A safe printing management method and system in a work secret scene

Abstract

The application provides a safe printing management and control method and system in a work secret scene, relates to the technical field of network security, and comprises the following steps: receiving a printing request initiated by a terminal through a safe printing management and control gateway; performing multi-dimensional parallel authentication based on the printing request; judging whether the multi-dimensional parallel authentication is passed; if yes, establishing an encrypted transmission channel by the safe printing management and control gateway; otherwise, blocking the printing request and generating an alarm log; transmitting the printing data to a target printer through the encrypted transmission channel, and performing behavior detection on the printing data in a sandbox environment during the transmission process; judging whether the behavior detection result is normal; if yes, controlling the printing job execution; otherwise, blocking the transmission process of the printing data to the target printer, and pushing alarm information to the administrator.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a secure printing control method and system for work-related confidentiality scenarios. Background Technology

[0002] Secure printing in confidential work scenarios focuses on protecting confidential information, specifically for organizations with extremely high information confidentiality requirements, such as government agencies, military units, research institutions, and core financial departments. Its core application scenarios cover the entire process of printing confidential internal documents, including access control, device authentication, traffic protection, and behavior tracing, aiming to provide an end-to-end security solution for printing confidential documents.

[0003] Currently, technological development in this field mainly revolves around several directions. Terminal-level print management technology authenticates print requests and filters documents by installing client software on office terminals. Printer-side access control technology manages device access and usage by configuring printer access permissions and task verification mechanisms. Furthermore, network-layer basic filtering technology controls access to printing protocol ports by configuring network device rules. These technologies collectively form the foundation of print security management in office environments, providing organizations with multi-layered technical options for information protection.

[0004] However, with the increasing complexity of office models and the continuous evolution of network threats, the existing technology system still has room for continuous optimization and deep integration in dealing with new scenarios such as cross-network segment printing and mobile terminal printing, as well as ensuring the security of printing data transmission and realizing full-process behavior traceability. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide a secure printing control method in work confidentiality scenarios, which can solve the technical problems of insufficient security in dealing with new scenarios such as cross-network segment printing and mobile terminal printing, as well as insufficient protection of printing data transmission security and full-process behavior traceability.

[0006] A first aspect of this invention provides a secure printing control method for scenarios involving work secrets, comprising: S1: Receive print requests initiated by terminals through the secure print management gateway; S2: Perform multi-dimensional parallel authentication based on print requests; S3: Determine whether all multi-dimensional parallel authentications have passed; if so, establish an encrypted transmission channel by the secure print management gateway; otherwise, block the print request and generate an alarm log. S4: Transmit print data to the target printer through an encrypted transmission channel, and perform behavior detection on the print data in a sandbox environment during the transmission process; S5: Determine if the behavior detection result is normal; if so, control the execution of the print job; otherwise, block the transmission of print data to the target printer and push an alarm message to the administrator.

[0007] A second aspect of this invention provides a secure printing control system for work secret scenarios, comprising: a processor and a memory; The memory stores programs or instructions that can run on the processor, which, when executed by the processor, implement the steps of the secure printing control method in a confidential work scenario as described in the first aspect.

[0008] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: In this embodiment of the invention, to address the optimization needs of cross-network segment and mobile terminal printing scenarios, data transmission security, and end-to-end traceability, a secure printing management gateway is used to centrally receive printing requests, perform multi-dimensional parallel authentication, and adapt to various office modes. An encrypted transmission channel is established to forward printing data, ensuring transmission security. Abnormal behavior detection in a sandbox environment, combined with alarm logs and end-to-end recording, enables traceability of printing behavior. This approach simultaneously balances security management and office efficiency, accurately addressing the optimization limitations of existing technologies. Attached Figure Description

[0009] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0010] Figure 1 This is a flowchart illustrating a secure printing control method for a work secret scenario provided by an embodiment of the present invention.

[0011] Figure 2 This is a schematic diagram of a product structure provided in an embodiment of the present invention.

