Clipboard management method, electronic device and computer program product

Abstract

The embodiment of the invention provides a clipboard management method, an electronic device and a computer program product. The method comprises the following steps: carrying out sensitivity grading on information contents to be copied; when determining that the sensitivity level is a first sensitivity level, setting a security policy of the information content; and according to the security policy, executing a clipping and pasting operation on the information content. The problem that the data security of the clipboard is poor in the prior art is solved, and the effect of improving the data security of the clipboard is achieved.

Description

Technical Field

[0001] The present invention relates to the field of communications, and more specifically, to a clipboard management method, an electronic device, and a computer program product. Background Technology

[0002] With the widespread adoption of smart devices, more and more people are using the clipboard function. As a fundamental function of software systems and frequently used by users, the clipboard acts as a data transfer station. However, current clipboard technology offers relatively limited functionality and lacks information access control, making it prone to information leakage, reducing user experience, and failing to meet the information leakage prevention requirements of some industries. Summary of the Invention

[0003] This invention provides a clipboard management method, electronic device, and computer program product to at least solve the problem of poor data security of the clipboard in related technologies.

[0004] According to an embodiment of the present invention, a clipboard management method is provided, comprising: classifying the sensitivity of information content to be copied; when the sensitivity classification is determined to be a first sensitivity level, setting a security policy for the information content; and performing a clipping operation on the information content according to the security policy.

[0005] According to another embodiment of the present invention, a network device is also provided, the network device including a receiver, a transmitter and a processor, the network device being configured to perform the steps of any of the above method embodiments via at least one of the receiver, the transmitter and the processor.

[0006] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0007] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0008] According to yet another embodiment of the present invention, a computer program product is also provided, comprising a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0009] The present invention provides a clipboard management method through the above embodiments, which involves classifying the sensitivity of the information content to be copied; when the sensitivity classification is determined to be the first sensitivity level, setting a security policy for the information content; and performing a clipboard operation on the information content according to the security policy. This solves the problem of poor clipboard data security in related technologies and achieves the effect of improving clipboard data security. Attached Figure Description

[0010] Figure 1 This is a hardware structure block diagram of a mobile terminal for the clipboard management method according to an embodiment of the present invention;

[0011] Figure 2 This is a system architecture diagram of the clipboard management method according to an embodiment of the present invention;

[0012] Figure 3 This is a flowchart of the clipboard management method according to an embodiment of the present invention;

[0013] Figure 4 This is a flowchart illustrating cross-device copy and paste functionality according to an embodiment of the present invention;

[0014] Figure 5 This is a flowchart illustrating the copy-paste process within the same device according to an embodiment of the present invention. Detailed Implementation

[0015] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0017] Current mainstream operating systems (such as Windows, macOS, Android, and iOS) typically have built-in clipboard functionality, and users can further enhance this functionality by downloading third-party clipboard management tools. These existing technologies have significant technical flaws: Lack of content sensitivity identification and tiered protection: Content copied using existing clipboard technologies, whether general text or sensitive information such as accounts and passwords, is stored in plaintext in memory. This poses a risk of being spied on by malware or background applications; Lack of access control: As a globally shared resource, the clipboard in existing technologies is equally accessible to all applications, failing to distinguish between trusted and unknown applications, leading to sensitive information being exposed to uncontrolled access; Weak cross-device synchronization security mechanisms: Existing clipboard functions only focus on data accessibility during pasting operations, without imposing any restrictions on the number of pasting operations or target application usage management, resulting in uncontrolled pasted content and exacerbating the risk of information leakage.

[0018] This application proposes a security-level hierarchical management method to address the problem of sensitive information leakage caused by the lack of security control in existing clipboard systems. This method enables hierarchical storage and encryption of clipboard content, allowing for automatic destruction or restricted use of clipboard content through security policies. Furthermore, this application provides a dynamic permission model based on application identity to precisely control the access behavior of applications with different trust levels to clipboard content. Additionally, this application provides a cross-device clipboard content access management method, integrating cross-device usage restrictions and interface anonymization display functions. This achieves systematic security protection for sensitive information in clipboard content throughout its entire lifecycle—from copying, storage, transmission, use, and display—effectively preventing information leakage caused by clipboard misuse.

