Taking-out file approval method and system, storage medium and equipment

Abstract

The invention relates to the technical field of data security, and particularly provides a takeout file approval method and system, a storage medium and equipment, and the method comprises the steps: responding to a takeout request of a user for a takeout file, scanning the file, and generating file scanning data; the takeout request comprises target use scene information; performing sensitivity analysis on the file scanning data to generate a sensitive attribute result; determining the sensitivity level of the file based on the sensitive attribute result and the target use scene information; and performing corresponding approval processing on the files with different sensitivity levels. According to the method, the sensitivity level of the file is determined based on the sensitive attribute result and the target use scene information, and the files with different sensitivity levels are subjected to different approval processing, so that dynamic standardized adaptation of the sensitivity level of the takeaway file is realized, subjective deviation of manual judgment can be avoided, and consistency and accuracy of risk pre-judgment can be improved; and meanwhile, the security supervision of the takeout file is enhanced, and the leakage risk is reduced.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method, system, storage medium and device for approving outbound documents. Background Technology

[0002] In the digital age, data has become a core asset for enterprises, and frequent data breaches have resulted in huge losses. In the area of ​​enterprise document security management, determining the sensitivity level of a document is the core basis for deciding on approval processes and security strategies.

[0003] In existing technologies, enterprises often use a static, inherent attribute-based judgment model to classify the sensitivity of documents. This means that a fixed sensitivity level is preset based solely on the inherent sensitive characteristics of the document itself, and the same approval process is executed. As a result, since the sensitivity level is fixed, the corresponding approval level, encryption strength, and usage permissions are also fixed, leading to extreme cases of over-control or under-control. This not only fails to meet security management needs but also reduces office efficiency. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method, system, storage medium, and device for approving outbound documents. By dynamically adapting the sensitivity level of the documents, it can improve the accuracy of risk prediction during the approval process of outbound documents and reduce the risk of leakage.

[0005] To achieve the objectives of this application, the following technical solution is provided: Firstly, this application provides a method for approving out-of-bounds documents, including: In response to a user's request to bring a file to the outside, the file is scanned and file scan data is generated; the outside request includes target usage scenario information; The file scan data is subjected to sensitivity analysis to generate sensitive attribute results; then, based on the sensitive attribute results and the target usage scenario information, the sensitivity level of the file is determined. Documents with different sensitivity levels will be subject to corresponding approval processes.

[0006] A further improvement of this invention is that the document scan data is at least one of text content, image information, and structured data, and the sensitive attribute result includes a sensitivity score; the sensitivity analysis of the document scan data to generate sensitive attribute results includes: extracting and comparing sensitive information in the document scan data based on a constructed sensitive information database to obtain sensitive information sets corresponding to different levels of sensitivity; determining the frequency of occurrence of sensitive information in each sensitive information set; and calculating the sensitivity score of the document using a weighted summation method based on a preset weight corresponding to each sensitive information set; wherein, the content for calculating the sensitivity score of the document is: ;in, For sensitivity scores, Weighting for highly sensitive information Weighting of sensitive information Weights for low-sensitivity information The frequency of highly sensitive information appearing The frequency of the occurrence of sensitive information The frequency of occurrence of low-sensitivity information.

[0007] A further improvement of this invention is that determining the sensitivity level of the file based on the sensitive attribute results and the target usage scenario information includes: determining a first sensitivity level based on the sensitivity score; the first sensitivity level is one of multiple levels; determining a scenario risk level corresponding to the target usage scenario based on the target usage scenario information; the scenario risk level is one of the multiple levels; judging the compatibility between the first sensitivity level and the scenario risk level; if the first sensitivity level and the scenario risk level are not compatible, adjusting the first sensitivity level to obtain a second sensitivity level, and determining the second sensitivity level as the sensitivity level of the file; if the first sensitivity level and the scenario risk level are compatible, determining the first sensitivity level as the sensitivity level of the file.

