Document security management method and device based on high confidentiality and storage medium

Abstract

The invention discloses a document security management method and device based on high confidentiality and a storage medium, and the method comprises the steps: monitoring a document operation event in real time, and generating operation information based on the document operation event, the document operation event comprises a conventional operation or an unconventional operation on a quality manual, a program file, a standard operation specification or a table; determining an operation type of the operation information; if the operation type is a conventional operation, generating an operation backup of the document operation event and storing the operation backup; and if the operation type is an unconventional operation, collecting context information of the document operation event, and storing the context information in association with the operation history of the document. According to the method and the device, the conventional operation type and the non-conventional operation type are distinguished, and the complete context information is acquired for the non-conventional operation and is stored in an associated manner, so that the whole-process tracing of the non-conventional operation of the document is realized, and the integrity of document management and the auditing reliability are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of document management, in particular to a high-security-based document security management method, device and storage medium. BACKGROUND

[0002] In the daily operation of professional laboratories, the management of documents such as quality manuals, program files, standard operating procedures and record forms is a key link to ensure their quality and ability. These documents not only standardize various activities of the laboratory, but also often involve users' personal sensitive information, so the strictness and traceability of their management is crucial. In order to meet the requirements of relevant management standards for document control and traceability, a special document management system is usually deployed in traditional technology to manage the life cycle of documents, which can record standard process operations such as document creation, editing, approval, release, query, etc. and save the corresponding version history.

[0003] However, in some specific application scenarios, in addition to the above predictable routine operations, some irregular operation requirements inevitably occur in practice. For example, in an emergency, a finalized document needs to be revised urgently, or due to process abnormalities, special handling is needed to bypass the standard approval path. Such operations usually cannot be completed through the system's preset front-end process, and need to be implemented directly in the system's background by authorized technical personnel.

[0004] The limitation of traditional management systems is that their monitoring and recording mechanisms are mainly focused on and optimized for standard front-end operation processes. For irregular operations performed in the background, the current system often lacks systematic real-time monitoring and structured recording capabilities that match such operations, which leads to the fact that the system may not be able to automatically and completely capture and associate key meta-information such as the context of such background operations, the specific authorization basis, and the compliance of the operation itself with the operation history of the relevant document, thereby affecting the completeness and transparency of the document management chain when auditing and tracing the entire life cycle of the document.

[0005] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0006] The main purpose of the present application is to provide a high-security-based document security management method, device and storage medium, which aims to solve the technical problem that the prior art cannot completely trace irregular operations in document management.

[0007] To achieve the above purpose, the present application provides a high-security-based document security management method, which comprises: monitoring a document operation event in real time and generating operation information based on the document operation event, wherein the document operation event comprises a regular operation or an irregular operation on a quality manual, a program file, a standard operation procedure or a table; determining an operation type of the operation information; if the operation type is a regular operation, generating an operation backup of the document operation event; if the operation type is an irregular operation, collecting context information of the document operation event and saving the context information in association with an operation history of the document.

[0008] In an embodiment, the step of monitoring a document operation event in real time and generating operation information based on the document operation event comprises: capturing an operation behavior of a user based on the document, extracting an execution parameter of the operation behavior as the document operation event; generating the operation record based on the execution parameter.

[0009] In an embodiment, the step of determining an operation type of the operation information comprises: extracting a behavior feature of the operation information, and determining whether the behavior feature conforms to a preset business operation process; if the behavior feature conforms to the preset business operation process, determining that the operation type of the operation information is a regular operation; if the behavior feature does not conform to the preset business operation process, determining that the operation type of the operation information is an irregular operation.

[0010] In an embodiment, the step of extracting a behavior feature of the operation information and determining whether the behavior feature conforms to a preset business operation process comprises: analyzing an execution path of the behavior feature, and determining whether the execution path conforms to a preset standard workflow; detecting whether the execution path contains a special permission call, determining whether the behavior feature conforms to the preset business operation process according to the execution path analysis and the detection result of the special permission call.

[0011] In an embodiment, the step of collecting context information of the document operation event and saving the context information in association with an operation history of the document if the operation type is an irregular operation comprises: obtaining an environmental scenario parameter based on the execution of the document operation event, and recording an operation credential triggering the document operation event; storing the environmental scenario parameter and the operation credential in association with a document operation record corresponding to the document operation event.

[0012] In an embodiment, the high-security-based document security management method further comprises: monitoring an abnormal state of the document operation event execution process, the abnormal state comprising non-working period operation and multiple authentication failure records; when detecting the abnormal state, generating an abnormal event mark and recording an abnormal processing process; associating and saving the abnormal event mark and the abnormal processing process with the document operation record corresponding to the document operation event.

[0013] In an embodiment, the step of monitoring the abnormal state of the document operation event execution process comprises: acquiring the timestamp of the document operation event in real time, and determining whether the timestamp is in a preset working period; if the timestamp is not in the preset working period, recording the duration of the document operation event, and generating a time abnormality mark; associating and saving the time abnormality mark with the document operation record corresponding to the document operation event.

[0014] In an embodiment, the high-security-based document security management method further comprises: counting the number of authentication failures of the same operation credential within a preset time period; comparing the number of authentication failures with a preset security threshold; if the number of authentication failures exceeds the preset security threshold, generating a security abnormality mark and triggering a security warning; associating and saving the security abnormality mark with the corresponding operation credential information.