[0019] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices, such as, but not limited to, smartphones, tablets, smart wearable devices, smart vehicle systems, and smart home control devices. Taking running on a mobile terminal as an example... Figure 1 This is a hardware structure block diagram of a mobile terminal for the clipboard management method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0020] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the clipboard management method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0021] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0022] The embodiments of this application can be applied to Figure 2 The system architecture shown is as follows: Figure 2 As shown, the system architecture includes: an application layer, a clipboard security agent, a core service layer, a system layer, and a hardware layer. The core service layer includes a policy management engine, an encryption / decryption engine, a secure storage area, and a cross-device synchronization service.

[0023] The clipboard security agent intercepts all application access requests to the system clipboard and forwards them to the policy management engine for authentication. It is responsible for invoking the encryption / decryption engine to process content and managing the secure storage area. The clipboard security agent takes over and redirects traditional global clipboard access mechanisms, forming the foundation for implementing dynamic access control and hierarchical storage.

[0024] The policy management engine can store and execute all security policies, including: a) Content sensitivity classification rules: identifying and classifying copied content. In an exemplary embodiment, the classification is as follows: plain text, important information, sensitive information, etc. b) Application identity dynamic permission model, including trusted applications, unknown applications, or background applications. Trusted applications can be user-defined secure applications; unknown applications are untrusted applications; background applications are applications not currently being used by the user. c) Paste policy (paste here refers to clipboard content operations in a broad sense, and can also include forwarding, etc., applicable to the same device or across devices): this restricts pasted content, such as determining whether the application requesting paste is a trusted application, limiting the number of times it can be used, and limiting the duration of use. d) Automatic content destruction policy: this determines the content pasted to the clipboard. If it is sensitive information, a time limit is set to prevent others from accessing the device and performing paste operations, thus preventing information leakage. The policy management engine centralizes and dynamically manages security rules to achieve "security classification" management.

[0025] The encryption / decryption engine is responsible for encrypting (before storage) and decrypting (before authorized pasting) content marked as sensitive. It manages encryption keys, ensuring that each key is bound to a device or user identity. In this embodiment of the invention, the specific encryption / decryption algorithm relied upon by the encryption / decryption engine (such as Advanced Encryption Standard - 256 bits (AES-256) or RSA public-key encryption algorithm) is replaceable; the algorithm can be upgraded according to security requirements without affecting the overall architecture.

[0026] The secure storage area, which can be located in system memory or a designated protected region, is used to encrypt and store sensitive clipboard content and its metadata (such as creation time, source application, paste policy, etc.). Unlike traditional clipboards that temporarily store information in a public memory area, the secure storage area in this embodiment of the invention achieves both physical isolation and encryption protection.

[0027] Cross-device synchronization service ensures that content and its associated security policies are synchronized to the target device via an encrypted channel when content is copied to the cloud or synchronized between devices. Cross-device synchronization service synchronizes not only content, but also its usage policies (such as "one-time paste"), achieving cross-device continuation of security policies.

[0028] It should be noted that the application layer, clipboard security proxy, core service layer, system layer, and hardware layer in the above network architecture, as well as the policy management engine, encryption / decryption engine, secure storage area, and cross-device synchronization service, are merely different functional divisions of the network architecture. In actual implementations, different naming methods can be used to distinguish the above functions, such as different modules, as long as the clipboard management method of this invention can be implemented. This invention is not limited to the above network architecture and functional naming.

[0029] This embodiment provides a clipboard management method. Figure 3 This is a flowchart of the clipboard management method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0030] Step S302: Sensitivity classification of the information content to be copied.