[0008] A further improvement of this invention is that, for each target usage scenario, the risk level of the scenario is determined based on the probability and impact of information leakage corresponding to the target usage scenario; the process of judging the compatibility between the first sensitivity level and the scenario risk level, and adjusting the first sensitivity level to obtain a second sensitivity level when the first sensitivity level and the scenario risk level do not match, includes: judging the target usage scenario and the attribute type of the file based on a preset compatibility mapping table; and increasing the first sensitivity level by an adjustment coefficient rule to obtain the second sensitivity level when the attribute type and the target usage scenario do not conform to the mapping relationship; wherein the adjustment coefficient rule corresponds to an adjustment coefficient range of -1 to +1.

[0009] A further improvement of the present invention is that, in the case where the first sensitivity level and the scenario risk level are not compatible, adjusting the first sensitivity level to obtain a second sensitivity level includes: when the first sensitivity level is lower than the scenario risk level, adjusting the first sensitivity level to the level corresponding to the scenario risk level to obtain the second sensitivity level; and in the case where the first sensitivity level and the scenario risk level are compatible, determining the first sensitivity level as the sensitivity level of the file includes: when the first sensitivity level is higher than or equal to the scenario risk level, determining the first sensitivity level as the sensitivity level of the file.

[0010] A further improvement of this invention is that the corresponding approval process for files with different sensitivity levels includes: for files with a sensitivity level of 1, no encryption is applied, and approval is granted directly; for files with a sensitivity level of 2, read-only encryption is applied, and approval is carried out through a manual approval process; for files with a sensitivity level of 3, editable but not forwardable encryption is applied, and the approval nodes include at least two levels of supervisors; for files with a sensitivity level of 4, permission binding and device binding are applied, and the approval nodes include supervisors and information security department nodes.

[0011] A further improvement of the present invention is that, for files with a sensitivity level of 1 and files with a sensitivity level of 2, after the approval process, the method further includes: calculating a permission opening coefficient for the file based on the security level of the outbound device and the security level of the outbound scenario; determining the outbound permissions for the file according to the permission opening coefficient; wherein the outbound permissions are either only electronic permissions or full copy and print permissions.

[0012] Secondly, this application provides an off-site document approval system for implementing the above-mentioned off-site document approval method. The system includes: The first generation module is used to respond to a user's outbound file request, scan the file, and generate file scan data; the outbound request includes target usage scenario information; The second generation module is used to perform sensitivity analysis on the file scan data and generate sensitive attribute results; then, based on the sensitive attribute results and the target usage scenario information, the sensitivity level of the file is determined. The approval module is used to process documents with different sensitivity levels accordingly.

[0013] Thirdly, this application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the outbound document approval method described above.

[0014] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described out-of-bounds document approval method.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The method, system, storage medium, and device for approving outbound documents provided in this application dynamically adjust the sensitivity level of documents based on the target usage scenario information and sensitive attribute results in the received outbound requests, and perform different approval processes for documents with different sensitivity levels. This achieves dynamic standardized adaptation of the sensitivity level of outbound documents, avoids subjective bias in manual judgment, and improves the consistency and accuracy of risk prediction. At the same time, it strengthens the security supervision of outbound documents and reduces the risk of leakage. Attached Figure Description

[0016] The accompanying drawings are provided to further understand this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. Figure 1 A schematic diagram of an optional outbound document approval method provided in an embodiment of this application; Figure 2 A schematic diagram of an optional structure of the outbound document approval system provided in this application embodiment; Figure 3 A schematic diagram of an optional structure of the outbound document approval system provided in this application embodiment; Figure 4 A schematic diagram of an optional structure of the scanning and parsing module provided in an embodiment of this application; Figure 5 A schematic diagram of an optional structure of the low-sensitivity file processing module provided in an embodiment of this application; Figure 6 This is a schematic diagram of an optional structure of the highly sensitive file processing module provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature; in the description of this application, unless otherwise stated, "multiple" means two or more.

[0019] In the digital age, data has become a core asset for enterprises, and frequent data breaches have led to huge losses. In data leakage prevention (DLP) systems, document approval is a critical step, but traditional manual approval suffers from problems such as low efficiency, accuracy being greatly affected by human factors, and a lack of real-time monitoring, early warning, and effective traceability mechanisms.