[0015] In addition, to achieve the above-mentioned purposes, the present application also proposes a high-security-based document security management device, which comprises a memory, a processor and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the high-security-based document security management method as described above.

[0016] In addition, to achieve the above-mentioned purposes, the present application also proposes a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the high-security-based document security management method as described above.

[0017] The one or more technical solutions proposed in the present application have at least the following technical effects: Real-time monitoring of document operation events, and generating operation information based on the document operation events, wherein the document operation events include routine operation or non-routine operation on quality manual, program file, standard operation procedure or table; determining the operation type of the operation information; if the operation type is routine operation, generating operation backup of the document operation events; if the operation type is non-routine operation, collecting context information of the document operation events, and associating and saving the context information with operation history of the document.

[0018] Therefore, the present application realizes the whole-process tracing of document non-routine operation by distinguishing the routine and non-routine operation types and collecting complete context information of non-routine operation for associated saving, and effectively improves the completeness and audit reliability of document management. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings incorporated in and forming a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, the other drawings can also be obtained based on these drawings without any creative work.

[0021] Figure 1 Flowchart of the first embodiment of the high-security document safety management method of the present application; Figure 2 Flowchart of the second embodiment of the high-security document safety management method of the present application; Figure 3 Flowchart of the third embodiment of the high-security document safety management method of the present application; Figure 4 Device structure diagram of the hardware running environment involved in the high-security document safety management method in the embodiments of the present application.

[0022] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0023] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0024] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings and specific embodiments of the specification.

[0025] The main solution of the embodiment of the application is: real-time monitoring of a document operation event, and generating operation information based on the document operation event, wherein the document operation event includes regular operation or irregular operation on a quality manual, a program file, a standard operation procedure or a table; determining an operation type of the operation information; if the operation type is regular operation, generating operation backup saving of the document operation event; if the operation type is irregular operation, collecting context information of the document operation event, and saving the context information in association with an operation history of the document.

[0026] The prior art cannot completely trace irregular operation in document management.

[0027] The application provides a solution, which distinguishes between regular and irregular operation types, collects complete context information for irregular operation and saves the context information in association, realizes complete process tracing of document irregular operation, and effectively improves the completeness and audit reliability of document management.

[0028] Based on this, the embodiment of the application provides a high-security-based document security management method, referring to Figure 1 , Figure 1 The flowchart of the first embodiment of the high-security-based document security management method of the application. In this embodiment, the high-security-based document security management method includes steps S10-S40: Step S10, real-time monitoring of a document operation event, and generating operation information based on the document operation event, wherein the document operation event includes regular operation or irregular operation on a quality manual, a program file, a standard operation procedure or a table; In this embodiment, real-time monitoring of a document operation event is realized by deploying an event capture agent in a document management system. For this purpose, the event capture agent is embedded in the system kernel layer to intercept all access requests to the quality manual, the program file, the standard operation procedure or the table by a hook mechanism, and to monitor relevant document operation events based on the access requests. When a user initiates a document operation, the event capture agent extracts the original data of the operation event, including operation timestamp, operator identity, document unique code and operation command type. The operation event data is transmitted to a parsing engine through an event bus, wherein data cleaning and format standardization are performed to generate structured operation information, and the operation information includes event sequence number, document version hash value, operation parameter list and session context, ensuring data integrity and traceability.

[0029] In the data processing logic, the parsing engine applies a rule engine to classify and preprocess the operation events, which is based on a predefined policy library to identify whether the operation events belong to a regular or irregular category, for example, regular operations include document creation, editing, approval and publishing, while irregular operations involve emergency revision or authority override. In the operation information generation process, data enrichment techniques are used to supplement the operator's department attributes and permission levels from the organization directory service, enhancing the semantic richness of the operation information. And the operation information is finally persisted to the audit log database for subsequent analysis modules.

[0030] In another feasible implementation, real-time monitoring can be achieved through a distributed event stream platform, for example, using Apache Kafka as an event collection middleware, the document operation events are synchronously emitted to the Kafka topic by the front-end application and back-end service, and real-time aggregation and conversion are performed by the stream processing engine. Specifically, the stream processing engine applies window function to calculate the timing characteristics of the document operation events, and combines operation metadata from multiple data sources to generate a unified operation information view.

[0031] In addition, based on this monitoring operation, an anomaly detection algorithm is also integrated to dynamically identify potential atypical operation patterns, the anomaly detection algorithm is based on historical operation data to train an isolation forest model to real-time score the anomaly probability of the document operation events. If the event anomaly score of the document operation events exceeds the preset anomaly threshold, it is automatically marked as a state to be reviewed, and an enhanced monitoring process is triggered, based on this proactive mechanism, the monitoring range is expanded, covering the edge scenarios that may be missed by traditional rules.

[0032] To ensure the real-time nature of monitoring, high-frequency operation events are cached using in-memory data grids to reduce database read-write latency, and the event processing pipeline is designed as a stateless microservice, which is scaled elastically through Kubernetes to cope with load fluctuations. The monitoring agent also supports configuration hot updates, allowing administrators to dynamically adjust event capture strategies without system restart.

[0033] Specifically, the steps of real-time monitoring of document operation events and generating operation information based on the document operation events include: Capturing user operation behavior based on the document, extracting the execution parameters of the operation behavior as the document operation events; Generating the operation record based on the execution parameters.

