File outgoing management method and system, medium and product

Abstract

The invention discloses a file outgoing management method and system, a medium and a product, and relates to the field of data management. The method comprises the following steps: configuring a security policy for a to-be-sent basic file at a management end, and encrypting the basic file by using an encryption key to obtain a target file; packaging the target file, preset file management and control middleware and the unique file identifier to generate a controlled executable container; collecting current environment context data of the client through the controlled executable container; and obtaining a risk assessment result through the environment context data and the trusted environment features, issuing a decryption token to the controlled executable container when a first identifier in the risk assessment result is passing, and determining the strength of a to-be-executed adaptive response strategy according to a second identifier in the risk assessment result. By implementing the technical scheme, the security of the outgoing file in the transmission and reading process is improved, and the file is prevented from being illegally persisted and leaked.

Description

Technical Field

[0001] This application relates to the field of data management, and in particular to a method, system, medium, and product for managing the external distribution of documents. Background Technology

[0002] In today's digital age, the security and effective management of information are of paramount importance. With the increasing frequency of information exchange between enterprises and individuals, and the growing number of scenarios involving the external distribution of documents, higher demands are being placed on the security control of these documents.

[0003] Traditional methods for managing externally distributed files typically include the following: One is simple encryption, such as setting passwords to restrict access, allowing only those with the password to open the file. Another is setting access permissions, such as specifying different user permissions for files, like read-only or editable. Still other methods involve network security measures, such as firewalls and intrusion detection systems, to prevent unauthorized access to files from external networks.

[0004] However, existing methods for managing outgoing files have significant shortcomings. Simple encryption and permission settings are easily cracked and cannot effectively address increasingly complex security threats. Network security measures primarily focus on protecting external networks, with limited ability to control the security of files during internal use. Furthermore, existing methods struggle to dynamically assess and manage the risks associated with file usage, failing to promptly identify and address potential security risks. Summary of the Invention

[0005] This application provides a method, system, medium, and product for managing the external distribution of files. By identifying risks through dynamic risk assessment, behavioral baseline models, and other means, it implements adaptive response strategies to ensure the security of files during transmission and viewing, and prevents files from being illegally persisted and leaked.

[0006] Firstly, this application provides a method for managing the external distribution of documents, the method comprising: On the management side, a security policy is configured for the basic file to be sent out. The basic file is encrypted using an encryption key to obtain the target file. The encryption key is associated with the security policy and stored in an independent policy and key service center. A unique file identifier corresponding to the target file is generated. The security policy includes a basic usage policy, a context-aware policy, and an adaptive response policy. The basic usage policy is used to define the validity period and maximum number of times the target file can be opened. The context-aware policy is used to define the trusted environment characteristics in which the target file is allowed to be opened. The trusted environment characteristics include a whitelist of allowed application processes and a range of permitted network addresses. The adaptive response policy is used to define the rules for automatically escalating the control intensity when a risk event is detected. The target file, the preset file management middleware, and the unique file identifier are encapsulated to generate a controlled executable container; After the client starts the controlled executable container, the environment probe module embedded in the controlled executable container collects the client's current environment context data. The environment context data includes a list of currently running processes and network connection information. The environment context data and the unique file identifier are sent to the policy and key service center. The policy and key service center matches the environmental context data with the trusted environment features to perform dynamic risk assessment and obtain a risk assessment result. When the first identifier in the risk assessment result is "passed", a decryption token is issued to the controlled executable container, and the strength of the adaptive response policy to be executed is determined according to the second identifier in the risk assessment result.

[0007] By employing the above technical solution, environmental probes collect contextual data such as client running processes and network connections in real time, and match it with preset trusted environment characteristics to achieve dynamic risk assessment of the environment in which files are sent externally. Based on basic usage policies (validity period, number of times opened), context-aware policies (process whitelist, network scope), and adaptive response policies (risk event response rules), a multi-dimensional, condition-triggered, and granular access control mechanism is constructed. A key-and-file-separated encrypted storage method is used, dynamically decrypting file content only in memory using a decryption token, and preventing file content leakage by intercepting persistent operations (such as save as, storage API calls). Based on the risk assessment results, different levels of control operations (such as blocking access, upgrading authentication) are automatically triggered, achieving dynamic protection upgrades based on the risk profile and improving the ability to respond to unknown threats.

[0008] In some embodiments, the method further includes: monitoring the viewing process of the target file; if a risk event with a determined adaptive response strategy strength is identified during the monitoring process, then performing control operations according to the adaptive response strategy, specifically including: If a risk event corresponding to the strength of the adaptive response strategy is detected, a snare file fragment in the target file is obtained, and the information in the snare file fragment is dynamically rendered as a visible watermark covering the entire display area. An encrypted beacon containing a unique tracking identifier associated with the unique file identifier is deployed to the source IP address or untrusted process of the risk event. After the encrypted beacon runs in the target environment, it collects and sends back the characteristic information of the target environment to the policy and key service center. The policy and key service center receives and aggregates all feature information returned by the encrypted beacon, and performs correlation analysis with the information of the trap file fragment and the watermark trigger event log to construct a risk profile of the risk event. The risk profile includes path map, attack method and source attribute. Based on the severity and source of the attack in the risk profile, a matching adaptive response strategy is triggered, and the strength of the adaptive response strategy is adjusted.

[0009] By employing the above technical solution, a full-screen watermark is proactively displayed upon detecting a risk event. This not only serves as a warning and deterrent but, more importantly, transforms potential, hidden threats into visible and recordable events, providing a clear starting point for subsequent tracking. Encrypted beacons are deployed to the attack source; these beacons can operate within the target environment and transmit characteristic information back. This is a technology that shifts from passive defense to proactive reconnaissance, aiming to penetrate deep into the attacker's ranks and collect critical intelligence such as their identity, location, and technical methods. By correlating and analyzing watermarked events, captured file information, and beacon-transmitted data, a "risk profile" containing attack paths, methods, and sources is automatically constructed. This achieves a leap from isolated security events to a systematic understanding of attack activities, generating actionable threat intelligence. Based on the constructed accurate risk profile (rather than a single event), subsequent protection strategies and strengths are dynamically adjusted. This enables the security system to have self-evolution capabilities, allowing for the most effective response to threats of different levels and sources, forming a closed loop of "perception-assessment-decision-action."

[0010] In some embodiments, encrypting the underlying file using an encryption key includes: Based on the context of the base file, a text generation model is used to create semantically relevant but fictional trap text paragraphs, or, based on the original image of the base file, a trap image region containing artifacts or erroneous features is generated. In the trap text paragraph or the trap image area, structured metadata containing the unique file identifier, authorized user information and timestamp is embedded to form the trap file fragment; The captured file fragment is merged with the base file at a preset level in the document object tree, and the merged overall structure is uniformly encrypted using the encryption key to obtain the target file. The target file is configured such that when it is decrypted in memory by the file management middleware on the client, the file management middleware skips the captured file fragment according to the embedded rendering logic in normal viewing mode.