[0020] Current solutions do not consider the impact of document out-of-home scenarios on sensitivity. For example, the risk of leakage for the same internal sensitive document differs significantly depending on whether it is taken to a remote branch office or a public environment for customer demonstrations. However, current technology still applies the same approval process at a fixed level, which can easily lead to over- or under-control. Furthermore, because the sensitivity level is fixed, the corresponding approval level, encryption strength, and access permissions also remain unchanged. To avoid security vulnerabilities caused by a fixed level, current solutions often adopt a one-size-fits-all high-level control strategy. While this can improve security, it significantly increases the approval and time costs in low-risk scenarios. Conversely, simplifying the process can easily lead to security risks in high-risk scenarios.

[0021] To address the aforementioned technical problems, the present invention proposes the following technical solutions and corresponding embodiments.

[0022] The following is combined Figures 1 to 6 The illustrated embodiments describe the technical solution of the present invention: Example 1 This application provides an embodiment of a method for approving off-site documents, referring to... Figure 1 As shown, the steps include S101 to S103 as follows: Step S101: In response to the user's request to bring out a file, scan the file and generate file scan data; the request to bring out a file includes target usage scenario information.

[0023] In this embodiment, the target use scenario (outbound scenario) is one or more scenarios in a scenario list established based on the enterprise's business type and historical use scenarios. The target use scenario information is the scenario identifier corresponding to the target use scenario determined in the outbound request, so as to identify the target use scenario in the scenario list. As a feasible implementation method, the target use scenario can be any one or more of the following: remote branch office environment, external partner office environment, specific institutional environment, public environment, and personal home environment.

[0024] In this embodiment, when a user requests to decrypt and take a file (external file) out, the system automatically triggers a file scanning request, scans the external file, and generates file scan data. In this embodiment, for a scanned (external) file, the corresponding file scan data can be directly retrieved.

[0025] In this embodiment, the document scanning data may include text content, image information, and structured data. For text content, this embodiment uses OCR technology to recognize text in images and PDFs, and directly reads the character content of text files such as Word and TXT. For image information, this embodiment uses image recognition technology to parse the core information such as text, graphics, and logos in the image. For structured data, this embodiment directly reads fixed field data from Excel, database exported files, and form-type documents to clarify the meaning of the fields.

[0026] In this embodiment of the application, when an employee submits a request to take out a product, a field for filling in scenario information can be added. The field includes: usage environment, purpose of use, recipient, and scope of dissemination (the system automatically associates the scenario risk level).

[0027] Step S102: Perform sensitivity analysis on the file scan data to generate sensitive attribute results; then determine the sensitivity level of the file based on the sensitive attribute results and the target usage scenario information.

[0028] In this embodiment of the application, the sensitive attribute result refers to the sensitive resolution result combining the inherent sensitive attributes of the file. The inherent sensitive attributes may include information type, data dimension, and permission association degree. Among them, the information type may include confidential information, core business information, internal sensitive information, internal non-sensitive information, and public information; the data dimension may include core technical data, financial data, customer data, ordinary business data, and non-core data; and the permission association degree may include executive exclusive, position exclusive, team visible, department visible, and all visible.

[0029] As a feasible implementation method, the sensitivity attribute result is the sensitivity score of the file. Specifically, sensitive information in the file scan data is extracted and compared based on the constructed sensitive information database to obtain sensitive information sets corresponding to different levels of sensitivity; for each sensitive information set, the frequency of occurrence of sensitive information (sensitive text, sensitive core information, sensitive fields) is determined; based on the preset weights corresponding to each sensitive information set, the sensitivity score of the file is calculated using a weighted summation method. The calculation of the file's sensitivity score includes: ; in, For sensitivity scores, Weighting for highly sensitive information Weighting of sensitive information Weights for low-sensitivity information The frequency of highly sensitive information appearing The frequency of the occurrence of sensitive information The frequency of occurrence of low-sensitivity information.