[0012] Figure 3 This is a schematic diagram of a secure printing control system for a confidential work scenario provided by an embodiment of the present invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0014] The secure printing control method for work secret scenarios provided by the embodiments of the present invention will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0015] Reference manual attached Figure 1 The diagram illustrates a flowchart of a secure printing control method for a confidential work scenario provided by an embodiment of the present invention.

[0016] This invention provides a secure printing control method for scenarios involving work secrets, which may include the following steps: S1: Receives print requests initiated by terminals through the secure print management gateway.

[0017] Among them, the secure print management gateway is a centralized print traffic management device that integrates core modules such as vertical / horizontal traffic proxy, sandbox detection, and encrypted transmission, providing security support for the entire printing process. The terminal refers to devices such as office PCs, laptops, and mobile terminals that initiate print operations.

[0018] Specifically, the hardware configuration of the secure printing control gateway can be a device with the model number SecPrint-GW-001, equipped with a quad-core processor, 8GB of memory, 2TB of SSD storage, and support for dual WAN / LAN network cards (speed 1000Mbps). Its deployment method is to connect it in series between the LAN core switch and the external network exit, and all printing traffic must be forwarded through this gateway.

[0019] S2: Perform multi-dimensional parallel authentication based on print requests.

[0020] Among them, multi-dimensional parallel authentication refers to simultaneously verifying user identity, terminal compliance, printing permissions, and other dimensions. The verification of each dimension is carried out synchronously and without interference. The print request includes core content such as user information, terminal information, document information, and target printer information.

[0021] Optionally, multi-dimensional parallel authentication includes user identity authentication, terminal compliance authentication, and document printing permission authentication.

[0022] Among them, user identity authentication refers to the mechanism for verifying the legitimacy of the printer initiator's identity, terminal compliance authentication refers to the process for verifying whether the device initiating the printing complies with the preset security specifications, and document printing permission authentication refers to the verification method for checking whether the user has the qualification to print the corresponding document.

[0023] Optionally, the user authentication process specifically includes: Receive authentication information submitted by users.

[0024] Among them, authentication information refers to the data used by users for identity verification, including account passwords, USB key information, biometric features, etc.

[0025] For example, the authentication information submitted by the user may include the account name zhangsan, password XXXX, USB key number SN123456, or fingerprint biometric data.

[0026] The authentication information is compared and verified through the identity authentication platform.

[0027] Among them, the identity authentication platform refers to a dedicated platform used to store and compare user identity data, which can be connected to the organization's unified identity authentication platform.

[0028] The system checks if the authentication information matches the verification result. If yes, the user's authentication is successful. Otherwise, the user's authentication has failed.

[0029] Optionally, the terminal compliance certification process is as follows: Based on the device information of the terminal initiating the printing, it is determined whether the terminal is on a preset terminal whitelist and whether a secure client has been installed. If both are true, the terminal's compliance authentication is deemed successful. Otherwise, the terminal's compliance authentication is deemed unsuccessful.

[0030] Among them, device information refers to the unique identification data of the terminal, including IP address, MAC address, etc., terminal whitelist refers to the pre-entered list of compliant office terminals, and security client refers to the dedicated software installed on the terminal to meet security control requirements.

[0031] For example, the terminal device information that initiates printing may include IP address 192.168.1.50 and MAC address 00:2C:3D:4E:5F:6A. If the device information is pre-entered in the terminal whitelist and the terminal has a dedicated security client installed, then the terminal is deemed to have passed compliance authentication.

[0032] Optionally, the document printing permission authentication process specifically includes: Get the document security level and the user role that initiated the print request.

[0033] Among them, document security level refers to the level of classification based on the confidentiality of the document, and user role refers to the permission classification set according to the user's job responsibilities.

[0034] For example, the document corresponding to the print request is classified as confidential, and the user who initiated the print request is a core R&D personnel.