[0031] In this embodiment of the invention, before performing sensitivity classification on the information content to be copied, a copy request from the clipboard is first received, and the information content to be copied and metadata are obtained, wherein the metadata includes at least the source application package identifier of the information content.

[0032] In one exemplary embodiment, sensitivity classification of the information content to be copied includes: classifying the information content based on predefined rules; or, classifying the information content based on user needs; or, classifying the information content based on a preset AI recognition model.

[0033] In this embodiment of the invention, the predefined rules include at least one of the following: keyword matching; and source application package identification matching. That is, the sensitivity of information content can be graded based on whether the information content contains preset keywords or whether the source application of the information content is included in a preset source application package identification. In one embodiment, the sensitivity of information content can also be graded according to user needs. In one embodiment, an AI recognition model, such as a keyword recognition model, can be set to grade the sensitivity of information content. The AI ​​recognition model can be obtained through conventional model training methods, and no specific limitations are imposed here.

[0034] In one exemplary embodiment, sensitivity classification of the information content to be copied includes: performing sensitivity classification of the information content to be copied according to a first operation instruction; the operation instruction includes a selection operation of the information content to be copied or a clipboard preset function trigger operation.

[0035] In one exemplary embodiment, performing sensitivity classification on the information content to be copied includes: performing sensitivity classification on the information content to be copied, determining whether the sensitivity classification of the information content is a first sensitivity level or a second sensitivity level, wherein when the sensitivity classification is determined to be a second sensitivity level, the information content corresponding to the second sensitivity level is stored in a public storage area.

[0036] In this embodiment of the invention, the sensitivity classification of information content includes, but is not limited to, a first sensitivity level or a second sensitivity level. In one embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring encryption, and the second sensitivity level is the lowest sensitivity level, i.e., the level not requiring encryption. In one embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring special encryption or multiple encryption using complex methods. The second sensitivity level is a general sensitivity level, i.e., it can be encrypted using general methods and does not require confidential storage; it only needs to be stored in a public storage area for clipping.

[0037] In this embodiment of the invention, the clipboard content, i.e., the aforementioned information content, is subjected to sensitivity identification and classification (e.g., normal, sensitive), and sensitive content is subject to mandatory encrypted storage. By introducing an automatic destruction mechanism with security policies (e.g., after single use, after timeout), the risk of persistent leakage is eliminated from the source of the data lifecycle.

[0038] Step S304: When the sensitivity level is determined to be the first sensitivity level, set the security policy for the information content.

[0039] In one exemplary embodiment, a security policy is set for information content with a sensitivity level of first sensitivity, including at least one of the following: a threshold for the number of times the information content is used; the retention period of the information content; and a whitelist of applications that are allowed to use the information content.

[0040] In this embodiment of the invention, the security policy includes, but is not limited to, the number of times information content can be used, the storage duration, and allowed applications. A security policy for a single piece of information content may include one or more of these factors. For example, it may allow the content to be used three times within 30 minutes, and then be destroyed after 30 minutes or after three uses. Alternatively, the security policy may only include a single-use count, indicating that the information content is used only once and must be deleted immediately after being copied and pasted.

[0041] Step S306: Perform a cut and paste operation on the information content according to the security policy.

[0042] In one exemplary embodiment, before performing a cut-and-paste operation on the information content according to the security policy, the method further includes: encrypting the information content corresponding to the first sensitivity level, and storing the security policy and the ciphertext obtained from the encryption process.

[0043] In one exemplary embodiment, after storing the security policy and the ciphertext obtained through encryption processing, the method further includes: establishing an indication signaling signal for indicating the ciphertext identifier of the ciphertext.

[0044] In this embodiment of the invention, after the ciphertext obtained through encryption is securely stored, it is not necessary to copy and paste it between different devices or applications by transmitting the specific content of the ciphertext. Instead, a mapping relationship between the instruction signaling and the identifier of the ciphertext can be established through the aforementioned instruction signaling. Only the instruction signaling needs to be transmitted between different devices or applications, and the ciphertext can be accessed according to the instruction signaling. In one embodiment, the instruction signaling points to the encrypted content in the secure storage area, rather than the content itself.