[0030] In this embodiment, for the text content of the document scan data, semantic analysis is used to identify and extract sensitive information, which is then matched with a constructed sensitive information database to mark the location of sensitive information (sensitive text) in the text content. For example, sensitive information may include customer mobile phone numbers, business plans, technical parameter descriptions, etc. In this embodiment, for the image information in the document scan data, image recognition technology is used to analyze the core information such as text, images, and logos in the image. The identified core information is compared with features in a pre-constructed sensitive image feature database. Sensitive information is marked when the similarity between the obtained core information and the feature database exceeds a preset threshold. Simultaneously, OCR is used to extract text from the image for auxiliary determination. Sensitive information may include classified chart templates, etc. In this embodiment, for the structured data of the document scan data, field value threshold checks are performed to verify whether a field is on the data sensitive field list, ultimately determining the sensitive information.

[0031] This embodiment comprehensively utilizes text recognition, image recognition, and data mining technologies to identify and analyze file information. Leveraging an intelligent scanning architecture that integrates multiple technologies and a dynamic sensitivity assessment mechanism, the system can accurately identify sensitive information within files. Sensitivity analysis algorithms quantify file risks, and the dynamically updated sensitive information database reduces bias from subjective human judgment. Automated decryption and encrypted transmission and storage mechanisms for low-sensitivity files, along with multi-stage manual review for high-sensitivity files, construct a multi-layered security protection system to safeguard the security of core enterprise data.

[0032] In this embodiment, a first sensitivity level is first determined based on a sensitivity score; the first sensitivity level is one of five levels from level one to level five. The scenario risk level corresponding to the target usage scenario is then determined based on the target usage scenario information; here, the scenario risk level is also one of five levels from level one to level five. Then, the compatibility between the first sensitivity level and the scenario risk level is judged to obtain a second sensitivity level as the final sensitivity level. Specifically, if the first sensitivity level and the scenario risk level do not match, the first sensitivity level is adjusted to obtain the second sensitivity level, and this second sensitivity level is determined as the sensitivity level of the file. If the first sensitivity level and the scenario risk level match, the first sensitivity level remains unchanged, i.e., the first sensitivity level is determined as the sensitivity level of the file. Here, compatibility refers to whether the external scenario and the file are compatible, and the degree of compatibility. As a feasible implementation method, the compatibility judgment criterion is based on a preset compatibility mapping table. In this embodiment of the application, the target usage scenario and the attribute type of the file are determined based on a preset adaptability mapping table. If the attribute type and the target usage scenario do not match the mapping relationship, the first sensitivity level is increased by an adjustment coefficient rule to obtain the second sensitivity level. The adjustment coefficient rule corresponds to an adjustment coefficient range of -1 to +1.

[0033] Here, the first sensitivity level is determined by classifying sensitivity scores using preset thresholds of varying degrees. In this embodiment, for each target use scenario, a quantitative scoring method is used to determine the scenario risk level (levels 1-5, with level 5 being the highest) based on the probability of leakage and the degree of impact of leakage corresponding to the target use scenario.

[0034] As a feasible implementation method, the adjustment coefficient rule is determined based on the compatibility between the scenario and the document. If the compatibility is high (such as core documents used in core business scenarios), the adjustment level is increased by 0.5-1 levels; if the compatibility is low (such as confidential documents used in public scenarios), the adjustment level is increased by 2 levels; and if there is no compatibility (such as classified documents used for public dissemination), the adjustment level is directly set to the highest level.

[0035] In this embodiment of the application, documents involving state secrets or trade secrets are directly assigned to Level 5, the highest level of sensitivity, regardless of the risk level of the scenario. Simultaneously, the first sensitivity level of publicly available information within the enterprise is fixed at Level 1, and the second sensitivity level, after adjustment by the adjustment coefficient rules, cannot exceed Level 2.

[0036] As a feasible implementation method, if the first sensitivity level is lower than the scenario risk level, the first sensitivity level is adjusted to the level corresponding to the scenario risk level to obtain a second sensitivity level; if the first sensitivity level is higher than or equal to the scenario risk level, the first sensitivity level is determined as the sensitivity level of the file. For example, if the file's attribute category is business data and the external scenario is an external partner's office environment, the external scenario is determined to be compatible with the file, and the sensitivity level in this case is determined based on the higher of the first sensitivity level and the scenario risk level.

[0037] In this embodiment, the scenario list is updated quarterly or semi-annually to add new scenarios and / or adjust the risk levels of each scenario. Each time a new scenario is added or the risk levels of each scenario are adjusted, the corresponding attribute information is promptly added.