[0011] By employing the aforementioned technical solution, AI technology is used to generate fictitious content that is semantically or visually integrated with real documents. This ensures that the decoy fragments are highly deceptive and covert, making them difficult for attackers to identify and filter, thus effectively improving the success rate of decoy capture. Structured metadata, including file IDs and user information, is embedded in the decoy content, providing a unique "digital fingerprint" for subsequent security tracking. Once the decoy content is stolen or leaked, this information can be used to accurately locate the source of the leak and the specific file. The decoy fragments are deeply integrated with the real document structure and uniformly encrypted, ensuring the integrity and consistency of the target file. During normal viewing, the decoy content is actively skipped and completely transparent to the user, achieving a seamless connection between security protection and normal use. The entire design uses the decoy content as a "trap" pre-embedded in the file. These fragments are only triggered and exposed when an attacker attempts to extract or access the complete file content. This makes the security response no longer based on suspicious behavior, but on the precise capture and verification of malicious intent.

[0012] In some embodiments, the method further includes detecting a risk event corresponding to the strength of the adaptive response strategy by means of the following steps: Collect the first operation interaction data of the current user during the file viewing process. The first operation interaction data includes mouse movement trajectory, click frequency, page scrolling speed and dwell time in the preset target content area, and periodically upload it to the policy and key service center as part of the audit log. By utilizing the second operation interaction behavior data of multiple authorized users on the target file through the policy and key service center, a behavioral baseline model representing normal file viewing operations is constructed through cluster analysis. The first operation interaction behavior data is compared with the behavior baseline model in real time to calculate and generate a dynamic trust score. When the dynamic trust score is lower than the threshold corresponding to the strength of the adaptive response strategy, the current event corresponding to the first operation interaction behavior data is determined to be a risk event.

[0013] By employing the above technical solution, real-time, seamless monitoring of the file viewing process is achieved through the collection of fine-grained operational data such as mouse trajectory, scrolling speed, and dwell time, transforming user behavior into analyzable security signals. A baseline model of normal operation is constructed using historical behavioral data from multiple authorized users through cluster analysis. This method enables the system to learn and evolve on its own, defining what is "normal," rather than relying on fixed static rules. The current user behavior is compared in real-time with the group behavior baseline, outputting a quantified dynamic trust score. This transforms risk assessment from qualitative judgment to quantitative evaluation, making risk assessment more accurate and objective. The real-time calculated trust score is compared with preset thresholds based on different policy strengths to automatically determine risk events. This ensures that the security response accurately matches the perceived risk level, achieving an upgrade from single alarms to tiered, flexible judgment.

[0014] In some embodiments, the construction of a behavioral baseline model representing normal document viewing operations through cluster analysis specifically includes: Extract user operation sequence patterns, operation interval time distribution, mouse trajectory feature parameters, and target content area interaction depth from the second operation interaction behavior dataset to construct a multi-dimensional behavior feature vector; The multi-dimensional behavioral feature vectors are processed by a clustering algorithm to identify and divide behavioral clusters that represent different user interaction patterns. Each behavioral cluster represents the reading habits of a user group towards the target file. Based on the distribution density, intra-cluster variance, and distance from other clusters of the behavior cluster, the target behavior cluster is selected as the reference set of the behavior baseline model, and the statistical characteristics of the reference set are calculated, including the behavior feature mean vector, covariance matrix, and behavior boundary hyperplane. Based on the reference set and the statistical features, the behavioral baseline model is constructed, and the behavioral baseline model is adaptively updated by periodically using incremental learning or periodic full retraining, and by incorporating newly collected second operational interaction behavior data.

[0015] By employing the above technical solution, multi-dimensional features such as sequence patterns, trajectory parameters, and interaction depth are extracted from the original operational data to construct feature vectors that comprehensively and accurately describe user browsing habits, laying a data foundation for establishing an accurate baseline model. Different user behavior pattern clusters are automatically identified and divided using clustering algorithms, rather than by pre-setting fixed rules. This method objectively discovers various "normal" behavior patterns in the data, making the baseline closer to real and diverse user habits. Based on statistical indicators such as cluster density, variance, and distance, the most typical and stable behavior clusters are scientifically selected as benchmarks. By calculating the mean, covariance, and boundary hyperplane, a behavior model that represents the norm while having clear boundaries is constructed, enhancing the reliability of risk assessment. Incremental learning or periodic retraining mechanisms are used to enable the behavior baseline model to continuously evolve by incorporating new user behavior data. This ensures that the model can adapt to the "normal" behavior drift caused by business development or changes in user habits, preventing the baseline from becoming outdated and maintaining long-term effectiveness.

[0016] In some embodiments, the method further includes: decrypting the target file in memory using the decryption token through the file management middleware to obtain decrypted content, and delivering the decrypted content to the client's local associated application for opening via a secure rendering interface, specifically including: A memory-isolated secure channel with integrity verification and encrypted transmission capabilities is established between the file management middleware and the client's local associated application to ensure that the decrypted content is not tampered with during transmission. The decrypted content is loaded into a protected memory area inside the application sandbox managed by the file management middleware in the form of an encrypted data stream or a memory-mapped region through the memory-isolated security channel, and plaintext disk write operations are prohibited. The system calls related to file reading, writing, opening, and data import issued by the client's local associated application are intercepted using application interface hook technology, and the system calls are redirected to the secure rendering interface. The secure rendering interface locates within the protected memory region according to the redirection and provides the data stream of the decrypted content to the local associated application in read-only mode, and monitors the access behavior and operation instructions of the client's local associated application to the data stream in real time.

[0017] By employing the above technical solution, an encrypted and integrity-verified memory isolation channel is constructed through inter-process communication. This ensures that the decrypted content remains in protected memory throughout its transmission from middleware to the application, effectively preventing data theft or tampering during transmission. The decrypted content is loaded into a protected memory area within a controlled application sandbox, and plaintext writes to disk are prohibited. This creates an isolated execution environment, separating data from untrusted operating system environments and malware, ensuring data is processed only within secure boundaries. Application programming interface (API) hooking technology is used to intercept and redirect all application system calls involving file and data imports. This deprives the application of direct access to the file system, forcing all requests to pass through a unified secure rendering interface, thereby taking over data access control.