[0045] In one exemplary embodiment, the method further includes: when the information content is copied and pasted from the first electronic device to the second electronic device, sending the instruction signaling, ciphertext, and security policy corresponding to the information content to the second electronic device via a secure channel.

[0046] In this embodiment of the invention, for cross-device copy and paste, a cross-device synchronization service is adopted, and the instruction signaling, security policy and ciphertext are sent to the second electronic device through a secure channel.

[0047] In one exemplary embodiment, the method further includes: after receiving the paste request from the target application, verifying the application identity of the target application and determining whether to allow pasting, wherein pasting is refused if the application identity is an unknown application; or, pasting is refused if the application identity is a background application and the sensitivity level is the first sensitivity level; or, pasting is allowed if the application identity is a trusted application and the application meets the security policy.

[0048] In this embodiment of the invention, a dynamic trust model is established at the application level, classifying applications into categories such as "trusted," "unknown," and "background," and dynamically authorizing them to access different levels of clipboard content accordingly. This feature fundamentally solves the security vulnerability of existing clipboards that treat all applications equally.

[0049] In one exemplary embodiment, after rejecting the pasting, the method further includes: destroying the ciphertext corresponding to the information content.

[0050] In this embodiment of the invention, "refuse to paste" means that the information content corresponding to the ciphertext cannot be copied and pasted, or that the target application that wants to paste the information content does not meet the conditions of the security policy. In order to avoid content leakage, the ciphertext needs to be deleted and destroyed.

[0051] In one exemplary embodiment, after allowing pasting, the method further includes: decrypting the ciphertext corresponding to the information content to obtain the information content; and performing desensitization processing on the information content before pasting.

[0052] In this embodiment of the invention, after pasting is allowed, the encryption / decryption engine uses a key (securely transmitted by a synchronization service) to decrypt the ciphertext. Before transmitting the information content to the target application, the information content can be partially anonymized according to settings (e.g., passwords are displayed as asterisks) before being entered into the application input box.

[0053] In one exemplary embodiment, after allowing pasting, the method further includes: displaying information content with a sensitivity level of first sensitivity level in a de-sensitized form on the system interface.

[0054] In this embodiment of the invention, sensitive content is de-identified by default in the system user interface (UI) (such as the clipboard history list). The report indicates that this improvement directly targets the physical leakage pathway of "peeping," enhancing security in the usage environment.

[0055] In one exemplary embodiment, after allowing pasting, the method further includes: updating the usage status of the information content; and if the usage status does not meet the security policy, destroying the ciphertext and security policy corresponding to the information content.

[0056] In this embodiment of the invention, after successful pasting, the policy management engine updates the usage status of the content (e.g., decrements the remaining usage count by 1). If the usage count is exhausted or a timeout occurs, the secure storage area is notified to automatically destroy the encrypted content and its policy.

[0057] This invention provides a clipboard management method that classifies the information content to be copied based on its sensitivity; when the sensitivity level is determined to be the first sensitivity level, a security policy is set for the information content; and a clipping operation is performed on the information content according to the security policy. This solves the problem of poor clipboard data security in related technologies and achieves the effect of improving clipboard data security.

[0058] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0059] This embodiment also provides a clipboard management device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0060] In this embodiment of the invention, the clipboard management device may further include different modules, and the naming and functional division of the modules may be selected in different ways according to the actual situation, without specific limitations.

[0061] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0062] This invention also provides a network device, which includes a receiver, a transmitter, and a processor. The network device is used to execute the steps of the clipboard management method embodiments described above through at least one of the receiver, transmitter, and processor.

[0063] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0064] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0065] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0066] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0067] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0068] In one exemplary embodiment, the computer program product described above includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the methods described in various embodiments of this application.

[0069] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0070] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0071] To enable those skilled in the art to better understand the technical solutions of the present invention, the following description is provided in conjunction with different embodiments.