[0038] In this embodiment of the application, after determining the sensitivity level of a file, a permission adaptation coefficient can be dynamically calculated based on the file's subsequent outbound scenarios to assist in subsequent permission configuration. The permission adaptation coefficient is calculated as follows: A = 0.5 × Snorm + 0.3 × E + 0.2 × N, where A is the permission adaptation coefficient, Snorm is the normalized value of the initial sensitivity score S, E is the security level of the outbound device, and N is the network security level of the outbound network.

[0039] Step S103: Perform corresponding approval processing on documents with different sensitivity levels.

[0040] In this embodiment, files with a sensitivity level of 1 are not encrypted and are directly approved (automatic authorization); files with a sensitivity level of 2 are read-only encrypted and approved through a manual approval process, restricting forwarding; files with a sensitivity level of 3 are editable but not forwardable encrypted, with approval nodes including at least two levels of supervisors and bound to designated devices; files with a sensitivity level of 4 are subject to permission and device binding, with approval nodes including supervisors and information security department nodes; and files with a sensitivity level of 5 are limited to the user's personal use and are subject to real-time auditing.

[0041] In this embodiment, for files with a sensitivity level of 1 and a sensitivity level of 2, after approval, a permission opening coefficient is calculated for the file based on the security level of the outbound device and the security level of the outbound scenario; then, the outbound permission for the file is determined according to the permission opening coefficient; this outbound permission may be limited to electronic access only, or it may include full copying and printing permissions. For example, the permission opening coefficient... The calculation formula is:

[0042] in, This represents the access level factor. For the safety level of portable devices, For outdoor scenarios, the safety level is as follows; when Full copy and print permissions are granted when the value is ≥0.8; when... When the value is less than 0.8, only online viewing access is available.

[0043] In this embodiment, a manual approval process for highly sensitive documents is customized according to the enterprise's security policy and management requirements. Multiple approval stages are set up with corresponding approval permissions and standards. Approval reminders are sent to approvers, the approval process is tracked in real time, approval opinions and approval time are recorded, and the approval results are fed back to the user and processed accordingly.

[0044] The outbound file approval method, system, storage medium, and device provided in this embodiment dynamically adjust the sensitivity level of the file based on the target usage scenario information and sensitive attribute results in the received outbound request, and perform different approval processes for files with different sensitivity levels. This achieves dynamic standardized adaptation of the sensitivity level of outbound files, avoids subjective bias in manual judgment, and improves the consistency and accuracy of risk prediction. At the same time, it strengthens the security supervision of outbound files and reduces the risk of leakage.

[0045] Example 2 Based on the above embodiments, this embodiment also provides an off-site document approval system for implementing the off-site document approval method of Embodiment 1 above, referring to... Figure 2 As shown, the outbound document approval system 200 of this embodiment includes: The first generation module 201 is used to scan the file and generate file scan data in response to a user's outbound file request; the outbound request includes target usage scenario information. The second generation module 202 is used to perform sensitivity analysis on the file scan data and generate sensitive attribute results; then, based on the sensitive attribute results and the target usage scenario information, the sensitivity level of the file is determined. The approval module 203 is used to perform corresponding approval processing on documents with different sensitivity levels.

[0046] In this embodiment of the application, the first generation module 201 is further configured to extract and compare sensitive information in the file scan data based on the constructed sensitive information database to obtain sensitive information sets corresponding to different levels of sensitivity; for each sensitive information set, determine the frequency of occurrence of the sensitive information therein; and calculate the sensitivity score of the file using a weighted summation method based on the preset weight corresponding to each sensitive information set.

[0047] In this embodiment of the application, the second generation module 202 is further configured to determine a first sensitivity level based on a sensitivity score; the first sensitivity level is one of multiple levels; determine the scenario risk level corresponding to the target usage scenario based on the target usage scenario information; the scenario risk level is one of multiple levels; determine the compatibility between the first sensitivity level and the scenario risk level; if the first sensitivity level and the scenario risk level do not match, adjust the first sensitivity level to obtain a second sensitivity level, and determine the second sensitivity level as the sensitivity level of the file; if the first sensitivity level and the scenario risk level match, determine the first sensitivity level as the sensitivity level of the file.