[0018] In some embodiments, the step of using application programming interface (API) hook technology to intercept all file read / write, open, and data import-related system calls issued by the client's local associated application, and redirecting the system calls to the secure rendering interface, specifically includes: When the controlled executable container starts, the file management middleware dynamically injects interception hooks into the process space of the local associated application and locks the target application interface to be intercepted. The target application interface includes functions related to creating files, opening files, reading files, writing files, and clipboard operations for data exchange. When the local associated application is detected to initiate a call to the target application interface, the intercept hook takes over the program execution flow and captures the complete context information of the current call, including the call parameters, thread identifier and return address; The file management middleware analyzes the context information to identify the resource path or data handle intended for access. If it is determined that the resource path or data handle points to the decrypted content of the target file, the current call is redirected to the secure rendering interface.

[0019] By employing the above technical solution, and dynamically injecting interception hooks into the target application process while locking key API functions such as file operations and clipboard access, precise and comprehensive control over the data outflow path is achieved, cutting off the application's direct processing of plaintext data at the lowest level. Analyzing the captured context intelligently identifies requests intending to access protected file content. This intent-based identification mechanism ensures accurate determination of sensitive access, seamlessly and transparently redirecting legitimate content access requests to the secure rendering interface. By taking over the program execution flow and forcibly redirecting, all access to controlled content is converged to a single secure rendering interface. This establishes a mandatory policy enforcement point between the application and the raw data, ensuring that all operations undergo unified security checks and authorization, achieving centralized data access governance.

[0020] In a second aspect, embodiments of this application provide a computer system including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the steps of the method described in any possible implementation of the first aspect.

[0021] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0022] Fourthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0023] It is understood that the computer system provided in the second aspect, the storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the method provided in this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. It changes the traditional protection method of static passwords or simple encryption. Whether a file can be opened depends not only on whether the user has permissions, but also on whether its current operating environment (such as process whitelists, network location) is trustworthy. This allows the security policy to adapt to complex and ever-changing real-world usage scenarios, authorizing access only in a secure environment, significantly improving the dynamic protection capabilities of files; 2. A collaborative system is formed through centralized management and decision-making via an independent policy and key service center, while client containers are responsible for execution and awareness. The processes of key and file separation, environment data reporting, central risk assessment, and token issuance combine centralized cloud-based control of security capabilities with precise client-side execution, thus constructing a defense-in-depth system. 3. Encrypt and encapsulate before distribution; exist in ciphertext form during transmission; decrypt in memory when used, and deliver through a secure rendering interface, intercepting persistent operations; execute adaptive responses when risks occur. This design ensures that plaintext content never appears on the client's disk, effectively preventing data leakage caused by methods such as saving as, screenshots (using watermarks, etc.); 4. It can automatically match control measures of different intensities (such as logging, pop-up warnings, enhanced watermarking, blocking access, and even reverse tracing) based on risk assessment results (secondary identifier). This mechanism upgrades security protection from static, predefined rules to a dynamic, intelligently adjustable response loop, improving the ability to respond to unknown threats. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a document outsourcing management method according to an embodiment of this application; Figure 2 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application. Detailed Implementation

[0026] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0027] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0028] The following is combined with Figure 1 The method of the embodiments of this application will be described below.

[0029] Please see Figure 1This is a flowchart illustrating a document outsourcing management method according to an embodiment of this application. Figure 1 As shown, a method for managing external file distribution includes the following steps: S101. On the management side, a security policy is configured for the basic file to be sent out. The basic file is encrypted using an encryption key to obtain the target file. The encryption key is associated with the security policy and stored in an independent policy and key service center. A unique file identifier corresponding to the target file is generated. The security policy includes a basic usage policy, a context-aware policy, and an adaptive response policy. The basic usage policy is used to define the validity period and maximum number of times the target file can be opened. The context-aware policy is used to define the trusted environment characteristics in which the target file is allowed to be opened. The trusted environment characteristics include a whitelist of allowed application processes and a range of permitted network addresses. The adaptive response policy is used to define the rules for automatically escalating the control intensity when a risk event is detected. S102. Encapsulate the target file, the preset file management middleware, and the unique file identifier to generate a controlled executable container; S103. After the client starts the controlled executable container, the client's current environment context data is collected through the environment probe module embedded in the controlled executable container. The environment context data includes a list of currently running processes and network connection information. The environment context data and the unique file identifier are sent to the policy and key service center. S104. The policy and key service center matches the environmental context data with the trusted environment features to perform dynamic risk assessment and obtain a risk assessment result. When the first identifier in the risk assessment result is passed, a decryption token is issued to the controlled executable container, and the strength of the adaptive response policy to be executed is determined according to the second identifier in the risk assessment result. In some embodiments, it also includes: S105. The target file is decrypted in memory using the decryption token through the file management middleware to obtain the decrypted content, and the decrypted content is delivered to the client's local associated application to open through the secure rendering interface; S106. During the file viewing process, monitor and intercept persistent operations on the decrypted content. The persistent operations include the application's "Save As" instruction and the call to the application interface involving file storage. If a risk event with a determined adaptive response strategy strength is identified during the monitoring process, control operations are performed according to the adaptive response strategy.

[0030] All data collection in this application embodiment is compliant, for example, authorized by the user being collected. Basic usage policy: Defines the file's lifecycle, including validity period (e.g., only openable within three months) and maximum number of openings (e.g., maximum allowed 20 times). This provides basic access control, preventing indefinite or unlimited use of files. Context-aware policy: Defines the secure operating environment for the file. Application process whitelist: Only trusted readers (e.g., genuine Adobe Acrobat Reader, specific enterprise versions of WPS) are allowed to open the file, preventing malware from stealing content. Permitted network address range: Only access is allowed within specified IP ranges or networks (e.g., company intranet VPN addresses), preventing the file from being opened in uncontrolled public network environments. Adaptive response policy: Defines automated contingency plans; it's not a simple block, but an automatic escalation rule for control strength. For example, only logs are recorded when suspicious activity is detected for the first time; a warning pops up when detected again; when definite theft is detected, a full-screen watermark is triggered and reverse tracing is performed. Encryption and associated storage: The base file is encrypted using an encryption key to generate the target file. The encryption key is associated with the aforementioned triple security policy and stored in a separate policy and key service center. The file itself is separate from the "key" and "rules" for opening it. Even if the client obtains the target file, it cannot decrypt it itself; it must apply to the center, which decides whether to issue a decryption token based on the policy. A unique file identifier is generated for each target file. This ID is the core link connecting the file, its corresponding policy, and all subsequent access logs. The target file (ciphertext), the file management middleware, and the unique file identifier are encapsulated into a controlled executable container (usually a self-extracting .exe file or a container file of a specific format). The file management middleware integrates all client security functions in subsequent steps, such as environment detection, communication, decryption, rendering, and behavior monitoring. This encapsulation method ensures that the recipient does not need to pre-install any complex software; it only needs to run the container to access the file in a controlled environment.