[0072] Example 1

[0073] Figure 4 This is a flowchart illustrating cross-device copy and paste functionality according to an embodiment of the present invention, such as... Figure 4 As shown, it includes the following steps:

[0074] Phase 1: Copying operation (on the first electronic device).

[0075] Step S101: Intercept copy requests and content retrieval.

[0076] When a user selects text and performs a "copy" operation in any application on the first electronic device, the clipboard security agent intercepts the operation and obtains the content of the information to be copied and its metadata (such as the source application package name).

[0077] Step S102: Content sensitivity classification and security policy generation.

[0078] The strategy management engine classifies content into sensitivity levels (e.g., first sensitivity level or second sensitivity level) based on predefined rules (such as keyword matching, source application determination, etc.). In embodiments of this invention, the sensitivity classification of information content includes, but is not limited to, first sensitivity level or second sensitivity level. In one embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring encryption, and the second sensitivity level is the lowest sensitivity level, i.e., the level not requiring encryption. In another embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring special encryption or multiple encryption using complex methods, and the second sensitivity level is a general sensitivity level, i.e., encryption using general methods is sufficient.

[0079] Generation Policy: For sensitive (Level 1 Sensitivity) content, automatically generate and bind security policies, for example:

[0080] usage_limit: 1 (limits usage to 1 time);

[0081] TTL: 300000 (survival time 5 minutes);

[0082] allowed_apps: [com.trusted.app] (A whitelist of apps that are allowed to be pasted).

[0083] In this embodiment of the invention, the sensitivity of information content can also be graded according to user needs. In one embodiment, an AI recognition model, such as a keyword recognition model, can be set to grade the sensitivity of information content. The AI ​​recognition model can be obtained through conventional model training methods, and no specific limitations are imposed here.

[0084] Step S103: Content encryption and secure storage.

[0085] For sensitive content (i.e., information corresponding to the first sensitivity level), the encryption / decryption engine encrypts it using the security key of the first electronic device. The encrypted ciphertext, along with the aforementioned security policy, is stored in a secure storage area. Ordinary content (i.e., information corresponding to the second sensitivity level) may remain unencrypted and be temporarily stored in a public area.

[0086] Step S104: Update clipboard metadata.

[0087] The system clipboard is updated with only one instruction signaling, whose handle points to the encrypted content in the secure storage area, rather than the content itself.

[0088] Step S105: Cross-device synchronization.

[0089] The cross-device synchronization service synchronizes this instruction signaling, security policy, and ciphertext content to other devices (such as a second electronic device) under the user account via a secure channel (such as TLS). In this embodiment of the invention, after the ciphertext obtained through encryption is securely stored, it is not necessary to copy and paste the specific content of the ciphertext between different devices or applications. Instead, a mapping relationship between the instruction signaling and the identifier of the ciphertext can be established through the aforementioned instruction signaling. It is only necessary to transmit the instruction signaling between different devices or applications and then obtain and access the ciphertext according to the instruction signaling.

[0090] Phase Two: Pasting Operation (on the second electronic device).

[0091] Step S201: The target application requests paste.

[0092] A paste request is generated when the user clicks "paste" in the target application on the second electronic device.

[0093] Step S202: Permission verification.

[0094] The clipboard security agent intercepts the request and reports the application identity of the current requester to the policy management engine.

[0095] Dynamic permission verification: The policy engine performs verification based on the "application identity dynamic permission model".

[0096] If the requested application is an unknown application, access will be denied.

[0097] If the requesting application is a background application and the content is classified as Level 1 Sensitive (does not meet the security policy), access is denied.

[0098] If the requested application is on the allowed_apps whitelist of the security policy, or is a trusted application, then proceed to the next step of the security policy check.

[0099] Step S203: Compliance check of security policy.

[0100] The policy engine checks whether the paste request complies with the security policy set during copying.

[0101] The inspection items include, but are not limited to:

[0102] Usage count: Is the current usage count less than the limit? If not, reject the request and trigger content destruction.