[0034] In this embodiment, capturing user operation behavior based on the document is achieved by deploying a distributed event listener at the user interface layer and the server side of the document management system. The event listener, based on a publish-subscribe architecture, is registered as a global observer of system events, and intercepts user interaction operations in real time, such as document opening, editing, saving, or deleting actions. When a document operation behavior occurs, the listener collects the raw event data stream and applies a parsing engine to extract key execution parameters, including user identity credentials, operation timestamp, document unique identifier, operation command code, and session token. The execution parameters are processed by a data cleaning module to remove invalid fields and inconsistent content, and are mapped to a unified parameter schema through regular expression matching and type conversion, thereby generating standardized document operation events.

[0035] When generating operation records based on the execution parameters, a record synthesis service is called to input the parameters into a template engine to build a structured record object. The template engine, based on a pre-defined record format, classifies and fills the execution parameters into event metadata, operation details, and audit trail fields. The event metadata includes event sequence number and version hash; the operation details record specific behavior descriptions, such as document content change differences or permission modification logs; and the audit trail adds digital signatures and time chains to ensure record integrity and verifiability. The generated operation records are persisted to a relational audit database through transactional write operations, and are indexed to a full-text search engine to support efficient querying.

[0036] In another feasible implementation, capturing operation behavior can be achieved through kernel-level system call hooks, such as intercepting file I / O operations at the operating system level to obtain more low-level execution parameters, such as process identifiers and memory access patterns. When extracting execution parameters, combined with runtime application self-protection techniques, the context dependency relationship of operation behavior is dynamically analyzed, and an enhanced parameter set is generated, including system resource usage indicators and environment variables. Generating operation records can use the event trace mode, which appends each operation record as an immutable event to a read-only log stream, and separates read and write loads through the CQRS architecture to improve system scalability and consistency.

[0037] In terms of data processing logic expansion, a complex event processing engine is introduced to perform real-time pattern recognition and correlation analysis on the operation behavior data stream. When extracting execution parameters, a sliding time window is applied to calculate operation frequency and sequence rules, and automatically detect abnormal behavior characteristics, such as high-frequency modification or unauthorized access. During the generation of operation records, a natural language processing model is integrated to extract key entities and relationships from operation description texts, enriching the semantic dimension of records and enhancing the ability to identify hidden operation intentions, and optimizing the availability value of audit data.

[0038] Step S20, determining the operation type of the operation information; In this embodiment, the operation type of the operation information is determined through a multi-layer classification pipeline. The classification pipeline first retrieves the operation information from the audit log database and inputs it into a feature extraction module. The feature extraction module parses the structured fields in the operation information, including the operation command, document status flag, user role code, and time period index. The feature vector is then input into a decision system that has a rule engine and a machine learning classifier in parallel. The rule engine performs hard matching based on the business policy library. For example, if the operation command is "urgent revision" and the document status is "published", it is directly classified as an irregular operation.

[0039] In the case of pending rule matching, the machine learning classifier takes over the processing. The classifier uses a pre-trained support vector machine model to learn the decision boundary based on historical operation data. The model input of the support vector machine model includes operation frequency features, context similarity, and risk scores. The output is an operation type probability distribution. Based on this classification result, the arbitration module synthesizes the rule and model output to generate the final operation type label, which includes regular operation, irregular operation, or undefined operation, with a confidence index for reference by subsequent modules.

[0040] In another feasible implementation, the operation type determination can introduce graph neural network technology. The operation information is modeled as a heterogeneous graph, with nodes representing operation events, document entities, and users, and edges representing operation relationships. The graph neural network aggregates neighborhood features through a message passing algorithm to learn deep representations of operation context and classify operation types. This method is particularly suitable for handling complex operation chains and cross-document dependencies, improving classification accuracy.

[0041] In addition, the classification system integrates a real-time feedback mechanism, allowing administrators to label and correct classification results and correct data flowing into the online learning pipeline to incrementally update machine learning model parameters. In addition, classification performance indicators such as precision and recall are regularly evaluated, and feature weights or rule thresholds are automatically adjusted. This adaptive design ensures that the classification system remains efficient as the business evolves.

[0042] For high-concurrency operation streams, the classification pipeline uses a distributed computing framework such as Apache Spark Streaming for parallel classification. Operation information is processed in shards by document type to reduce processing delay. When writing classification results back to the audit database, atomic transaction checks are performed to prevent data inconsistency.

[0043] Further, a type statistical report is generated based on the above classification operation, which summarizes the proportion and trend of regular and irregular operations, and is pushed to a monitoring dashboard to assist administrators in system health assessment.

[0044] In addition, after the step of determining the operation type, an operation intention evaluation mechanism based on dynamic risk profiling is further introduced. Specifically, the system maintains a dynamic risk database associated with users, roles, and document sensitivity levels. When an irregular operation is identified, the system queries the recent behavior baseline of the operation initiator, historical violation records, and the security score of the current session in real time. Meanwhile, by combining the document classification label and keyword analysis of the operation content, the system extracts the semantic intention (such as "emergency revision" and "temporary authorization") in the operation description through a pre-trained natural language processing model, and calculates the deviation of the intention from the known compliance mode. Finally, the system generates a comprehensive risk index that integrates behavior deviation, document sensitivity, and contextual anomaly indicators. If the risk index exceeds the adaptive threshold, the system automatically raises the monitoring level of the operation and triggers real-time alerts to the security administrator console. At the same time, the risk index and evaluation basis are stored as enhanced metadata in the audit trail of the document operation, thereby achieving early warning and deep tracing of potential malicious or negligent operations.