[0031] When the recipient runs the container on the client, the security verification process begins. The environment probe module starts working, collecting the client's environment context data. This includes: a list of currently running processes (used for comparison with the configured application process whitelist) and network connection information (used to determine if the client is currently within the configured permitted network address range). This environment data, along with a unique file identifier, is sent to the Policy and Key Service Center. Upon receiving the environment data, the Policy and Key Service Center performs real-time matching against the context-aware policy pre-defined for that file. For example: Is the currently running reader on the whitelist? Is the current IP address within a trusted range? A risk assessment result is generated, including a first identifier and a second identifier. The first identifier represents a binary decision of whether access is allowed; it is only marked as passed if the environment fully complies with the policy. The second identifier represents the "risk level" or "trust level." Even if the environment is generally trustworthy, there may be subtle risks (such as the simultaneous running of uncommon software); this identifier is used to fine-tune the intensity of subsequent monitoring. If the first identifier is passed, a decryption token is issued to the client container. Note that the issued token can be a one-time, time-limited token, enhancing security. At the same time, the center will tell the client's file management middleware what adaptive response strategy strength should be used by default for this session based on the second identifier (e.g., standard monitoring for low risk and enhanced monitoring for medium risk).

[0032] The file management middleware uses the received decryption token to decrypt the target file in memory, obtaining the decrypted content. Throughout this process, the plaintext is never written to the client's disk. The decrypted content is not directly delivered to the local application; instead, it is delivered through a secure rendering interface. This interface establishes a secure, monitored channel (such as an encrypted memory-mapped area) to send the data stream to the associated local application (such as Word) for display. This allows users to view the file normally in familiar software, but not to edit it. Protection does not end after the file is opened; instead, it enters a continuous runtime monitoring phase. The file management middleware monitors and intercepts all operations that attempt to permanently save the decrypted content. This includes: application "Save As" commands, saves triggered by keyboard shortcuts, and all underlying system API calls involving file storage (such as WriteFile). This fundamentally prevents users from saving the file as a new, unprotected copy. During monitoring, the system identifies risk events based on a determined adaptive response strategy strength. For example, with enhanced monitoring, frequent copy-and-paste operations might be identified as risk events. Once a risk event is detected, the system will not rigidly close the file directly, but will execute tiered control operations according to a preset adaptive response strategy. For example, a basic response might be: log and report the event. A medium response might be: overlay a semi-transparent watermark on the document to warn the user. An advanced response might be: trigger a trapping mechanism, deploy tracking beacons, or even forcibly terminate the session and encrypt and destroy the decrypted temporary file.

[0033] In some embodiments, the method further includes: monitoring the viewing process of the target file; if a risk event with a determined adaptive response strategy strength is identified during the monitoring process, then performing control operations according to the adaptive response strategy, specifically including: If a risk event corresponding to the strength of the adaptive response strategy is detected, a snare file fragment in the target file is obtained, and the information in the snare file fragment is dynamically rendered as a visible watermark covering the entire display area. An encrypted beacon containing a unique tracking identifier associated with the unique file identifier is deployed to the source IP address or untrusted process of the risk event. After the encrypted beacon runs in the target environment, it collects and sends back the characteristic information of the target environment to the policy and key service center. The policy and key service center receives and aggregates all feature information returned by the encrypted beacon, and performs correlation analysis with the information of the trap file fragment and the watermark trigger event log to construct a risk profile of the risk event. The risk profile includes path map, attack method and source attribute. Based on the severity and source of the attack in the risk profile, a matching adaptive response strategy is triggered, and the strength of the adaptive response strategy is adjusted.

[0034] When a risk event corresponding to the strength of the adaptive response strategy is detected, the system immediately extracts a pre-embedded trap file fragment from the currently decrypted file content and dynamically renders the information within (such as "Internal Confidential - Disclosure Strictly Prohibited," "File ID: XXX," etc.) as a full-screen visible watermark covering the entire display area. This full-screen watermark severely interferes with reading the screen content and prevents theft such as screenshots. The watermark information typically contains a unique file identifier and authorized user information. Anyone who screenshots the watermarked content becomes direct evidence of the leak source. The watermark is "dynamically rendered," meaning it doesn't appear during normal viewing and only triggers when a risk occurs. This ensures a positive experience for legitimate users while making it difficult for attackers to defend against. The system proactively deploys an encrypted beacon to the source of the risk event (i.e., the source IP address, which could be the attacker's C&C server) or an untrusted process initiating malicious operations. This beacon contains a unique tracking identifier associated with the file's unique identifier. The unique tracking identifier within the beacon ensures that any returned information can be accurately associated with the specific risk event and the outgoing file. The encrypted beacon is designed to resemble a lightweight "probe" or "Trojan." Once running in the target environment (the attacker's machine), it silently collects system characteristic information, such as hardware fingerprints (MAC address, hard drive serial number, etc.); software environment (operating system version, list of installed software); network information (public IP address, domain name, other network configurations); and operational traces (current user account name, system log fragments, etc.). The Policy and Key Service Center acts as the brain, receiving characteristic information from each encrypted beacon. It performs cross-source and cross-event correlation analysis with information from the decoy file fragments and watermark trigger event logs. While a single event has limited value, correlation analysis can construct a comprehensive risk profile. Path graph: depicts the attack chain. For example, an attacker launches an attack from a certain IP address, triggering a watermark, and then the beacon sends back data from another geographical location, thus analyzing the attack's springboard and path. Attack methods: by analyzing the types of triggered decoy fragments and risk event behaviors, it determines whether the attacker is attempting mass data breaches, taking photos, or exploiting vulnerabilities for memory scraping. Source Attributes: Based on the hardware, network, and user information returned by the beacon, the system initially determines whether the attacker is an insider, a corporate spy, or an organized hacker, as well as their approximate geographical location and organizational background. According to the severity of the attack (e.g., attempts at large-scale file export) and source attributes (e.g., IPs from competitor countries) in the generated risk profile, the system automatically triggers more precisely matched adaptive response strategies and adjusts the default policy strength for such threats in the future. This enables tiered responses; for example, for low-risk internal employee misoperations, the system may only log and notify their supervisor via email; for confirmed external, organized attacks, it can immediately block access to all outgoing files from that IP segment and increase the baseline strength of the security policy for all company files.The system automatically adjusts the strength threshold and response method of its security policy through a continuous monitoring-response-analysis closed loop. For example, after discovering a new attack method, the system can learn and upgrade the monitoring level for such behavior on all clients from "standard" to "high," thereby achieving dynamic evolution of the overall defense capability.