[0103] Validity period: Is the content still within its Time To Live (TTL)? If it has expired, the content will be rejected and destroyed.

[0104] In this embodiment of the invention, the security policy for a piece of information content may include one or more of the above-mentioned usage count, storage duration, and allowed applications. For example, it may allow the information content to be used 3 times within 30 minutes, and then it must be destroyed after 30 minutes or after 3 uses. Alternatively, the security policy may only include one usage count, indicating that the use of the information content is one-time, and it must be deleted and destroyed immediately after being copied and pasted once.

[0105] Step S204: Content decryption and controllable output.

[0106] If all checks (including permission verification and security policy checks) pass, the encryption / decryption engine uses the key from the second electronic device (securely transmitted by the synchronization service) to decrypt the ciphertext.

[0107] Explicit anonymization: Before passing plaintext content to the target application, you can partially anonymize the content according to the settings (e.g., display passwords as asterisks) before filling it into the application's input box.

[0108] Interface feedback: In the system interface (such as the clipboard history list), sensitive content is always displayed in an anonymized form. ).

[0109] Step S205: Policy state update.

[0110] After successful pasting, the policy management engine updates the usage status of the content (e.g., decrements the remaining usage count by 1). If the usage count is exhausted or a timeout occurs, the secure storage area is notified to automatically destroy the encrypted content and its policy.

[0111] Through the above process, this embodiment of the invention achieves full-link, fine-grained security control over clipboard content from copying and synchronization to pasting, effectively solving the problem of information leakage.

[0112] The clipboard management method provided in this embodiment of the invention can also be completed on a single device. Figure 5 This is a flowchart of copying and pasting within the same device according to an embodiment of the present invention, such as... Figure 5 As shown, the steps for copying and pasting on the same device are as follows:

[0113] Phase 1: Copying operation (on the first electronic device).

[0114] Step S101: Intercept copy requests and content retrieval.

[0115] When a user selects text and performs a "copy" operation in any application on the first electronic device, the clipboard security agent intercepts the operation and obtains the information to be copied and its metadata (such as the source application package name).

[0116] Step S102: Content sensitivity classification and strategy generation.

[0117] The strategy management engine classifies content into sensitivity levels (e.g., first sensitivity level or second sensitivity level) based on predefined rules (such as keyword matching, source application determination, etc.). In embodiments of this invention, the sensitivity classification of information content includes, but is not limited to, first sensitivity level or second sensitivity level. In one embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring encryption, and the second sensitivity level is the lowest sensitivity level, i.e., the level not requiring encryption. In another embodiment, the first sensitivity level is the highest sensitivity level, i.e., the level requiring special encryption or multiple encryption using complex methods, and the second sensitivity level is a general sensitivity level, i.e., encryption using general methods is sufficient.

[0118] Generation Policy: For sensitive (Level 1 Sensitivity) content, automatically generate and bind security policies, for example:

[0119] usage_limit: 1 (limits usage to 1 time);

[0120] TTL: 300000 (survival time 5 minutes);

[0121] allowed_apps: [com.trusted.app] (A whitelist of apps that are allowed to be pasted).

[0122] In this embodiment of the invention, the sensitivity of information content can also be graded according to user needs. In one embodiment, an AI recognition model, such as a keyword recognition model, can be set to grade the sensitivity of information content. The AI ​​recognition model can be obtained through conventional model training methods, and no specific limitations are imposed here.

[0123] Step S103: Content encryption and secure storage.

[0124] For sensitive content (i.e., information corresponding to the first sensitivity level), the encryption / decryption engine encrypts it using the security key of the first electronic device. The encrypted ciphertext, along with the aforementioned security policy, is stored in a secure storage area. Ordinary content (i.e., information corresponding to the second sensitivity level) may remain unencrypted and be temporarily stored in a public area.

[0125] Step S104: Update clipboard metadata.

[0126] The system clipboard is updated with only one instruction signaling, whose handle points to the encrypted content in the secure storage area, rather than the content itself.