[0035] Based on the preset permission policy, determine the range of document security levels that user roles are allowed to print.

[0036] The permission policy refers to the pre-defined rules for matching user roles with printing permissions.

[0037] The system determines whether the document's security classification is within the acceptable range and whether the number of copies to be printed meets the preset limits. If both are true, the document's print permission authentication is successful. Otherwise, the document's print permission authentication is unsuccessful.

[0038] Among them, the preset limit refers to the compliance threshold set for the number of printed copies.

[0039] It should be noted that those skilled in the art can set the size of the compliance threshold according to actual needs, and this invention does not limit it.

[0040] For example, the default limit is a maximum of 5 copies of a confidential document can be printed at a time. If a user initiates a printout of 3 copies, which does not exceed this compliance threshold, then the printout compliance requirement is met.

[0041] It should be noted that the core requirement of multi-dimensional parallel authentication is that all dimensions must pass the verification before proceeding to the next step. If any verification fails, the printing request will be terminated directly without waiting for the verification results of other dimensions.

[0042] Optionally, after S2 and before S3, the following are also included: Perform compliance verification on the target printer.

[0043] The process of verifying the compliance of the target printer specifically includes: Based on the print request, obtain the target printer identifier.

[0044] Based on the target printer's identifier, determine whether the target printer is within the preset printer whitelist. If so, the target printer's compliance verification is considered successful. Otherwise, the target printer's compliance verification is considered unsuccessful.

[0045] Among them, the compliance verification of the target printer refers to the process of verifying whether the printer receiving the print job is legal and compliant. The target printer identifier refers to the unique characteristic information of the printer, including MAC address, IP address, device model, etc. The printer whitelist refers to the list of compliant printers that have been pre-approved and entered.

[0046] For example, if the target printer is identified by MAC address 00:1A:2B:3C:4D:5E, IP address 192.168.1.100, and device model HP M455dn, and this printer information has been entered into the printer whitelist, then the compliance verification of the target printer is deemed to have passed.

[0047] In this embodiment of the invention, a multi-dimensional parallel and synchronous verification mechanism involving user, terminal, and document permissions is used to achieve comprehensive and instantaneous verification of the initiator of the printing behavior, the tool, and the object. This design not only significantly improves authentication efficiency and reduces request latency, but also ensures the integrity of the security chain through a veto logic, eliminating any single-dimensional security weakness.

[0048] S3: Determine if all multi-dimensional parallel authentications have passed. If so, the secure print management gateway establishes an encrypted transmission channel. Otherwise, block print requests and generate an alarm log.

[0049] Among them, the encrypted transmission channel refers to a secure data transmission link built with the TLS encryption protocol, which can prevent data from being eavesdropped on or tampered with. The alarm log is encrypted storage data that records unauthenticated request information, reasons for blocking, etc., and is used for compliance auditing and tracing.

[0050] Specifically, the encrypted transmission channel uses the TLS 1.3 encryption protocol and is configured with the AES-256-GCM encryption algorithm. A server certificate issued by the enterprise's CA must be imported to ensure encryption effectiveness. The alarm log must record information including the source IP of the unauthenticated request, the terminal MAC address, the blocking time, and the triggered verification rules.

[0051] In this embodiment of the invention, authentication results are forcibly associated with secure transmission and audit traceability. Successful authentication establishes a high-strength encrypted channel, ensuring that data flow originates in a trusted and confidential environment. Authentication failure immediately blocks the flow and generates a structured alarm log, enabling immediate response to threats and providing a precise and tamper-proof starting point for subsequent traceability.

[0052] S4: Transmit print data to the target printer via an encrypted transmission channel, and perform behavior detection on the print data in a sandbox environment during the transmission process.

[0053] Among them, the sandbox environment is an isolated virtual space that simulates the operating environment of the target printer, which can avoid the detection process from affecting the actual system. Abnormal behavior detection refers to the detection mechanism that identifies illegal operations such as malicious code injection and data theft through static feature matching and dynamic behavior analysis.