[0035] In some embodiments, encrypting the underlying file using an encryption key includes: Based on the context of the base file, a text generation model is used to create semantically relevant but fictional trap text paragraphs, or, based on the original image of the base file, a trap image region containing artifacts or erroneous features is generated. In the trap text paragraph or the trap image area, structured metadata containing the unique file identifier, authorized user information and timestamp is embedded to form the trap file fragment; The captured file fragment is merged with the base file at a preset level in the document object tree, and the merged overall structure is uniformly encrypted using the encryption key to obtain the target file. The target file is configured such that when it is decrypted in memory by the file management middleware on the client, the file management middleware skips the captured file fragment according to the embedded rendering logic in normal viewing mode.

[0036] Text generation models can be used to analyze the theme, style, and vocabulary of a base document, automatically generating one or more semantically highly related but entirely fictitious texts. For example, if the base document is a technical report on "quantum computer chip design," the generated sting text might be a fictitious "details of thermal coding technology for next-generation chips," containing seemingly plausible but fabricated technical parameters and experimental data. The original images in the file can be processed to generate sting image regions containing artifacts (such as seemingly blurred sensitive areas), erroneous features (such as deliberately added incorrect data point charts), or hidden watermark layers. These artifacts and erroneous features may mislead attackers into believing they are real but flawed sensitive information, thus attracting them to take screenshots or conduct in-depth analysis. A structured metadata segment can be embedded in the generated sting text or images using techniques such as steganography or digital watermarking. This metadata typically includes a unique file identifier, authorized user information, and a timestamp. When the sting content appears externally, the security team can extract this metadata to irrefutably determine the source of the leak, the specific file, and the responsible party. The system inserts the entrapment fragments into a pre-defined deep node in the document tree. Simply adding content to the beginning or end of a file is easily removed. However, deep embedding within the document structure makes these entrapment fragments difficult to detect and separate using ordinary file parsing tools. The merged file remains a well-formatted document, preventing structural errors from raising suspicion or causing reader crashes. The entire merged document structure is uniformly encrypted. This means that the entrapment fragments and the real content are completely intertwined and indistinguishable in the encrypted state. This prevents attackers from identifying and removing entrapment content at the encrypted level by comparing file sizes or analyzing structural anomalies. To access the content, it must first be decrypted through file management middleware. After the target file is decrypted in memory on the client side by the file management middleware, the middleware does not directly deliver the complete decrypted document to the reader. Instead, based on its embedded rendering logic, it actively skips document nodes marked as "entrapment fragments" when delivering the content stream to the reader. Authorized users will not see these fictitious paragraphs or images during normal viewing, and their user experience will not be affected. This ensures the usability of the solution. These stole fragments will only be exposed along with the real content when attackers attempt to bypass the file management middleware, such as by directly decrypting the entire file through cracking methods or exploiting vulnerabilities to export the complete document content.

[0037] In some embodiments, the method further includes detecting a risk event corresponding to the strength of the adaptive response strategy by means of the following steps: Collect the first operation interaction data of the current user during the file viewing process. The first operation interaction data includes mouse movement trajectory, click frequency, page scrolling speed and dwell time in the preset target content area, and periodically upload it to the policy and key service center as part of the audit log. By utilizing the second operation interaction behavior data of multiple authorized users on the target file through the policy and key service center, a behavioral baseline model representing normal file viewing operations is constructed through cluster analysis. The first operation interaction behavior data is compared with the behavior baseline model in real time to calculate and generate a dynamic trust score. When the dynamic trust score is lower than the threshold corresponding to the strength of the adaptive response strategy, the current event corresponding to the first operation interaction behavior data is determined to be a risk event.

[0038] The system silently collects user interaction data on the first interaction with the document in the client background. This data includes mouse movement, click frequency, page scrolling speed, and dwell time in preset target content areas. The system collects mouse movement data during document browsing to analyze browsing path characteristics, such as rapid scanning, line-by-line reading, or repeated hovering in specific areas. It also records click frequency data, analyzing the density of clicks to distinguish between different operation modes, such as normal reading, rapid page turning, and intensive copying. Page scrolling speed is also a key indicator; the system monitors scrolling speed changes to determine whether the user is browsing at a constant speed, jumping quickly, or suddenly stopping on a specific page. Furthermore, the system pays special attention to the duration of user dwell time in preset target content areas (such as sensitive data tables or core paragraphs), analyzing dwell time characteristics to identify normal browsing behavior and potentially risky prolonged dwell behaviors (such as screenshots or copying). This data, as part of the audit log, is encrypted and periodically uploaded to the policy and key service center. This design balances real-time performance with efficiency, avoiding interference with user operations. The system utilizes second-stage interaction behavior data (i.e., historical normal behavior datasets) from multiple authorized users on the same or similar target files. The Policy and Key Service Center extracts multi-dimensional behavioral feature vectors from this historical data (e.g., a feature vector can be represented as: [average scrolling speed, variance of dwell time in sensitive areas, mouse trajectory entropy value, etc.]). These feature vectors are processed using clustering algorithms (such as K-means, DBSCAN). The algorithm automatically groups users with similar behavioral patterns into the same behavioral cluster. Different clusters may represent different browsing habits, such as: "fast browsing cluster" (management overview), "deep reading cluster" (technical experts), and "search and verification cluster" (financial personnel). The system selects the most prevalent and stable behavioral cluster (usually the densest cluster with the smallest variance), or combines features from multiple clusters, to calculate a series of statistical features, such as the average range of each behavior, covariance matrix, etc., thereby constructing a multi-dimensional behavioral space and defining the boundaries of normal behavior within this space (i.e., the behavioral baseline model). The objective standard for "normal" is defined as follows: the model is not based on subjectively preset rules by administrators (such as "cannot stay for more than 30 seconds"), but rather emerges objectively from group data. This avoids overly rigid rules that could lead to false positives or false negatives. When the current user (their first interaction behavior data) views a file, the system compares their behavioral feature vector in real time with the behavioral baseline model stored in the cloud. By calculating the Mahalanobis distance between the current behavioral vector and the normal spatial center of the behavioral baseline, or using other similarity algorithms, a continuous, numerical, dynamic trust score (e.g., 0-100 points) is generated. The higher the score, the more the current behavior conforms to the normal pattern of the group; the lower the score, the more it deviates from the normal pattern.The system compares the calculated dynamic trust score with the threshold corresponding to the strength of the adaptive response strategy applied to the current session. High-strength strategy: The threshold is set higher (e.g., triggered when the trust score is below 80). This means that in highly sensitive scenarios, the system has extremely low tolerance for abnormal behavior, and even slight deviations may trigger an alarm. Low-strength strategy: The threshold is set lower (e.g., triggered only when the trust score is below 40). This means that in normal scenarios, user behavior is allowed a wider range of normal fluctuations. Only when the dynamic trust score is lower than the threshold corresponding to the current strategy strength is the current event determined to be a risk event. This allows the sensitivity of risk detection to be dynamically adjusted based on factors such as the importance of the file, user role, and environmental risks, enabling refined management.