[0045] Based on the above analysis, the step of determining the operation type of the operation information includes: extracting the behavior features of the operation information and determining whether the behavior features conform to the preset business operation process; if the behavior features conform to the preset business operation process, determining that the type of the operation information is a regular operation; if the behavior features do not conform to the preset business operation process, determining that the type of the operation information is an irregular operation.

[0046] In this embodiment, the operation type is distinguished by comparing the behavior features of the operation information with the conformity of the preset business operation process. First, the key behavior features are extracted from the operation information, which are a multi-dimensional vector. The elements of the multi-dimensional vector include operation command sequence, execution timing pattern, associated document lifecycle state, and initiator user role context. Furthermore, semantic parsing and pattern recognition algorithms are used to extract the behavior features, converting unstructured logs in the operation information into standardized feature representations for subsequent process analysis and decision-making.

[0047] After the behavior features are extracted, they are input into a process compliance checking engine, in which a digital model of the preset business operation process is built in. The digital model defines the sequence of all compliant operations, state transition conditions, and role permission constraints in the form of state machines or business process modeling and annotation graphs. Therefore, the digital model matches the behavior feature vector with the preset business operation process model through graph traversal or rule inference algorithm, and outputs a Boolean decision result about compliance.

[0048] If the behavior features completely comply with the preset business operation process, that is, the operation sequence, execution context, and permissions are all within the allowed range defined by the model, it is determined that the type of the operation information is regular operation. This determination result will trigger the standard document processing and backup link, and the operation information is marked as regular type and routed to the corresponding regular operation processing module.

[0049] If the behavior features do not comply with the preset business operation process, for example, an undefined command sequence, abnormal state transition, or permission access beyond the limit is detected, it is determined that the type of the operation information is irregular operation. This determination result will activate the enhanced audit and context collection process, and the operation information is given an irregular operation identifier, and the targeted exception handling and recording mechanism is started.

[0050] In another possible implementation, the process compliance judgment can introduce a deep learning model trained based on historical operation data, which automatically learns the complex nonlinear relationship between behavior features and process compliance by analyzing a large number of regular and irregular operation samples, identifies edge cases that are difficult for rule engines to cover, and improves the accuracy and adaptive ability of operation type determination.

[0051] Further, the step of extracting the behavior features of the operation information and determining whether the behavior features comply with the preset business operation process includes: analyzing the execution path of the behavior features to determine whether the execution path complies with the preset standard workflow; detecting whether the execution path contains a special permission call; determining whether the behavior features comply with the preset business operation process according to the execution path analysis and the detection result of the special permission call.

[0052] In this embodiment, the specific process of extracting the behavior characteristics of the operation information and determining whether it conforms to the preset business operation process is refined into the detection of the compliance of the execution path and the special permission call. Specifically, first, the execution path contained in the behavior characteristics is analyzed, which refers to an ordered set of a series of system calls, service interface accesses and state changes involved in completing a specific document operation. Based on the path analysis engine, the call chain identifier in the operation log can be parsed to reconstruct the complete execution path graph.

[0053] After the execution path is reconstructed, the execution path is compared with the preset standard workflow, which is stored in the form of a directed acyclic graph in the process knowledge base, and clearly specifies the standard steps, sequence and legal branches of various document operations. The edit distance or isomorphism between the execution path and the standard workflow graph is calculated, and if the execution path can be completely contained in the standard workflow, it is determined that the path is compliant; if there are deviated, missing or redundant nodes and edges, it is determined that the path is not compliant.

[0054] Concurrently, the special permission call detection module monitors whether the execution path triggers system permissions or management interfaces higher than the regular operation level, such as direct database writing, bypassing the approval chain to force release commands or directly modifying the access control list. The detection is based on a dynamically updated special permission signature library, which identifies high-risk call instructions in the path in real time through pattern matching.

[0055] Finally, the process compliance decision maker integrates the analysis results of the execution path and the detection results of the special permission call to make joint reasoning. If the execution path conforms to the standard workflow and does not contain any special permission call, it is finally determined that the behavior characteristics conform to the preset business operation process; otherwise, if the execution path is not compliant or any condition of the special permission call is detected, it is finally determined that the behavior characteristics do not conform to the preset business operation process.

[0056] In another feasible implementation, the execution path analysis can use real-time streaming complex event processing technology to window aggregate and sequence pattern match the event stream generated by the operation behavior, so as to dynamically judge the path compliance. The special permission detection can integrate behavior-based anomaly detection algorithms, which not only rely on static signatures, but also analyze the frequency and timing context of permission calls to identify potential permission abuse behaviors, thereby improving the recognition ability of new unconventional operations.

[0057] Step S30, if the operation type is a regular operation, generating an operation backup of the document operation event; In this embodiment, when the operation type is determined to be a regular operation, a backup management service is invoked to generate an operation backup of the document operation event. The backup management service first obtains the current version binary data of the target document from the document repository and merges metadata in the operation information, such as the operation sequence number and version label. The operation backup is constructed as a composite object containing the full content of the document, the operation timestamp, the operator digital signature, and the version difference digest. After the backup data is encrypted by AES-256, it is persisted into a multi-tenant object storage system, ensuring data confidentiality and storage isolation.

[0058] During the backup generation process, a version control strategy is implemented to create a linear version history for each regular operation. The version management is based on a content-addressed storage model, in which each backup version is uniquely identified by the document content hash value and the inter-version dependency is maintained through a Merkle tree structure. Backup metadata is recorded in a version registry, including the parent version pointer, the change set size, and the storage location index. This design supports efficient version rollback and difference comparison.