[0127] Phase Two: Paste Operation (on the first electronic device).

[0128] Step S201: The target application requests paste.

[0129] A paste request is generated when the user clicks "paste" in the target application on the second electronic device.

[0130] Step S202: Permission verification.

[0131] The clipboard security agent intercepts the request. It reports the application identity of the current requester to the policy management engine.

[0132] Dynamic permission verification: The policy engine performs verification based on the "application identity dynamic permission model".

[0133] If the requested application is an unknown application, access will be denied.

[0134] If the requesting application is a background application and the content is classified as Level 1 Sensitive (does not meet the security policy), access is denied.

[0135] If the requested application is on the allowed_apps whitelist of the security policy, or is a trusted application, then proceed to the next step of the security policy check.

[0136] Step S203: Compliance check of security policy.

[0137] The policy engine checks whether the paste request complies with the security policy set during copying.

[0138] The inspection items include, but are not limited to:

[0139] Usage count: Is the current usage count less than the limit? If not, reject the request and trigger content destruction.

[0140] Validity period: Is the content still within its Time To Live (TTL)? If it has expired, the content will be rejected and destroyed.

[0141] In this embodiment of the invention, the security policy for a piece of information content may include one or more of the above-mentioned usage count, storage duration, and allowed applications. For example, it may allow the information content to be used 3 times within 30 minutes, and then it must be destroyed after 30 minutes or after 3 uses. Alternatively, the security policy may only include one usage count, indicating that the use of the information content is one-time, and it must be deleted and destroyed immediately after being copied and pasted once.

[0142] In this embodiment of the invention, in a cross-device synchronization scenario, the copy operation can be accompanied by a strategy (such as pasting only once on the target device). The system will enforce the strategy and invalidate the data after completion, thereby achieving controllability of sensitive information during the transfer process and breaking through the limitation of existing technologies that only synchronize but do not control.

[0143] Step S204: Content decryption.

[0144] If all checks (including permission verification and security policy checks) pass, the encryption / decryption engine uses the key from the first electronic device to decrypt the ciphertext.

[0145] Explicit anonymization: Before passing plaintext content to the target application, you can partially anonymize the content according to the settings (e.g., display passwords as asterisks) before filling it into the application's input box.

[0146] Interface feedback: In the system interface (such as the clipboard history list), sensitive content is always displayed in an anonymized form. ).

[0147] Step S205: Policy state update.

[0148] After successful pasting, the policy management engine updates the usage status of the content (e.g., decrements the remaining usage count by 1). If the usage count is exhausted or a timeout occurs, the secure storage area is notified to automatically destroy the encrypted content and its policy.

[0149] The clipboard management method provided in this invention constructs a dynamic protection system covering the entire lifecycle of information generation, transmission, use, and destruction through the synergy of technologies such as hierarchical storage, dynamic permissions, cross-device policies, and de-identified display. Through this collaborative work, closed-loop security protection is achieved for sensitive information throughout the entire process of copying, storage, cross-device transmission, application access, and interface display. Without compromising convenience, the clipboard is upgraded from a relatively weak link in system security to a trusted data transfer hub, significantly improving product security and user trust.

[0150] The clipboard management method provided in this invention is applicable to single-device or multi-device work or life scenarios of mobile terminals. Its typical application environment includes a hybrid network architecture consisting of enterprise Wi-Fi, mobile data networks, and the Internet, ensuring secure communication between multiple terminals such as mobile phones, tablets, and computers and the central access control server. The system relies on the application sandbox and encryption interface provided by the underlying operating system. Through encryption at the data transmission and storage layers, it ultimately achieves fine-grained clipboard security classification policy control at the application layer, which can be implemented in single-device operation or multi-device collaboration.