[0048] In this embodiment of the application, the second generation module 202 is further used to determine the target usage scenario and the attribute type of the file based on a preset adaptability mapping table. If the attribute type and the target usage scenario do not conform to the mapping relationship, the first sensitivity level is increased by an adjustment coefficient rule to obtain a second sensitivity level. The adjustment coefficient corresponding to the adjustment coefficient rule is in the range of -1 to +1.

[0049] In this embodiment of the application, the second generation module 202 is further configured to adjust the first sensitivity level to the level corresponding to the scenario risk level to obtain a second sensitivity level when the first sensitivity level is lower than the scenario risk level; and to determine the first sensitivity level as the sensitivity level of the file when the first sensitivity level is higher than or equal to the scenario risk level.

[0050] In this embodiment, the approval module 203 is further configured to: approve files with a sensitivity level of 1 without encryption; approve files with a sensitivity level of 2 by reading-only encryption and through a manual approval process; approve files with a sensitivity level of 3 by making them editable but not forwardable, with approval nodes including at least two levels of supervisors; and approve files with a sensitivity level of 4 by binding permissions and devices, with approval nodes including supervisors and information security department nodes.

[0051] The off-site document approval system in this embodiment also includes a permission determination module 204. This permission determination module 204 is used to calculate the permission opening coefficient of the document based on the security level of the off-site device and the security level of the off-site scenario after the approval is completed; and determine the off-site permission for the document according to the permission opening coefficient; the off-site permission is either only open for electronic access, or open for full copying and printing.

[0052] Example 3 Based on the above embodiments, this embodiment provides yet another off-site document approval system, referring to... Figure 3As shown, the outbound document approval system 300 includes a trigger module 301, a scanning and parsing module 302, a low-sensitivity document processing module 303, and a high-sensitivity document processing module 304; wherein: Trigger module 301 is used to receive the user's decryption outbound request and trigger a file scanning request; Scanning and parsing module 302, refer to Figure 4 As shown, the system includes a document scanning unit 3021, a sensitivity analysis unit 3022, a sensitive information database management unit 3023, a multi-technology fusion scanning unit 3024, and a dynamic sensitivity assessment unit 3025. The document scanning unit 3021 comprehensively scans documents using multiple scanning technologies to obtain detailed information, such as reading text file content, converting images to text using OCR, and analyzing the structural features of binary files. The sensitivity analysis unit 3022 employs a sensitivity analysis algorithm, combined with a sensitive information database, to calculate a sensitivity score and determine the level by matching and statistically analyzing keywords and other information in the documents according to preset rules. The sensitive information database management unit 3023 is used to establish, update, and maintain the sensitive information database, and regularly collects and organizes new sensitive information. Sensitive information is categorized, stored, and managed to ensure accuracy and timeliness. A multi-technology fusion scanning unit 3024 is used to comprehensively utilize text recognition, image recognition, and data mining technologies to identify and analyze file information. For example, it combines OCR and deep learning to improve the accuracy of image text recognition and uses data mining to analyze structured data to discover sensitive information. A dynamic sensitivity assessment unit 3025 is used to adjust the file sensitivity level based on user operation behavior data and file usage scenario data by calculating dynamic factor scores in real time. For example, a weighted scoring method is used to calculate the sensitivity score in real time. The dynamic sensitivity calculation formula is: Real-time sensitivity score = Initial sensitivity score × 0.6 + Dynamic factor score × 0.4. Here, the initial sensitivity score is the aforementioned sensitivity score. Dynamic factors can be the scenario risk level of the target usage scenario. In this embodiment, the scanning and parsing module 302 further includes an intelligent learning and optimization unit 3026. The intelligent learning and optimization unit 3026 optimizes the sensitivity analysis algorithm and sensitive information database by learning and analyzing a large number of document scanning and parsing results, automatically discovers new sensitive information patterns using machine learning, and adjusts the evaluation rules. As a feasible implementation method, a supervised learning algorithm is used to train historical approval data to build an adaptive learning model. The model parameters are updated in real time through online learning functions, the model performance is evaluated regularly, and a retraining process is triggered to optimize the accuracy of the sensitivity analysis algorithm.