[0059] In another feasible implementation, an incremental snapshot technology is used to implement the operation backup, and the backup management service monitors the block-level changes of the document storage volume and captures the modified data blocks through a write-time copy mechanism. Only the changed blocks and operation metadata are packaged into an incremental backup, reducing storage occupancy. During backup, the system calculates a global consistency point to ensure that the backup data is atomically aligned with the operation event. During the recovery process, the incremental backup is reconstructed into a complete version through chain reorganization.

[0060] In addition, the backup storage architecture adopts an erasure coding encoding scheme to shard and distribute the backup data to multiple geographic nodes. This scheme optimizes storage efficiency while ensuring data reliability. The backup operation is executed asynchronously through an event-driven architecture, avoiding blocking the main business thread. The backup completion event is published to the system message queue, triggering the subsequent audit process.

[0061] Backup lifecycle management is automatically executed based on a policy engine, which defines backup retention periods and archiving rules according to document retention regulations and business needs. For example, regular operation backups may be retained until the next quality audit period and then automatically migrated to cold storage. The policy engine periodically scans backup metadata to perform cleaning or compression tasks.

[0062] Backup integrity is guaranteed through a checksum verification mechanism. After each backup is generated, a SHA-256 hash value is calculated and stored in a separate verification service. Regular integrity scans compare the stored data with the verification value, and when damage is found, a repair process is triggered. Backup access logs are separately recorded for security auditing.

[0063] In addition, the backup management service provides a RESTful API to support external systems to initiate on-demand backups or query backup status. API requests are authenticated by OAuth 2.0 to ensure operation authorization. This interface design facilitates the integration of automated operation and maintenance tools to achieve end-to-end management of the backup process.

[0064] In step S40, if the operation type is an irregular operation, context information of the document operation event is collected and saved in association with the operation history of the document.

[0065] In this embodiment, when the operation type is determined to be an irregular operation, a context collection engine is activated to collect context information of the document operation event. The context collection engine aggregates context data from multi-dimensional data sources, including system performance indicators, user behavior logs, environment variables, and external event triggers. The collected context information specifically covers operation terminal information, network session details, concurrent process status, permission change records, and business reason descriptions. Data collection is achieved through proxy programs and service mesh telemetry technology, ensuring low invasiveness and high coverage.

[0066] In the collection logic, the context data is standardized into a unified schema, with core fields defined by the schema, such as event causal relationship diagrams, risk level identifiers, and compliance reference clauses. The standardization process applies data fusion algorithms to address time synchronization and entity resolution issues in multi-source data. Finally, the context information is encoded in JSON-LD format, supporting semantic queries and associated data expansion.

[0067] In another possible implementation, the collection of context information is enhanced through a blockchain-assisted evidence storage mechanism. Each irregular operation generates a unique transaction hash, and the context information is recorded as a transaction payload in a permissioned chain network. On-chain evidence storage provides tamper-proofing and timestamp authority authentication, particularly suitable for high-security scenarios. When retrieving the context information, the data integrity and access rights are verified through a smart contract.

[0068] The collected context information is saved in association with the operation history of the document in an audit data lake, and a graph database is used to store this association. The operation history node is linked to the context node through edge relationships, and edge attributes describe the association type and strength, such as "trigger" or "impact". When querying, a graph traversal algorithm efficiently retrieves the context information of the entire chain of operation history.

[0069] In addition, the correlation preservation procedure implements consistency checks to ensure that the context information is logically consistent with the timeline of the operation event. The check rules are based on a temporal database and a business rules engine, e.g. checking if the pre-operation permission state allows an irregular action. If a contradiction is detected, the system generates an exception event and notifies an administrator for intervention.

[0070] To support complex analysis, the data of the context information is indexed into a search engine, allowing full-text retrieval and aggregate queries. Predefined analysis views, such as irregular operation root cause analysis dashboards, visualize the correlation patterns of context and operation history. Machine learning models are trained with the correlation data to predict the probability of occurrence and the impact range of irregular operations.

[0071] The context collection module provides data export functions in standard formats such as XES or MXML for process mining tool integration. The export process includes data desensitization and anonymization processing to meet privacy protection requirements. This extensibility enables the system to adapt to cross-domain audit and compliance reporting needs.

[0072] Based on the above analysis, if the operation type is an irregular operation, the steps of collecting the context information of the document operation event and correlating and preserving the context information with the operation history of the document include: Obtaining environment scenario parameters based on the document operation event and recording operation credentials triggering the document operation event; Storing the environment scenario parameters and the operation credentials in association with the document operation record corresponding to the document operation event.

[0073] In this embodiment, when it is determined that the operation type is an irregular operation, an enhanced context collection process is immediately started. The enhanced context collection process first obtains environment scenario parameters when the document operation event is executed through a monitoring agent cluster deployed in the infrastructure layer. The environment scenario parameters are a multi-dimensional data set, including server load indicators, network connection status, geographic location information of the access terminal, system time window when the operation occurs, and a list of other processes running concurrently. The parameter information based on the multi-dimensional data set is collected in real time by performance monitoring tools and network security probes, and is aggregated to a context processing engine through a unified data bus for standardized processing.