[0054] Furthermore, the sandbox environment needs to simulate the core operating logic of the target printer, such as protocol parsing and data caching. Abnormal behavior detection covers two core aspects: static feature detection and dynamic behavior simulation. During the detection process, the built-in abnormal print traffic feature library needs to be called. This feature library supports online updates and is updated once a day.

[0055] In one possible implementation, S4 specifically includes sub-steps S401 to S407: S401: Receives the print traffic after it has been decrypted through the encrypted transmission channel.

[0056] Print traffic refers to the various data packets transmitted during the printing process.

[0057] For example, print traffic may include document data packets and print parameter configuration packets transmitted based on the IPP protocol (port 631 / TCP) or the RAW protocol (port 9100 / TCP).

[0058] Reference manual attached Figure 2 The diagram shows a product structure provided by an embodiment of the present invention.

[0059] Specifically, Figure 2 The core component is the secure print management gateway (model: SecPrint-GW-001), which includes a quad-core processor, 8GB of RAM, 2TB of SSD storage, supports dual WAN / LAN network cards (speed 1000Mbps), and integrates core modules such as vertical traffic proxy, horizontal traffic proxy, sandbox detection, and encrypted transmission. Auxiliary components include compliant printers (supporting IPP, RAW, and SMB protocols, such as HP M455dn and Canon iR-ADV C5535i), office terminals (PCs, laptops, and mobile terminals), a unified identity authentication server (supporting LDAP / SAML 2.0 protocols), and a log storage server.

[0060] Furthermore, in terms of inclusion relationships, Figure 2 The overall architecture features a core gateway and auxiliary devices. The secure print management gateway serves as the system's central hub, with all auxiliary devices functioning collaboratively around it. In terms of connectivity, the secure print management gateway is connected in series between the LAN core switch and the external network exit; all print traffic must be forwarded through the gateway. The unified identity authentication server and log storage server communicate with the gateway via the LAN to synchronize identity data and log information. Office terminals and compliant printers connect to the LAN, initiating print requests to the gateway and receiving compliant print data forwarded by the gateway, respectively.

[0061] It should be noted that, Figure 2The system hardware composition and connection logic are clearly presented, providing architectural support for subsequent software configuration (such as gateway basic parameter settings and whitelist entry) and the entire printing process (such as user authentication and traffic detection), ensuring that the hardware foundation for print control in confidential work scenarios is feasible and reproducible.

[0062] S402: Parse the printing protocol type corresponding to the printing traffic in order to extract the traffic content in the printing traffic.

[0063] Among them, traffic content refers to the core data extracted from print traffic, including document data, transmission instructions, etc.

[0064] Specifically, the mainstream printing protocols that can be parsed include IPP, RAW / JetDirect / AppSocket, LPD, SMB, and AirPrint. The extracted transmission instructions can include instructions such as setting the number of copies to print, selecting duplex printing, and adding watermarks.

[0065] S403: Perform static feature detection on the traffic content to obtain static detection results.

[0066] Static feature detection refers to the method of detecting the inherent attributes of traffic content, and static detection results refer to the various sets of verification data formed after static feature detection.

[0067] In one possible implementation, S403 specifically includes sub-steps S4031 to S4035: S4031: Extract document data from the traffic content and calculate the document hash value of the document data.

[0068] Among them, document data refers to document-related data contained in the traffic content, and document hash value refers to a unique identifier value calculated from the document data using a hash algorithm.

[0069] S4032: Match the document hash value with the sensitive document hash values ​​in the preset sensitive document hash database to obtain the document hash value matching result.

[0070] Among them, the sensitive document hash library refers to a database that stores the hash values ​​of sensitive or malicious documents.

[0071] S4033: Based on a preset sensitive word database, perform full-text search on document data to obtain sensitive keyword search results.

[0072] The sensitive word database refers to a pre-defined database containing keywords containing sensitive information, and custom additions are supported.