[0039] In some embodiments, the construction of a behavioral baseline model representing normal document viewing operations through cluster analysis specifically includes: Extract user operation sequence patterns, operation interval time distribution, mouse trajectory feature parameters, and target content area interaction depth from the second operation interaction behavior dataset to construct a multi-dimensional behavior feature vector; The multi-dimensional behavioral feature vectors are processed by a clustering algorithm to identify and divide behavioral clusters that represent different user interaction patterns. Each behavioral cluster represents the reading habits of a user group towards the target file. Based on the distribution density, intra-cluster variance, and distance from other clusters of the behavior cluster, the target behavior cluster is selected as the reference set of the behavior baseline model, and the statistical characteristics of the reference set are calculated, including the behavior feature mean vector, covariance matrix, and behavior boundary hyperplane. Based on the reference set and the statistical features, the behavioral baseline model is constructed, and the behavioral baseline model is adaptively updated by periodically using incremental learning or periodic full retraining, and by incorporating newly collected second operational interaction behavior data.

[0040] User action sequence patterns: Abstracting user actions such as clicking, scrolling, and hovering into ordered sequences (e.g., "scroll-hover-click-scroll") and extracting their features, such as sequence entropy (measuring randomness) and frequent subsequence patterns, helps identify whether it is systematic browsing or random jumping. Operation interval time distribution: Statistically analyzing the time interval distribution between adjacent operations, calculating its mean, variance, skewness, etc. For example, the operation intervals for normal reading are relatively stable and conform to human reaction time, while automated batch copying operations may exhibit extremely short and uniform intervals. Mouse trajectory feature parameters: Quantifying and analyzing mouse movement trajectories, extracting parameters such as total trajectory length, speed change curve, trajectory smoothness (whether there is jitter), and trajectory entropy in specific areas (randomness of movement). For example, the trajectory during careful reading is usually smooth, continuous, and aligned with text lines, while the trajectory during inattentive reading or rapid searching may be messy and jumpy. Interaction depth of target content area: Quantifies the intensity of user interaction with preset sensitive areas, such as the number of times the user enters the area, the ratio of the total number of operations to the total duration within the area, and the frequency of specific operations (such as right-clicking and selection) within the area. Multiple sub-feature values ​​from these four dimensions are combined into a high-dimensional, multi-dimensional behavioral feature vector. This vector represents a digital fingerprint of a user's browsing behavior in a single instance or over a period of time. Algorithms such as K-means, DBSCAN, or Gaussian mixture models are used to perform cluster analysis on the massive user behavior feature vectors. The algorithm automatically groups user feature vectors with highly similar behavioral patterns into the same "behavioral cluster." Each cluster represents a typical interaction pattern within the file's user group. For example, the system might automatically cluster the following clusters: Cluster A (deep reading type), characterized by low to medium scrolling speed, prolonged lingering on technical detail paragraphs, mouse trajectory closely following text lines, and strong regularity in operation sequences; Cluster B (fast browsing type), characterized by high-speed scrolling, short and evenly distributed lingering time, and jumping mouse trajectory; Cluster C (data verification type), characterized by frequent jumping between data table areas and conclusion sections, and dense clicking and hovering on numerical cells. The target behavior cluster is selected as the reference set for the baseline model. Selection criteria can be as follows: high distribution density, choosing the cluster with the densest data points, indicating that the behavior pattern is most common and representative among the user group; low intra-cluster variance, choosing clusters with small differences in features among their points, indicating that the group's behavior pattern is highly consistent and stable, with less noise, making it a more reliable benchmark; moderate or significant distance from other clusters, avoiding clusters with ambiguous boundaries to ensure baseline clarity. Typically, clusters meeting the criteria of "high density and low variance" are selected as the target behavior cluster, and all their data points constitute the reference set for building the model. Behavioral Feature Mean Vector: Calculates the average of all feature vectors in the reference set. This represents the behavioral center of the most typical normal user. Covariance Matrix: Calculates the correlation between each feature dimension.For example, it quantifies the correlation between scrolling speed and dwell time under normal conditions. This is key to defining the shape and orientation of the normal behavior space. Behavioral boundary hyperplane (or hypersurface): Based on the mean vector and covariance matrix, a boundary is defined in the multivariate feature space that includes the vast majority of reference set data points, using statistical methods (such as Mahalanobis distance with threshold setting) or algorithms (such as single-class support vector machines). The space within the boundary is defined as the normal behavior space. The boundary can take the form of a complex hypersurface, but conceptually it can be understood as a hyperplane. Constructing the behavioral baseline model: The core of the final behavioral baseline model is a mathematical decision function jointly defined by the reference set, mean vector, covariance matrix, and behavioral boundary. Its function is: given a new user behavior feature vector, calculate its distance from the "typical center" and determine whether it falls within the normal boundary. When new, judged normal behavior data (secondary operation interaction behavior data) is generated, the system fine-tunes the model parameters in a streaming manner (such as updating the mean vector and covariance matrix), allowing the model boundary to slowly "drift" and adapt to gradual changes in user habits.

[0041] In some embodiments, the method further includes: decrypting the target file in memory using the decryption token through the file management middleware to obtain decrypted content, and delivering the decrypted content to the client's local associated application for opening via a secure rendering interface, specifically including: A memory-isolated secure channel with integrity verification and encrypted transmission capabilities is established between the file management middleware and the client's local associated application to ensure that the decrypted content is not tampered with during transmission. The decrypted content is loaded into a protected memory area inside the application sandbox managed by the file management middleware in the form of an encrypted data stream or a memory-mapped region through the memory-isolated security channel, and plaintext disk write operations are prohibited. The system calls related to file reading, writing, opening, and data import issued by the client's local associated application are intercepted using application interface hook technology, and the system calls are redirected to the secure rendering interface. The secure rendering interface locates within the protected memory region according to the redirection and provides the data stream of the decrypted content to the local associated application in read-only mode, and monitors the access behavior and operation instructions of the client's local associated application to the data stream in real time.