[0074] While collecting the environmental context parameters, the operation credentials triggering the document operation event are recorded. The operation credentials not only contain the basic user identity, but also extend the record of multi-factor authentication tokens, session key hash values, specific permission delegation records for this operation, and the valid period timestamp of the credentials. The system obtains the complete credential issuance chain and real-time authorization status by calling the identity management and access control service, ensuring the verifiability and non-repudiation of the operation credential record.

[0075] After completing data collection, the environmental context parameters and the operation credentials are associated with the document operation record corresponding to the document operation event. This association process is achieved by generating a globally unique transaction identifier, which is embedded in the metadata of the document operation record, the environmental context parameter set, and the operation credential record, and all associated data are encapsulated into an indivisible audit unit and persisted into an audit data store with versioning characteristics. A column-oriented database structure is used for storage to optimize the performance of subsequent association queries for specific dimensions.

[0076] In addition, the eBPF technology-based kernel observability framework can also be introduced to obtain the environmental context parameters, thereby capturing more detailed runtime contexts at the operating system level, such as system call sequences, file descriptor states, and memory page access patterns. The record of operation credentials can be integrated with blockchain technology, which synchronously writes the key fingerprint information of the credentials to a permission chain node at the time of operation, and uses the distributed ledger characteristics to provide strong evidence with timestamp and consensus mechanism guarantee for subsequent audits, greatly enhancing the credibility and tamper resistance of the associated stored data.

[0077] Further, in the step of collecting and associating the context information of the irregular operation, the distributed storage and integrity protection mechanism based on the permission chain is further integrated. When the system determines that it is an irregular operation and captures its context data (including environmental parameters, operation credentials, session snapshots, etc.), the hash value of the key context information, the timestamp, and the unique identifier of the operation event are immediately assembled into a storage transaction and submitted to the permission chain network deployed in the organization. The on-chain nodes verify and record the transaction through the consensus algorithm, generate an immutable on-chain storage record, and return a storage receipt (including block height and transaction hash). Subsequently, the system binds the receipt with the locally stored complete context information and stores them together in the audit database. In subsequent audits or dispute verification, auditors can quickly locate the on-chain storage through the receipt and perform a hash comparison on the locally stored context data to verify that it has not been tampered with since the storage. This mechanism not only enhances the credibility and anti-fraud of irregular operation records, but also provides a standardized verification interface for cross-department and cross-system audit collaboration, especially suitable for high-security scenarios that require strict compliance.

[0078] In summary, by distinguishing between regular and irregular operation types and collecting complete context information for irregular operations for associated storage, the full-process traceability of document irregular operations is achieved, effectively improving the integrity and audit reliability of document management.

[0079] Further, it can also be seen that Figure 2 , Figure 2 is a flowchart of the second embodiment of the document security management method based on high security according to the present application, based on Figure 2 , the document security management method based on high security further comprises steps S50-S70: Step S50, monitor the abnormal state of the document operation event execution process, the abnormal state includes non-working period operation and multiple authentication failure records; Step S60, when detecting an abnormal state, generate an abnormal event marker and record an abnormal handling process; Step S70, associate and save the abnormal event marker and the abnormal handling process with the document operation record corresponding to the document operation event.

[0080] In this embodiment, after the operation type recognition and processing are completed, a systematic abnormal state monitoring and processing procedure is further performed. Through the integrated security information and event management module, multi-dimensional abnormal states during the execution of the document operation event are continuously monitored. The determination of the multi-dimensional abnormal states is based on the joint output of the dynamic rule engine and the machine learning model, and the monitoring range is not limited to non-working period operation and multiple authentication failure records, but is extended to include composite indicators such as operation sequence anomaly, access frequency mutation, resource consumption mode deviation from the baseline, and geographic space login conflict. Real-time data streams are pulled from the identity authentication service, network traffic probe, and application program log, and through the complex event processing engine, stream aggregation and pattern matching are performed to identify operation behaviors that meet the abnormal definition in real time.

[0081] When any abnormal state is detected, an abnormal event processing pipeline is triggered, which generates a structured abnormal event tag containing abnormal level classification, trigger rule identifier, confidence score, and time sensitivity label. Subsequently, an abnormal processing procedure corresponding thereto is automatically recorded, which covers system automatic response actions such as temporary session interruption, immediate authority downgrade, or sending a secondary verification request, as well as security administrator possible intervention of manual disposal decision and operation instruction. All disposal steps are recorded in detail in the security event tracking system to form a complete disposal timeline.

[0082] Furthermore, the abnormal event tag and abnormal processing procedure are deeply associated with the document operation record corresponding to the document operation event that triggered the abnormality, and are saved, and this association mechanism is realized through distributed link tracking technology, and a globally unique tracking identifier is assigned to the entire abnormal event chain, which is injected into the abnormal event record, disposal process log, and original document operation record. All associated data are uniformly stored in a security data lake with time sequence characteristics, and the storage structure is optimized to support efficient cross-entity association query and forensic analysis, ensuring that the entire life cycle information from abnormal detection to disposal completion can be seamlessly traced back.

[0083] In another feasible implementation, a service mesh-based agentless architecture is used for abnormal state monitoring, and telemetry data of inter-service calls are analyzed to detect abnormal behaviors at the microservice level. The record of the abnormal processing procedure can introduce intelligent script technology, which encodes the disposal process into an executable automated script, records manual operations, automatically executes the response steps defined in the script, and records the execution results and effect evaluation, thereby improving the speed and consistency of abnormal response and providing a data basis for quantitative analysis of disposal effect.

