File access management method and device, equipment, medium and program product

Abstract

The embodiments of the present specification disclose a file access control method and device, equipment, medium and program product, which can improve the security of file access. Wherein, the method is applied to a first terminal running a security detection agent, comprising: in response to an access operation on a target file, intercepting a first access request triggered by the access operation through the security detection agent; the target file is injected with security mark information before being transmitted to the first terminal; extracting the security mark information from the target file according to the first access request through the security detection agent; performing pre-access detection on the target file according to the security mark information through the security detection agent; the pre-access detection includes mark integrity detection and access consistency detection; in the case that the pre-access detection fails, blocking the first access request through the security detection agent.

Description

Technical Field

[0001] This specification relates to the field of data security technology, and in particular to a file access control method, apparatus, device, medium, and program product. Background Technology

[0002] In digital office scenarios, business systems typically integrate file access functions such as file preview and file download, allowing users to access files containing internal work data. To ensure data security, related technologies usually implement approval processes for accessing designated files (such as files containing sensitive information), meaning users must obtain the appropriate authorization before accessing the specified files.

[0003] However, the aforementioned approval process still leaves the circulation and use of designated files in a relatively open state. For example, once a designated file is downloaded and stored on a user's terminal, it may be secondary distributed to other users via email, instant messaging software, or other network transmission methods. Other users who receive the designated file can directly access it without going through the approval process, resulting in unauthorized access and compromising data security. Therefore, there is an urgent need to provide a file access control method to improve the security of file access. Summary of the Invention

[0004] This specification provides a file access control method, apparatus, device, medium, and program product that can improve the security of file access.

[0005] Firstly, this specification provides a file access control method, applied to a first terminal, the first terminal running a security detection agent, the method comprising: In response to an access operation targeting a target file, the first access request triggered by the access operation is intercepted by a security detection proxy; the target file is injected with security tag information before being transmitted to the first terminal; The security detection agent extracts security tag information from the target file based on the first access request; The security detection agent performs pre-access checks on the target file based on security label information; the pre-access checks include label integrity checks and access consistency checks. If the pre-access check fails, the first access request is blocked through the security check proxy.

[0006] In one possible implementation, the security detection agent includes a user-mode module and / or a kernel-mode module; intercepting the first access request triggered by the access operation through the security detection agent includes: hooking function calls of an application running in the first terminal through the user-mode module to intercept the first access request when the application initiates a first access request to the operating system of the first terminal; and / or intercepting the first access request before the first access request triggered by the access operation reaches the file system of the first terminal through the kernel-mode module.

[0007] In one possible implementation, a security detection agent extracts security tag information from the target file based on a first access request, including: determining a temporary path of the target file based on the first access request; reading the metadata of the target file based on the temporary path; and extracting security tag information from the metadata.

[0008] In one possible implementation, the security labeling information includes a signature information field and an access information field. The security detection agent performs pre-access checks on the target file based on the security labeling information, including: performing a labeling integrity check on the target file based on the signature information field; and if the labeling integrity check passes, performing an access consistency check on the target file based on the access information field.

[0009] In one possible implementation, the signature information class field includes a signature algorithm identifier field and a signature result field. The security detection agent performs a mark integrity check on the target file based on the signature information class field, including: performing the following steps through the security detection agent: determining the target signature algorithm based on the signature algorithm identifier field; performing a signature calculation on the string composed of multiple fields in the security mark information based on the target signature algorithm to obtain the current signature result; comparing the current signature result with the original signature result in the signature result field; if they are consistent, the mark integrity check is deemed to have passed; otherwise, the mark integrity check is deemed to have failed.

[0010] In one possible implementation, the access information class field includes an accessible user identity field; the security detection agent performs access consistency detection on the target file based on the access information class field, including: the security detection agent performs the following steps: determining whether the accessible user identity field contains the first user identity information of the first terminal; if yes, the access consistency detection is deemed to have passed; if no, the access consistency detection is deemed to have failed.

[0011] In one possible implementation, the security detection agent includes a user-mode module and / or a kernel-mode module; blocking the first access request through the security detection agent includes: preventing the application from sending the first access request to the operating system of the first terminal through the user-mode module and returning an access denied response to the application; and / or discarding the first access request before it reaches the file system of the first terminal through the kernel-mode module and returning an access denied response to the application that initiated the first access request.