[0042] Inter-Process Communication (IPC): Since the file management middleware and the local application are two independent processes, they must communicate through IPC mechanisms (such as named pipes, shared memory, LPC / RPC). Encrypted Transmission: All decrypted data packets or memory pointer information transmitted through this channel are encrypted (e.g., using session keys). Even if other malicious processes intercept the channel traffic through memory scanning, they will only obtain ciphertext. Integrity Verification: Message authentication codes are added to the transmitted data to ensure that the data is not tampered with by third-party processes (e.g., by inserting malicious code or modifying text) during the transmission from the middleware to the application. Application Sandbox: When the file management middleware starts, it creates a controlled runtime environment—a sandbox—for the upcoming local associated application (such as Word). This sandbox can be a lightweight virtualization container or a system that strictly restricts process permissions through policies. Protected Memory Region: Inside the sandbox, the middleware allocates a dedicated protected memory region. This region is directly managed by the middleware and cannot be directly accessed by the operating system or other applications. Encrypted Data Stream: Decrypted content is encrypted in blocks and continuously "streamed" into the protected memory through a secure channel. Memory-mapped regions: A memory-mapped file object is created in protected memory, mapping the entire decrypted content to this region. The application accesses it via pointers. This method offers higher performance. Sandbox configuration and middleware monitoring absolutely prohibit any operation attempting to write plaintext content from the protected memory region to the physical disk or page file. This is a mandatory technical guarantee for achieving "no-persistent" data transfer. Application Programming Interface (API) hooking technology: When the local application starts, the file management middleware uses techniques such as DLL injection or API hijacking to replace the entry addresses of a series of critical system call functions with the addresses of its own functions. Targeted APIs intercepted typically include: file read / write (such as CreateFile, ReadFile, WriteFile), file open (fopen, ifstream.open), and data import (OleLoad (for embedding objects), Clipboard-related APIs (for pasting)). When an application calls the hooked function (for example, Word attempts to "open" this document), the middleware preemptively gains execution rights, checks the call parameters (such as file path and access mode), and if it finds that this is an access request for a controlled target file, it redirects the call instead of actually searching for the file on disk. The middleware redirects the call to its own secure rendering interface function. Upon receiving the redirected request, the secure rendering interface directly locates the corresponding decrypted content fragment in the protected memory area based on parameters such as offset and length in the request. The interface returns a data stream to the application only in read-only mode. This means the application can read and display / edit the file content (in memory), but any "save" or "write" operations initiated through the standard file API will be intercepted or fail.Users cannot generate a new, unprotected plaintext copy using the application's "Save As" function. Throughout the delivery process, the secure rendering interface continuously monitors the application's access to the data stream to determine if any abnormal behavior is detected.

[0043] In some embodiments, the step of using application programming interface (API) hook technology to intercept all file read / write, open, and data import-related system calls issued by the client's local associated application, and redirecting the system calls to the secure rendering interface, specifically includes: When the controlled executable container starts, the file management middleware dynamically injects interception hooks into the process space of the local associated application and locks the target application interface to be intercepted. The target application interface includes functions related to creating files, opening files, reading files, writing files, and clipboard operations for data exchange. When the local associated application is detected to initiate a call to the target application interface, the intercept hook takes over the program execution flow and captures the complete context information of the current call, including the call parameters, thread identifier and return address; The file management middleware analyzes the context information to identify the resource path or data handle intended for access. If it is determined that the resource path or data handle points to the decrypted content of the target file, the current call is redirected to the secure rendering interface.

[0044] When the controlled executable container starts, the file management middleware performs hook injection simultaneously with its own startup and that of associated applications. This ensures that monitoring is effective from the very beginning of the application lifecycle, with no blind spots. Targeting APIs: The hook code precisely targets a series of application interfaces highly relevant to data breach risks, forming a monitoring network, including core file operation APIs and data exchange channel APIs. Core file operation APIs include: CreateFileW / OpenFile (requests for creating or opening files), ReadFile / ReadFileEx (requests for reading file content), and WriteFile / WriteFileEx (requests for writing to files). Data exchange channel APIs include: OpenClipboard / GetClipboardData (operations for accessing the system clipboard) and OleLoad / OleCreateFromData (handling object linking and embedding, used to prevent dragging or copying embedded objects from documents).

[0045] When an application attempts to perform a related operation, the hook mechanism is activated, acting as the first line of filtering and forensics. Once the hooked API is invoked, the operating system prioritizes executing the hook function, temporarily suspending the execution flow of the original application and transferring control to the hook code of the file management middleware. The hook function immediately captures a snapshot of the call's context, including the call parameters, thread identifier, and return address. Call parameters: For example, for ReadFile, parameters include the file handle, the address of the read buffer, and the number of bytes to be read. Thread identifier: Records the thread that initiated the call, helping to distinguish between a legitimate operation by the application's main thread and the theft behavior of a suspicious background thread. Return address: Records the code address that should be returned after the call, ensuring correct flow transitions and aiding in the analysis of the call's origin. Context information analysis: The file management middleware (or the hook function itself) performs in-depth analysis of the captured context. For resource paths (such as the file path string passed in the CreateFile call), it analyzes whether they point to the target file path within the controlled container. For data handles (such as the file handle passed in a ReadFile call), the system queries a system-maintained handle mapping table to determine if the handle is associated with a protected memory region belonging to the target file, managed by the secure rendering interface. If the analysis indicates that the resource or handle intended for access does indeed point to the decrypted content of the target file, it is considered a controlled access request. If the access is to another unrelated file (such as an unrelated document on the user's local machine), it is allowed directly, and the original API is called without affecting normal user use. For calls deemed to require control, the system performs redirection. The hook function adapts and transforms the call parameters and then directly calls the corresponding function of the secure rendering interface. The secure rendering interface performs the corresponding virtualization operation (such as reading data at a specified offset) within the protected memory region based on the parameters and returns the result to the application through the hook function. From the application's perspective, it believes it has successfully read the file through the standard Windows API, but in reality, it is reading a monitored memory data stream from the secure rendering interface.

[0046] The above describes a file outgoing management method in the embodiments of this application. The following describes the computer system in the embodiments of this application in detail with reference to the above file outgoing management method.

[0047] Please see Figure 2 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application.

[0048] In some embodiments, the computer system 200 includes a computer device, which may be a terminal device. The computer device includes a processor 201, a memory 202, a sensor module 203, a communication module 204, an input device 205, and an output device 206 connected via a system bus. The processor 201 of the computer device provides computing and control capabilities. The memory 202 of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database is used to store data.

[0049] Those skilled in the art will understand that Figure 2 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0050] In some embodiments of this application, a computer-readable storage medium is provided, including instructions that, when executed on the computer system 200, cause the computer system 200 to perform a file outgoing management method according to an embodiment of this application.

[0051] In some embodiments of this application, a computer program product is also provided, which, when run on a computer system 200, causes the computer system 200 to execute a file outgoing management method according to an embodiment of this application.