[0073] For example, if the preset sensitive word library contains keywords such as top-secret, unpublished technical parameters and core formulas, and a full-text search of the document data reveals keywords related to unpublished technical parameters, then the sensitive keyword search result will show that sensitive keywords exist.

[0074] S4034: Verify the file attributes of the document data and obtain the file attribute verification result.

[0075] Among them, file attributes refer to the basic characteristics of a document, including size, format, number of pages, etc., while preset rules refer to the compliance standards set for file attributes.

[0076] For example, the default rules are that the document size should not exceed 100MB, the file format should be an office format such as .docx / .pdf / .xlsx, and the number of pages should not exceed 500. If the document size is 80MB, the format is .pdf, and the number of pages is 120, then the file attribute verification result is that it conforms to the default rules. If the document format is .exe, then the verification result is that it does not conform to the default rules.

[0077] S4035: Combine the document hash value matching results, sensitive keyword retrieval results, and file attribute verification results to determine the static detection results.

[0078] Specifically, the static detection results must clearly record the results of the three sub-detections. If any one of the sub-detection results is abnormal (such as a successful hash value match, the presence of sensitive keywords, or file attributes not conforming to preset rules), the entire static detection result is judged as abnormal. The static detection result is only judged as normal if all three sub-detection results are normal.

[0079] S404: Filter the static detection results to obtain compliant traffic samples.

[0080] Among them, compliant traffic samples refer to a subset of traffic that meets security standards after static testing.

[0081] It should be noted that traffic content can only be selected as a compliant traffic sample if the static detection result is normal. If the static detection result is abnormal, the traffic content will not be selected as a traffic sample and will trigger the subsequent abnormal handling process.

[0082] S405: Input traffic samples into the virtual sandbox environment.

[0083] The virtual sandbox environment refers to an isolated virtual space that simulates the operating environment of a printer.

[0084] Specifically, the virtual sandbox environment must be isolated from the actual office network and printer system, allowing traffic samples to perform data processing simulations only within this environment, and prohibiting traffic samples from accessing any system resources outside the sandbox environment.

[0085] S406: In a virtual sandbox environment, perform dynamic behavior simulation on traffic samples to obtain dynamic behavior data.

[0086] Among them, dynamic behavior simulation refers to replicating the entire process of printing data processing in an isolated environment, and dynamic behavior data refers to the behavior monitoring data collected during the dynamic behavior simulation process.

[0087] In one possible implementation, S406 specifically includes sub-steps S4061 to S4064: S4061: Perform data theft monitoring on traffic samples to obtain resource access monitoring results.

[0088] Among them, the resource access monitoring results refer to the monitoring records of traffic samples accessing external resources and transmitting data.

[0089] For example, if a traffic sample is detected attempting to read system registry information outside the sandbox environment, or transmitting data to the unauthorized address 203.0.113.250, the resource access monitoring result indicates abnormal access behavior.

[0090] S4062: Perform malicious code behavior monitoring on traffic samples and obtain code behavior monitoring results.

[0091] Among them, malicious code behavior refers to code execution operations that may endanger system security, including code injection, process tampering, etc.; code behavior monitoring results refer to the monitoring records of malicious code execution behavior; and illegal instructions refer to operation instructions that exceed the normal printing function of the printer.

[0092] For example, if a traffic sample is detected to trigger code injection behavior, attempting to tamper with the simulated printing process in the sandbox environment, the code behavior monitoring result is that malicious code execution behavior has been triggered.

[0093] S4063: Execute abnormal command call monitoring on traffic samples and obtain command call monitoring results.

[0094] Among them, the instruction call monitoring results refer to the monitoring records of illegal instructions.

[0095] For example, if the detected traffic sample contains instructions that exceed normal printing functions, such as modifying printer IP configuration or deleting printer cache data, then the instruction monitoring result is that it contains illegal instructions.