[0012] In one possible implementation, after blocking the first access request through a security detection proxy, the method further includes: displaying a prompt message; the prompt message indicates that the target file cannot be accessed and guides the user to initiate a file approval process; sending risk information of the first access request to the server; the risk information includes the file owner information of the target file, the identification information of the first terminal, and the first user identity information of the first terminal.

[0013] In one possible implementation, after displaying the prompt message, the method further includes: in response to a file approval operation for the target file, sending a file approval request for the target file to the server, the file approval request including first user identity information, so that the server: in response to the file approval request, determines whether the first user of the first terminal has the right to access the target file based on the first user identity information, and if the first user has the right to access the target file, sends approval approval information to the first terminal; in response to the approval approval information sent by the server, modifies the security tag information based on the first user identity information through a security detection proxy, and allows the first access request.

[0014] Secondly, this specification provides a file access control method applied to a server, wherein the server runs a file access gateway, and the method includes: Receive a second access request for a target file sent by a second terminal; the second access request includes the second user identity information of the second terminal; In response to the second access request, determine whether the second user of the second terminal has the right to access the target file based on the second user's identity information; When a second user has access to the target file, security tag information is injected into the target file's metadata through the file access gateway; Send the target file, which has been injected with security tag information, to the second terminal.

[0015] Thirdly, embodiments of this specification provide a file access control system, including: a first terminal, a second terminal, and a server. The first terminal runs a security detection agent, and the server runs a file access gateway. The second terminal is used to send a second access request for the target file to the server in response to an access operation for the target file; the second access request includes the second user identity information of the second terminal. The server is used to receive the second access request, respond to the second access request, determine whether the second user of the second terminal has the right to access the target file based on the second user's identity information; if the second user has the right to access the target file, inject security tag information into the metadata of the target file through the file access gateway; and send the target file to the second terminal. The second terminal is also used to receive the target file and send the target file to the first terminal; The first terminal is used to respond to an access operation targeting a target file by intercepting the first access request triggered by the access operation through a security detection proxy; extracting security tag information from the target file according to the first access request through the security detection proxy; performing pre-access detection on the target file according to the security tag information through the security detection proxy; the pre-access detection includes tag integrity detection and access consistency detection; and blocking the first access request through the security detection proxy if the pre-access detection fails.

[0016] Fourthly, embodiments of this specification provide a file access control device applied to a first terminal, the first terminal running a security detection agent, the device comprising: The operation response module is used to respond to access operations targeting the target file, and to intercept the first access request triggered by the access operation through a security detection proxy; the target file is injected with security tag information before being transmitted to the first terminal; The information extraction module is used to extract security tag information from the target file based on the first access request through the security detection agent; The access detection module is used to perform pre-access detection on target files based on security label information through a security detection agent; the pre-access detection includes label integrity detection and access consistency detection. The request blocking module is used to block the first access request through a security detection proxy if the access fails the pre-access detection.

[0017] Fifthly, embodiments of this specification provide a file access control device applied to a server, the server running a file access gateway, the device comprising: The request receiving module is used to receive a second access request for a target file sent by the second terminal; the second access request includes the second user identity information of the second terminal; The request and response module is used to respond to the second access request and determine whether the second user of the second terminal has the right to access the target file based on the second user's identity information. The information injection module is used to inject security tag information into the metadata of the target file through the file access gateway when a second user has the right to access the target file. The file sending module is used to send target files with injected security tag information to the second terminal.

[0018] Sixthly, embodiments of this specification provide an electronic device, including: a processor and a memory; the memory stores a computer program, and the processor executes the computer program to implement the method steps provided in the first or second aspect of the embodiments of this specification.

[0019] In a seventh aspect, embodiments of this specification provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the method steps provided in the first or second aspect of embodiments of this specification.

[0020] Eighthly, embodiments of this specification provide a computer program product, including a computer program; when the computer program is executed by a processor, it implements the method steps provided in the first or second aspect of embodiments of this specification.