[0053] Low-sensitivity file processing module 303, refer to Figure 5As shown, the system includes an approval tag adding unit 3031, a declassification and tag processing unit 3032, a permission and log management unit 3033, an encrypted transmission and storage unit 3034, a permission verification and update unit 3035, and a file integrity verification unit 3036. The approval tag adding unit 3031 automatically adds an approval-approved tag to low-sensitivity files determined to be of low sensitivity level to indicate that the file has passed automatic approval. The declassification and tag processing unit 3032 declassifies low-sensitivity files, adding a declassification identifier and a usage permission tag. The declassification process uses a data declassification algorithm, and the permission tag is embedded in the form of a digital signature or encrypted watermark. The permission and log management unit 3033 refines the settings for external access permissions, records file operation logs, and stores the logs for easy querying and traceability; the encrypted transmission and storage unit 3034 uses SSL / TLS protocol for encryption during transmission and AES-256 algorithm for local storage encryption during storage to ensure file security; the permission verification and update unit 3035 verifies user access permissions in real time through edge nodes and cloud servers, automatically updates tags and notifies users when permissions change; the file integrity verification unit 3036 periodically verifies file integrity, calculates and compares hash values ​​using a hash algorithm (SHA-256 algorithm), and promptly alerts and handles cases of tampering.

[0054] Highly sensitive file processing module 304, refer to Figure 6 As shown, the system includes a manual approval submission unit 3041, an approval process customization unit 3042, an approval tracking and feedback unit 3043, an approval reminder and notification unit 3044, an approval opinion management unit 3045, and an approval result traceability unit 3046. The manual approval submission unit 3041 submits highly sensitive documents to the manual approval process, sending an approval request containing basic document information to the corresponding approver. The approval process customization unit 3042 customizes the approval process according to enterprise requirements, configuring approval steps, personnel, and permissions through a workflow engine. The approval tracking and feedback unit 3043 tracks the approval process in real time and records approval opinions. The approval process is streamlined, with timely feedback to users and a progress tracking function. The approval reminder and notification unit 3044 sends reminders and expedited notifications to approvers via email, SMS, and other multi-channel messaging. The approval opinion management unit 3045 provides rich text editing for unified management of approval opinions, supporting input, modification, querying, and statistics. The approval result traceability unit 3046 establishes a traceability mechanism to record and save the approval process and results in detail, facilitating the tracing of leaks and security audits. This includes building a full-chain approval archive and using a correlation analysis engine to identify approval anomalies, supporting the tracing of responsibility and analysis of causes for leaks.

[0055] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method in any of the embodiments of this application. Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU) of the system or apparatus can read and execute the program code stored in the storage medium.

[0056] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the functions defined above in the system of this application.

[0057] It should be noted that the computer-readable storage medium shown in this invention can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. For example, a computer-readable storage medium can be an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable storage medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0058] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0059] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0060] It should be noted that although several modules or units of the device for performing actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0061] In the several embodiments provided in this application, it should be understood that the disclosed systems, modules, and methods can be implemented in other ways. For example, the module embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between modules or units, and may be electrical, mechanical, or other forms.

[0062] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. This application is not limited to the exact structures described above and illustrated in the accompanying drawings, and it should not be considered that the specific implementation of this application is limited to these descriptions. For those skilled in the art, various changes and modifications made without departing from the concept of this application should be considered to fall within the protection scope of this application.

Claims

1. A method for approving off-site documents, characterized in that, include: In response to a user's request to bring a file to the outside, the file is scanned and file scan data is generated; the outside request includes target usage scenario information; The file scan data is subjected to sensitivity analysis to generate sensitive attribute results; then, based on the sensitive attribute results and the target usage scenario information, the sensitivity level of the file is determined. Documents with different sensitivity levels will be subject to corresponding approval processes.