[0151] The clipboard management method provided in this invention provides the following features: For copying scenarios, when a user copies sensitive content (such as passwords or ID numbers), a brief contextual prompt bar may appear at the bottom or corner of the screen, for example, displaying: "Sensitive content copied - Single-use protection enabled," accompanied by a lock icon. This makes it easier to remind the user to pay attention. For pasting scenarios on a second electronic device, when a user attempts to paste content synchronized from the first electronic device that has a limited number of uses: If it is the first time pasting, the operation is executed normally, and there may be a slight prompt (such as "Content has been used and will expire"). If a second attempt to paste is made, the system will explicitly prompt: "This content is for single use only; paste permission has expired."

[0152] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A clipboard management method, characterized in that, Applied to a first electronic device, the method includes: Sensitivity classification should be applied to the information content to be copied; When the sensitivity level is determined to be the first sensitivity level, a security policy is set for the information content. According to the security policy, a cut and paste operation is performed on the information content.

2. The method according to claim 1, characterized in that, The sensitivity classification of the information content to be copied includes at least one of the following: The information content is classified according to predefined rules to assess its sensitivity. The information content is classified according to user needs based on its sensitivity. The information content is classified into sensitivity levels based on a preset AI recognition model.

3. The method according to claim 1, characterized in that, The sensitivity classification of the information content to be copied includes: The sensitivity of the information content to be copied is classified according to the first operation instruction; the operation instruction includes the selection operation of the information content to be copied, or the clipboard preset function trigger operation.

4. The method according to claim 1, characterized in that, The sensitivity classification of the information content to be copied includes: The information content to be copied is classified by sensitivity, and the sensitivity level of the information content is determined to be either a first sensitivity level or a second sensitivity level. When the sensitivity level is determined to be the second sensitivity level, the information content corresponding to the second sensitivity level is stored in a public storage area.

5. The method according to claim 1, characterized in that, Setting a security policy for information content classified as sensitivity level 1 includes at least one of the following: The threshold for the number of times the information content is used; the retention period for the information content; and the whitelist of applications that are allowed to use the information content.

6. The method according to claim 1, characterized in that, Before performing a cut-and-paste operation on the information content according to the security policy, the method further includes: The information content corresponding to the first sensitivity level is encrypted, and the security policy and the ciphertext obtained from the encryption process are stored.

7. The method according to claim 6, characterized in that, After storing the security policy and the ciphertext obtained through encryption, the process also includes: Establish an instruction signaling, which is used to indicate the ciphertext identifier of the ciphertext.

8. The method according to claim 1, characterized in that, The method further includes: Receive a second operation instruction to send the information content from the first electronic device to the second electronic device; The instruction signaling, ciphertext, and security policy corresponding to the information content are sent to the second electronic device through a secure channel.

9. The method according to claim 1, characterized in that, Also includes: When a third operation instruction is received to paste the information content into a target application via the clipboard, the application identity of the target application is verified to determine whether pasting is allowed. Specifically, if the application identity is an unknown application, pasting is rejected; or, if the application identity is a background application and the sensitivity level is the first sensitivity level, pasting is rejected; or, if the application identity is a trusted application and the application meets the security policy, pasting is allowed.

10. The method according to claim 9, characterized in that, After rejecting paste, it also includes: Destroy the ciphertext corresponding to the information content.

11. The method according to claim 9, characterized in that, After allowing pasting, it also includes: Decrypt the ciphertext corresponding to the information content to obtain the information content; The information content is then anonymized and pasted.

12. The method according to claim 9, characterized in that, After allowing pasting, it also includes: The information content with the sensitivity level of first sensitivity is displayed in a de-sensitized form on the system interface.

13. The method according to claim 9, characterized in that, After allowing pasting, it also includes: Update the usage status of the information content; if the usage status does not meet the security policy, destroy the ciphertext corresponding to the information content and the security policy.

14. A network device, characterized in that, The network device includes a receiver, a transmitter, and a processor, and the network device is configured to perform the steps of the method according to any one of claims 1 to 13 via at least one of the receiver, the transmitter, and the processor.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method described in any one of claims 1 to 13.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 13.

17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 13.

Images