[0096] S4064: Combine resource access monitoring results, code behavior monitoring results, and instruction call monitoring results to obtain dynamic behavior data.

[0097] Specifically, dynamic behavior data needs to be recorded in a structured format, including a description of the specific behavior of the three sub-monitoring items, the trigger time, and the resources or instructions involved. For example, on 2024-06-10 14:30:25, a traffic sample attempted to transmit data to the unauthorized address 203.0.113.250, indicating abnormal resource access monitoring. No malicious code execution was detected. No illegal instructions were included.

[0098] S407: Combines static detection results, dynamic behavior data, and a preset database of abnormal print traffic characteristics to perform behavior detection on print traffic.

[0099] Among them, the Printing Flow Anomaly Feature Library refers to a database that stores the characteristics of various abnormal printing behaviors.

[0100] In this embodiment of the invention, this step introduces a deep content inspection mechanism within the encrypted channel. Through a dual analysis combining static features and dynamic sandbox simulation, it can effectively identify content-based threats (such as hidden malicious code and abnormal instructions) that traditional encrypted transmission cannot prevent, achieving a balance between transmission security and content security, and greatly enhancing the defense capabilities against advanced persistent threats.

[0101] S5: Determine if the behavior detection result is normal. If yes, control the execution of the print job. Otherwise, block the transmission of print data to the target printer and send an alarm message to the administrator.

[0102] Among them, print job execution refers to the operation of the target printer to complete the document output according to preset parameters after receiving compliant print data, and administrator push alarm refers to the notification mechanism that provides real-time feedback on abnormal situations to management personnel through email, operation and maintenance platform, SMS and other means.

[0103] It should be noted that those skilled in the art can set the size of the preset parameters according to actual needs, and this invention does not limit this.

[0104] For example, if the abnormal behavior detection result is no abnormality, the target printer will complete the document output according to the preset parameters (3 copies, duplex printing, black and white output). If the detection result is abnormal, the printing data transmission will be blocked immediately, and an alarm message will be pushed to the administrator via the administrator's email address admin@xxx.com, the operation and maintenance platform, and SMS. The alarm content includes: "2024-06-10 15:10:30, abnormal printing traffic initiated by the terminal with IP address 192.168.1.60, abnormality matching degree 85%, transmission has been blocked."

[0105] In this embodiment of the invention, this step completes the final decision-making and feedback loop for security control. Based on the comprehensive analysis results of all the aforementioned steps, the system precisely allows or blocks printing jobs in real time, completely cutting off the risk output path. Simultaneously, through multi-channel real-time alarms, it ensures that security management personnel can perceive and handle anomalies immediately, achieving proactive and timely security protection.

[0106] Reference manual attached Figure 3 The diagram shows a structural schematic of a secure printing control system for a confidential work scenario provided by an embodiment of the present invention.

[0107] This invention provides a secure printing control system 20 for work confidentiality scenarios, including: a processor 201 and a memory 202; The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the above-mentioned secure printing control method in the context of confidential work and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0108] It should be understood that the processor 201 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0109] It should also be understood that the memory 202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM).

[0110] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0111] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0112] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0113] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0114] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0115] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0116] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0117] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0118] This invention provides a readable storage medium comprising: storing a program or instructions on the readable storage medium, wherein when the program or instructions are executed by a processor, the program or instructions implement the steps of the above-described secure printing control method in a confidential work scenario, and achieve the same technical effect. To avoid repetition, this invention will not elaborate further.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A secure printing management method in a work secret scene, characterized in that, include: S1: Receive print requests initiated by terminals through the secure print management gateway; S2: Based on the print request, perform multi-dimensional parallel authentication; S3: Determine whether all the multi-dimensional parallel authentications have passed; if so, the secure printing control gateway shall establish an encrypted transmission channel. Otherwise, block the print request and generate an alarm log; S4: Transmit print data to the target printer through the encrypted transmission channel, and perform behavior detection on the print data in a sandbox environment during the transmission process; S5: Determine whether the behavior detection result is normal; if so, control the execution of the print job; otherwise, block the transmission of the print data to the target printer and push an alarm message to the administrator.