2. The method for approving off-site documents according to claim 1, characterized in that, The document scan data is at least one of text content, image information, and structured data, and the sensitive attribute result includes a sensitivity score; the sensitivity analysis of the document scan data to generate sensitive attribute results includes: Based on the constructed sensitive information database, sensitive information in the file scan data is extracted and compared to obtain sensitive information sets corresponding to different levels of sensitivity; For each set of sensitive information, determine the frequency of occurrence of the sensitive information within it; Based on the preset weights corresponding to each set of sensitive information, the sensitivity score of the file is calculated using a weighted summation method. The content for calculating the sensitivity score of the file is as follows: ； in, For sensitivity scores, Weighting for highly sensitive information Weighting of sensitive information Weights for low-sensitivity information The frequency of highly sensitive information appearing The frequency of the occurrence of sensitive information The frequency of occurrence of low-sensitivity information.

3. The method for approving off-site documents according to claim 2, characterized in that, The process of determining the sensitivity level of the file based on the sensitive attribute results and the target usage scenario information includes: A first sensitivity level is determined based on the sensitivity score; the first sensitivity level is one of multiple levels. The scenario risk level corresponding to the target use scenario is determined based on the target use scenario information; the scenario risk level is one of the multiple levels. The compatibility between the first sensitivity level and the scenario risk level is determined. If the first sensitivity level and the scenario risk level are not compatible, the first sensitivity level is adjusted to obtain a second sensitivity level, and the second sensitivity level is determined as the sensitivity level of the file. If the first sensitivity level and the scenario risk level are compatible, the first sensitivity level is determined as the sensitivity level of the file.

4. The method for approving off-site documents according to claim 3, characterized in that, For each target use scenario, a risk level is determined based on the probability and impact of information leakage corresponding to the target use scenario; the compatibility between the first sensitivity level and the scenario risk level is assessed, and if the first sensitivity level and the scenario risk level are not compatible, the first sensitivity level is adjusted to obtain a second sensitivity level, including: Based on a preset adaptability mapping table, the target usage scenario and the attribute type of the file are determined. If the attribute type and the target usage scenario do not match the mapping relationship, the first sensitivity level is increased by an adjustment coefficient rule to obtain the second sensitivity level. The adjustment coefficient rule corresponds to an adjustment coefficient range of -1 to +1.

5. The method for approving off-site documents according to claim 3, characterized in that, In the event that the first sensitivity level and the scenario risk level are not compatible, adjusting the first sensitivity level to obtain a second sensitivity level includes: If the first sensitivity level is lower than the scenario risk level, the first sensitivity level is adjusted to the level corresponding to the scenario risk level to obtain the second sensitivity level; The step of determining the first sensitivity level as the sensitivity level of the file when the first sensitivity level and the scenario risk level are compatible includes: If the first sensitivity level is higher than or equal to the scenario risk level, the first sensitivity level is determined as the sensitivity level of the file.

6. The method for approving off-site documents according to any one of claims 1-5, characterized in that, The approval process for documents with different sensitivity levels includes: Files with a sensitivity level of 1 are not encrypted and are directly approved. For files with a sensitivity level of 2, read-only encryption is applied, and approval is carried out through a manual review process. For files with a sensitivity level of three, an editable but non-forwardable encryption process is applied, and the approval process includes at least two levels of supervisors. For files with a sensitivity level of four, permission binding and device binding are performed, and the approval nodes include the supervisor and the information security department nodes.

7. The method for approving off-site documents according to claim 1, characterized in that, For documents with a sensitivity level of 1 and documents with a sensitivity level of 2, after the approval process is completed, the method further includes: Based on the security level of the external device and the security level of the external scenario, calculate the permission openness coefficient for the file; The outbound permissions for the file are determined based on the permission openness coefficient; the outbound permissions may be either only electronic permissions or full copy and print permissions.

8. A system for approving outbound documents, used to implement the method for approving outbound documents according to any one of claims 1-7, characterized in that, include: The first generation module is used to respond to a user's outbound file request, scan the file, and generate file scan data; the outbound request includes target usage scenario information; The second generation module is used to perform sensitivity analysis on the file scan data and generate sensitive attribute results; then, based on the sensitive attribute results and the target usage scenario information, the sensitivity level of the file is determined. The approval module is used to process documents with different sensitivity levels accordingly.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the off-site document approval method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the off-site document approval method according to any one of claims 1 to 7.

Images