[0052] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0053] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0054] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for managing the external distribution of documents, characterized in that, include: On the management side, a security policy is configured for the basic file to be sent out. The basic file is encrypted using an encryption key to obtain the target file. The encryption key is associated with the security policy and stored in an independent policy and key service center. A unique file identifier corresponding to the target file is generated. The security policy includes a basic usage policy, a context-aware policy, and an adaptive response policy. The basic usage policy is used to define the validity period and maximum number of times the target file can be opened. The context-aware policy is used to define the trusted environment characteristics in which the target file is allowed to be opened. The trusted environment characteristics include a whitelist of allowed application processes and a range of permitted network addresses. The adaptive response policy is used to define the rules for automatically escalating the control intensity when a risk event is detected. The target file, the preset file management middleware, and the unique file identifier are encapsulated to generate a controlled executable container; After the client starts the controlled executable container, the environment probe module embedded in the controlled executable container collects the client's current environment context data. The environment context data includes a list of currently running processes and network connection information. The environment context data and the unique file identifier are sent to the policy and key service center. The policy and key service center matches the environmental context data with the trusted environment features to perform dynamic risk assessment and obtain a risk assessment result. When the first identifier in the risk assessment result is "passed", a decryption token is issued to the controlled executable container, and the strength of the adaptive response policy to be executed is determined according to the second identifier in the risk assessment result.

2. The document outsourcing management method according to claim 1, characterized in that, The method further includes: monitoring the viewing process of the target file; if a risk event with a determined adaptive response strategy strength is identified during the monitoring process, then performing control operations according to the adaptive response strategy, specifically including: If a risk event corresponding to the strength of the adaptive response strategy is detected, a snare file fragment in the target file is obtained, and the information in the snare file fragment is dynamically rendered as a visible watermark covering the entire display area. An encrypted beacon containing a unique tracking identifier associated with the unique file identifier is deployed to the source IP address or untrusted process of the risk event. After the encrypted beacon runs in the target environment, it collects and sends back the characteristic information of the target environment to the policy and key service center. The policy and key service center receives and aggregates all feature information returned by the encrypted beacon, and performs correlation analysis with the information of the trap file fragment and the watermark trigger event log to construct a risk profile of the risk event. The risk profile includes path map, attack method and source attribute. Based on the severity and source of the attack in the risk profile, a matching adaptive response strategy is triggered, and the strength of the adaptive response strategy is adjusted.

3. The document outsourcing management method according to claim 2, characterized in that, The encryption of the base file using the encryption key includes: Based on the context of the base file, a text generation model is used to create semantically relevant but fictional trap text paragraphs, or, based on the original image of the base file, a trap image region containing artifacts or erroneous features is generated. In the trap text paragraph or the trap image area, structured metadata containing the unique file identifier, authorized user information and timestamp is embedded to form the trap file fragment; The captured file fragment is merged with the base file at a preset level in the document object tree, and the merged overall structure is uniformly encrypted using the encryption key to obtain the target file. The target file is configured such that when it is decrypted in memory by the file management middleware on the client, the file management middleware skips the captured file fragment according to the embedded rendering logic in normal viewing mode.

4. The document outsourcing management method according to claim 2, characterized in that, The method further includes detecting risk events corresponding to the strength of the adaptive response strategy through the following steps: Collect the first operation interaction data of the current user during the file viewing process. The first operation interaction data includes mouse movement trajectory, click frequency, page scrolling speed and dwell time in the preset target content area, and periodically upload it to the policy and key service center as part of the audit log. By utilizing the second operation interaction behavior data of multiple authorized users on the target file through the policy and key service center, a behavioral baseline model representing normal file viewing operations is constructed through cluster analysis. The first operation interaction behavior data is compared with the behavior baseline model in real time to calculate and generate a dynamic trust score. When the dynamic trust score is lower than the threshold corresponding to the strength of the adaptive response strategy, the current event corresponding to the first operation interaction behavior data is determined to be a risk event.

5. The document outsourcing management method according to claim 4, characterized in that, The process involves constructing a behavioral baseline model representing normal document viewing operations through cluster analysis, specifically including: Extract user operation sequence patterns, operation interval time distribution, mouse trajectory feature parameters, and target content area interaction depth from the second operation interaction behavior dataset to construct a multi-dimensional behavior feature vector; The multi-dimensional behavioral feature vectors are processed by a clustering algorithm to identify and divide behavioral clusters that represent different user interaction patterns. Each behavioral cluster represents the reading habits of a user group towards the target file. Based on the distribution density, intra-cluster variance, and distance from other clusters of the behavior cluster, the target behavior cluster is selected as the reference set of the behavior baseline model, and the statistical characteristics of the reference set are calculated, including the behavior feature mean vector, covariance matrix, and behavior boundary hyperplane. Based on the reference set and the statistical features, the behavioral baseline model is constructed, and the behavioral baseline model is adaptively updated by periodically using incremental learning or periodic full retraining, and by incorporating newly collected second operational interaction behavior data.

6. The document outsourcing management method according to claim 1, characterized in that, The method further includes: using the decryption token in memory through the file management middleware to decrypt the target file to obtain decrypted content, and delivering the decrypted content to the client's local associated application for opening via a secure rendering interface, specifically including: A memory-isolated secure channel based on inter-process communication mechanism and with integrity verification and encrypted transmission capabilities is established between the file management middleware and the client's local associated application to ensure that the decrypted content is not tampered with during transmission. The decrypted content is loaded into a protected memory area inside the application sandbox managed by the file management middleware in the form of an encrypted data stream or a memory-mapped region through the memory-isolated security channel, and plaintext disk write operations are prohibited. The system calls related to file reading, writing, opening, and data import issued by the client's local associated application are intercepted using application interface hook technology, and the system calls are redirected to the secure rendering interface. The secure rendering interface locates within the protected memory region according to the redirection and provides the data stream of the decrypted content to the local associated application in read-only mode, and monitors the access behavior and operation instructions of the client's local associated application to the data stream in real time.

7. The document outsourcing management method according to claim 6, characterized in that, The method of using application programming interface (API) hook technology to intercept all system calls related to file read / write, open, and data import issued by the client's local associated application, and redirecting the system calls to the secure rendering interface, specifically includes: When the controlled executable container starts, the file management middleware dynamically injects interception hooks into the process space of the local associated application and locks the target application interface to be intercepted. The target application interface includes functions related to creating files, opening files, reading files, writing files, and clipboard operations for data exchange. When the local associated application is detected to initiate a call to the target application interface, the intercept hook takes over the program execution flow and captures the complete context information of the current call, including the call parameters, thread identifier and return address; The file management middleware analyzes the context information to identify the resource path or data handle intended for access. If it is determined that the resource path or data handle points to the decrypted content of the target file, the current call is redirected to the secure rendering interface.

8. A computer system comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-7.

Images