2. The method according to claim 1, wherein, The multi-dimensional parallel authentication includes user identity authentication, terminal compliance authentication, and document printing permission authentication.

3. The method according to claim 2, wherein, The user authentication process specifically includes: Receive authentication information submitted by users; The authentication information is compared and verified through an identity authentication platform; Determine whether the verification results are consistent; if yes, the user's identity authentication is deemed successful; otherwise, the user's identity authentication is deemed unsuccessful.

4. The secure printing control method for work-secret scenarios according to claim 2, characterized in that, The terminal compliance authentication process is as follows: Based on the device information of the terminal initiating the printing, it is determined whether the terminal is in a preset terminal whitelist and whether a security client has been installed; if both are true, the terminal's compliance authentication is deemed successful; otherwise, the terminal's compliance authentication is deemed unsuccessful.

5. The method according to claim 2, wherein, The document printing permission authentication process specifically includes: Obtain the document security level and the user role that initiated the printing request; Based on the preset permission policy, determine the range of document security levels that the user role is allowed to print; Determine whether the document security level corresponding to the print request is within the document security level range and whether the number of copies to be printed meets the preset limit; if both are true, then the document's print permission authentication is deemed successful; otherwise, the document's print permission authentication is deemed unsuccessful.

6. The method according to claim 1, wherein, The process includes the following steps after S2 and before S3: Perform compliance verification on the target printer; The process of performing compliance verification on the target printer specifically includes: Based on the print request, obtain the target printer identifier; Based on the target printer identifier, determine whether the target printer is within a preset printer whitelist; if so, the compliance verification of the target printer is deemed to have passed; otherwise, the compliance verification of the target printer is deemed to have failed.

7. The method according to claim 1, wherein, S4 specifically includes: S401: Receive the print traffic after it has been decrypted through the encrypted transmission channel; S402: Parse the printing protocol type corresponding to the printing traffic to extract the traffic content in the printing traffic; S403: Perform static feature detection on the traffic content to obtain static detection results; S404: Filter the static detection results to obtain compliant traffic samples; S405: Input the traffic sample into the virtual sandbox environment; S406: In the virtual sandbox environment, perform dynamic behavior simulation on the traffic sample to obtain dynamic behavior data; S407: Combine the static detection results, the dynamic behavior data, and the preset print traffic anomaly feature library to perform behavior detection on the print traffic.

8. The secure printing management method in a work secret scenario according to claim 7, characterized in that, Specifically, S403 includes: S4031: Extract document data from the traffic content and calculate the document hash value of the document data; S4032: Match the document hash value with the sensitive document hash values ​​in the preset sensitive document hash database to obtain the document hash value matching result; S4033: Based on a preset sensitive word database, perform a full-text search on the document data to obtain sensitive keyword search results; S4034: Verify the file attributes of the document data to obtain the file attribute verification result; S4035: Combine the document hash value matching result, the sensitive keyword retrieval result, and the file attribute verification result to determine the static detection result.

9. The method according to claim 7, wherein, Specifically, S406 includes: S4061: Perform data theft behavior monitoring on the traffic sample to obtain resource access monitoring results; S4062: Perform malicious code behavior monitoring on the traffic sample to obtain the code behavior monitoring results; S4063: Perform abnormal command call monitoring on the traffic sample and obtain the command call monitoring results; S4064: The dynamic behavior data is obtained by combining the resource access monitoring results, the code behavior monitoring results, and the instruction call monitoring results.

10. A secure printing control system for work-related confidentiality scenarios, characterized in that, include: Processor and memory; The memory stores programs or instructions that can run on the processor, and when the programs or instructions are executed by the processor, they implement the steps of the secure printing control method for a confidential work scenario as described in any one of claims 1 to 9.

Images