[0084] Specifically, the step of monitoring the abnormal state of the document operation event execution process comprises: acquiring a timestamp of the document operation event in real time, determining whether the timestamp is in a preset working time period; if the timestamp is not in the preset working time period, recording a duration of the document operation event, and generating a time anomaly label; saving the time anomaly label in association with a document operation record corresponding to the document operation event.

[0085] In this embodiment, the abnormal state of the non-working time period operation during the execution of the document operation event is realized through fine time sequence analysis. By acquiring the timestamp of the document operation event in real time, the timestamp is derived from a system clock synchronized through a network time protocol and is attached with a time zone identifier. After acquiring the timestamp, a time period strategy service is called to compare the timestamp with a preset working time period. The preset working time period is a dynamic strategy set, which not only includes a standard working time definition based on a calendar, but also may cover exceptional dates, department-specific schedules, and special working windows adjusted due to temporary projects.

[0086] If it is determined through comparison that the timestamp is not in any preset working time period, it is determined that the document operation event has a time dimension anomaly. Subsequently, a duration tracking process is started, which continuously monitors the entire life cycle from the start of the document operation event to the end of its session or forced termination, accurately records the active duration, idle time proportion, and whether different non-working time period blocks are crossed. Based on this, a time anomaly label is generated, which encapsulates quantitative information such as anomaly type, deviation degree, and duration.

[0087] Finally, the time anomaly label is saved in association with the document operation record corresponding to the document operation event that triggered the monitoring. The association operation is performed by adding a field in a high-concurrency document operation record database for linking security event labels to the corresponding record entries, and writing the unique identifier of the time anomaly label into the field. At the same time, a reverse reference is established in an independent security event index to ensure that all related time anomaly events can be quickly located through the document operation record during auditing, and vice versa.

[0088] In another feasible implementation, the compliance verification of the timestamp can introduce an adaptive learning mechanism based on user behavior baseline. By analyzing the historical legal operation time patterns of a specific user or user group, a personalized activity time baseline is dynamically generated, rather than relying completely on static preset working time periods. When the operation timestamp significantly deviates from the individual or group baseline, even if it is within the general preset working time period, it may be marked as abnormal, thereby achieving more fine detection of internal threats disguised as normal work.

[0089] Further, it can also be seen that Figure 3 , Figure 3 is a flowchart of a third embodiment of the document security management method based on high confidentiality according to the present application, based on Figure 3 , the document security management method based on high confidentiality further comprises steps S80-S110: Step S80, count the number of authentication failures of the same operation credential within a preset time period; Step S90, compare the number of authentication failures with a preset security threshold; Step S100, if the number of authentication failures exceeds the preset security threshold, generate a security anomaly marker and trigger a security warning; Step S110, save the security anomaly marker in association with the corresponding operation credential information.

[0090] In this embodiment, the persistence monitoring and response mechanism for the security state of the operation credential. Specifically, through the identity authentication service interface, the number of authentication failures of the same operation credential within a preset time period is collected and counted in real time, and the operation credential is normalized to a unique identity identifier, such as a user subject name or a hash value of a device token. The sliding time window algorithm is used in the statistical engine to aggregate and calculate the incoming authentication event stream, and the window size of the sliding time window algorithm can be dynamically adjusted according to the security policy, while recording the context information of each authentication failure, including the attempt timestamp, source IP address, authentication protocol used and failure reason code, providing multi-dimensional data support for subsequent analysis.

[0091] The number of authentication failures obtained by statistics is compared with a preset security threshold, which is not a fixed value but a dynamic variable managed by a policy engine, and the specific value can be adaptively adjusted based on historical baseline, real-time threat intelligence or user risk profile. In this comparison logic, not only the size of the value is determined, but also the spatiotemporal distribution density of the failure attempts, such as a concentrated failure from geographically dispersed locations within a short period of time, even if the total number does not exceed the threshold, it may also be identified as a potential attack pattern and trigger a warning.

[0092] If it is determined that the number of authentication failures exceeds the preset security threshold, a structured security anomaly marker is generated immediately, which includes an anomaly event ID, a risk level assessment, a specific threshold rule triggered, and a time validity identifier. At the same time, a hierarchical security warning process is automatically triggered, which performs a series of actions from notifying the administrator to automatic intervention according to the risk level, such as temporarily freezing the operation credential, forcing password reset, increasing the session monitoring level, or sending an alarm event to the security operation center.

[0093] Finally, the security exception marker is associated with the operation credential information that triggered this alert and saved. The association is made by creating a record in the security event log of the credential management database that is uniquely bound to the operation credential, and the record is linked to the full content of the security exception marker. In addition, the association information is synchronized to the security information and event management system and the identity governance platform, ensuring that any subsequent operations during the credential lifecycle can reference this exception history and provide data input for overall security posture assessment.

[0094] In another possible implementation, the statistics and evaluation of the number of authentication failures can introduce a complex event processing architecture based on a stream processing platform that can associate authentication failure events from multiple sources (such as VPN gateways, application portals, single sign-on systems) in real time, and through unified entity behavior analysis, more accurately identify distributed attacks against the same credential. The alert triggering mechanism can be integrated with an automated orchestration response system to achieve a closed-loop automation from detection to disposal, such as automatically listing high-risk credentials in a dynamic blacklist and implementing immediate isolation at the network level.

[0095] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the high-security-based document security management method of the present application. Further simple transformations based on this technical concept are within the scope of protection of the present application.

[0096] The present application provides a high-security-based document security management device, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the high-security-based document security management method in the above embodiment one.

