document, and the information in the attribute field region is not lost during the sending, modification, copying, and moving of the electronic document; and adding the security classification identifier of the electronic document to the attribute field region.

[0093] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0094] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0095] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0097] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for marking electronic documents with confidentiality, characterized in that, include: Obtain the format type of the electronic document; The attribute field area is determined according to the format type; wherein, the attribute field area will not affect the content of the electronic file, the opening and reading / writing of the electronic file, and the information in the attribute field area will not be lost during the sending, modification, copying and moving of the electronic file; Add the security classification identifier of the electronic document to the attribute field area.

2. The electronic document encryption method according to claim 1, characterized in that, Before adding the security classification identifier of the electronic document to the attribute field area, the method further includes: Obtain the security classification attribute data of the electronic document; wherein, the security classification attribute data includes the protocol version number of the electronic document, the security classification of the electronic document, the creation time of the electronic document, and the last modification time of the electronic document; The security level identifier is generated based on the security level identifier attribute data, and the security level identifier is encrypted according to a preset encryption method.

3. The electronic document encryption method according to claim 2, characterized in that, The step of generating the security level identifier based on the security level identifier attribute data includes: The security classification attribute data is processed into JSON format to obtain the security classification identifier.

4. The electronic document encryption method according to claim 3, characterized in that, The step of encrypting the security level identifier according to a preset encryption method includes: The security level identifier in JSON format is first encrypted using AES-256, and then further encrypted using Base64URL encoding.

5. The electronic document encryption method according to claim 2, characterized in that, After adding the security classification identifier of the electronic document to the attribute field area, the method further includes: Extract the encrypted security level identifier from the attribute domain region; The encrypted security level identifier is decrypted according to the decryption method corresponding to the encryption method; The creation time of the electronic file can be extracted based on the decrypted security classification identifier; The extracted creation time of the electronic file is compared with the actual creation time of the electronic file; If the extracted creation time of the electronic document matches the actual creation time of the electronic document, then it is determined that the security classification identifier has not been tampered with. If the extracted creation time of the electronic document is inconsistent with the actual creation time of the electronic document, it is determined that the security classification identifier has been tampered with.

6. The electronic document encryption method according to claim 2, characterized in that, After adding the security classification identifier of the electronic document to the attribute field area, the method further includes: Extract the encrypted security level identifier from the attribute domain region; The encrypted security level identifier is decrypted according to the decryption method corresponding to the encryption method; The last modification time of the electronic document is extracted based on the decrypted security classification identifier; The extracted last modification time of the electronic file is compared with the actual last modification time of the electronic file; If the extracted last modification time of the electronic document matches the actual last modification time of the electronic document, then it is determined that the content of the electronic document has not been modified. If the extracted last modification time of the electronic document is inconsistent with the actual last modification time of the electronic document, it is determined that the content of the electronic document has been modified.

7. The electronic document encryption method according to claim 1, characterized in that, The format types of the acquired electronic files include: If the PK header of the electronic file contains 50 4B 03 04, then the electronic file is determined to be a DOCX, XLSX, or PPTX format file. If the first 8 bytes of the electronic file are D0 CF 11E0 A1 B1 1A E1, then the electronic file is determined to be a DOC, WPS, XLS, ET, PPT or DPS format file. If the file header of the electronic document contains %PDF-version number, then the electronic document is determined to be a PDF format file; If the electronic file includes an ofd.xml file, then the electronic file is determined to be an OFD format file.

8. The electronic document encryption method according to claim 7, characterized in that, Adding the security classification identifier of the electronic document to the attribute field area includes: For DOCX, XLSX, or PPTX format files, add the security classification identifier of the electronic file to the Custom.xml node; For DOC, WPS, XLS, ET, PPT or DPS format files, add the security classification identifier of the electronic file to the CustomDocumentProperties storage area; For PDF format files, add the security classification identifier of the electronic file to the Info dictionary; For OFD format files, the security classification identifier of the electronic file is added to the OFD metadata area.

9. An electronic document encryption device, characterized in that, include: The acquisition module is used to: acquire the format type of electronic documents; The determination module is used to: determine the attribute field area according to the format type; wherein the attribute field area will not affect the content of the electronic file, the opening and reading / writing of the electronic file, and the information in the attribute field area will not be lost during the sending, modification, copying and moving of the electronic file; An add module is used to add the security classification identifier of the electronic document to the attribute field area.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the electronic document encryption method as described in any one of claims 1 to 8.

Images