[0097] Reference will now be made to Figure 4 which shows a structural schematic diagram of a high-security-based document security management device suitable for use to implement the embodiments of the present application. The high-security-based document security management device in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant: personal digital assistants), PADs (Portable Application Description: tablet computers), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 4 The high-security-based document security management device shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0098] As shown in Figure 4 The high-security based document security management device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. In the random access memory 1004, various programs and data required for the operation of the high-security based document security management device are also stored. The processing device 1001, the read only memory 1002, and the random access memory 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the high-security based document security management device to communicate with other devices wirelessly or by wire to exchange data. Although the high-security based document security management device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0099] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carrying computer program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the read only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of embodiments of the present disclosure are performed.

[0100] The high-security-based document security management device provided by the application adopts the high-security-based document security management method in the above embodiment, and can solve the technical problem that the prior art cannot completely trace the irregular operation in document management. Compared with the prior art, the high-security-based document security management device provided by the application has the same beneficial effects as the high-security-based document security management method provided by the above embodiment, and other technical features in the high-security-based document security management device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0101] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0102] The above is merely specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0103] The present application provides a storage medium, which is a computer readable storage medium, has computer readable program instructions (i.e. computer programs) stored thereon, and the computer readable program instructions are used to execute the high-security-based document security management method in the above embodiment.

[0104] The computer readable storage medium provided in the present application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), or any suitable combination of the above.

[0105] The above computer readable storage medium may be contained in a high-security based document security management device or may exist separately without being assembled into a high-security based document security management device.

[0106] The above computer readable storage medium carries one or more programs, which, when executed by the high-security based document security management device, enable the high-security based document security management device to implement the technical content of the above-mentioned high-security based document security management method embodiment.

[0107] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0108] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0109] The modules involved in the embodiments of the present application can be implemented in software or hardware. In some cases, the names of the modules do not constitute a limitation on the modules themselves.

[0110] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., computer programs) for executing the high-security-based document security management method described above, and can solve the technical problem that the prior art cannot completely trace the irregular operation in document management. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the high-security-based document security management method provided by the above embodiments, and will not be described here.

Claims

1. A high-security-based document security management method, characterized by, The high-security-based document security management method comprises the following steps: Real-time monitoring of document operation events and generating operation information based on the document operation events, wherein the document operation events include regular operation or irregular operation on quality manual, program file, standard operation procedure or table; Determining the operation type of the operation information; If the operation type is regular operation, generating operation backup of the document operation event; If the operation type is irregular operation, collecting context information of the document operation event and saving the context information in association with the operation history of the document.

2. The high-security-based document security management method of claim 1, wherein, The step of real-time monitoring of document operation events and generating operation information based on the document operation events comprises: Capturing user operation behavior based on the document, extracting execution parameters of the operation behavior as the document operation event; Generating the operation record based on the execution parameters.

3. The high-security-based document security management method of claim 1, wherein, The step of determining the operation type of the operation information comprises: Extracting behavior characteristics of the operation information, determining whether the behavior characteristics conform to the preset business operation process; If the behavior characteristics conform to the preset business operation process, determining the type of the operation information as regular operation; If the behavior characteristics do not conform to the preset business operation process, determining the type of the operation information as irregular operation.

4. The high-security-based document security management method of claim 3, wherein, The step of extracting the behavior characteristics of the operation information and determining whether the behavior characteristics conform to the preset business operation process comprises: Analyzing the execution path of the behavior characteristics, determining whether the execution path conforms to the preset standard workflow; Detecting whether the execution path contains special permission call, According to the execution path analysis and the detection result of the special permission call, determining whether the behavior characteristics conform to the preset business operation process.

5. The high-security based document security management method of claim 1, wherein, The step of collecting context information of the document operation event and saving the context information in association with the operation history of the document if the operation type is irregular operation comprises: Obtaining environment scene parameters based on the execution of the document operation event, and recording operation credentials triggering the document operation event; Storing the environment scene parameters and the operation credentials in association with the document operation record corresponding to the document operation event.

6. The high-security based document security management method according to any one of claims 1 to 5, characterized in that, The high-security-based document security management method further comprises: Monitoring the abnormal state of the document operation event execution process, the abnormal state including non-working period operation and multiple authentication failure records; When detecting the abnormal state, generating an abnormal event marker and recording an abnormal processing process; Saving the abnormal event marker and the abnormal processing process in association with the document operation record corresponding to the document operation event.

7. The high-security-based document security management method of claim 6, wherein, The step of monitoring the abnormal state of the document operation event execution process comprises: Real-time acquisition of the timestamp of the document operation event, determination of whether the timestamp is in the preset working period; If the timestamp is not in the preset working period, recording the duration of the document operation event and generating a time abnormality marker; Saving the time abnormality marker in association with the document operation record corresponding to the document operation event.

8. The high-security based document security management method according to any one of claims 1 to 5, wherein, The high-security-based document security management method further comprises: counting the number of authentication failures of the same operation credential within a preset time period; comparing the number of authentication failures with a preset security threshold; generating a security anomaly mark and triggering a security warning if the number of authentication failures exceeds the preset security threshold; saving the security anomaly mark in association with the corresponding operation credential information.

9. A high-security-based document security management apparatus, characterized by comprising: The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the high-security-based document security management method according to any one of claims 1 to 8.

10. A storage medium, characterized by The storage medium is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the high-security-based document security management method according to any one of claims 1 to 8.

Images