[0021] The aforementioned file access control methods, devices, electronic equipment, computer storage media, and computer program products, in the access authentication phase, ensure that users can only access the target file on the server after their approval by conducting pre-approval of file access requests, thus controlling the compliant distribution of target files from the source. In the file issuance phase, security tag information is injected into the metadata of the target file through the file access gateway, making the target file traceable and controllable even after it leaves the server. In the security detection phase, in response to access operations targeting the target file, the security detection agent deployed on the terminal intercepts access requests targeting the target file and performs tag integrity detection and access consistency detection based on the security tag information of the target file, enabling the identification of whether the target file has been tampered with and whether the current user is an authorized user before the content of the target file is accessed. In the access control phase, the security detection agent blocks access requests when the detection fails, ensuring that even if the target file is transmitted to the terminal, unauthorized users cannot access the file content.

[0022] The entire file access control process involves two aspects. First, by performing pre-access authentication on the server side and writing security tag information into the metadata of the target file before it is distributed, the target file carries security verification information bound to the authorized user when it leaves the server, providing a prerequisite for the terminal side to identify and block unauthorized access. Second, through a security detection proxy deployed on the terminal side, access requests for the target file are intercepted after a user initiates an access operation. Based on the security tag information of the target file, tag integrity checks and access identity consistency checks are performed. If the checks fail, the access is blocked. This ensures that the target file can still be effectively identified and controlled after it is stored locally on the terminal, avoiding the risk of data leakage during the cross-terminal transfer of the target file and improving the security of file access. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A schematic diagram of the architecture of a file access control method provided for an exemplary embodiment of this specification; Figure 2 A schematic diagram illustrating the application environment of a file access control method provided as an exemplary embodiment of this specification; Figure 3 A flowchart illustrating a file access control method provided as an exemplary embodiment of this specification; Figure 4 A flowchart illustrating another file access control method provided as an exemplary embodiment of this specification; Figure 5 A schematic diagram of a file access control device provided for an exemplary embodiment of this specification; Figure 6 A schematic diagram of another file access control device provided as an exemplary embodiment of this specification; Figure 7 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this specification; Figure 8 This is a schematic diagram of the structure of another electronic device provided as an exemplary embodiment of this specification. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this specification clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this specification.

[0026] In the description of this specification, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of these terms in this specification based on the specific circumstances. Furthermore, in the description of this specification, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0027] First, let's introduce one application scenario for which the embodiments of this manual are applicable: A company's deployed business system integrates file preview, file download, and other file access functions. To ensure data security, users must obtain authorization through an approval process before accessing designated files (i.e., target files) containing sensitive information from this business system. To prevent the target file from being disseminated beyond its scope and accessed without authorization, a file access gateway is deployed in the cloud to centralize the access chain for target files. After approval and before the file is transferred to the requesting user's terminal, the file access gateway injects security tag information, including signature and access information fields, into the target file's metadata. When the original user further disseminates and shares the target file via email or instant messaging software, the security detection agent on the receiving terminal parses the security tag information in the target file during the access request phase using user-space and / or kernel-space modules. Based on the security tag information, it performs tag integrity and access consistency checks on the target file. Access requests that fail the tag integrity or access consistency checks are blocked, thereby achieving file access control.

[0028] Please see Figure 1 The file access control process provided in the embodiments of this specification can be divided into: access authentication stage, file issuance stage, security detection stage, and access control stage. The specific implementation process of each stage is as follows: During the access authentication phase, the second user accesses the business system through a second terminal, initiating a second access request for the target file. Upon receiving this second access request, the business system pushes the target file to the file access gateway and triggers the approval system for process review. The approval system determines whether the second user has the right to access the target file based on their identity information. If the approval is successful, the document issuance phase begins; if the approval fails, the second access request is rejected.

[0029] During the file issuance phase, the file access gateway acquires the target file and injects security tag information into its metadata. This security tag information includes signature information fields and access information fields. The access information fields identify the file access context and include fields such as the accessible user's identity, access source, and access time. The signature information fields digitally sign each field in the security tag information to promptly identify any tampering or corruption. These fields include a signature algorithm identifier and a signature result field. After injecting the security tag information, the file access gateway sends the injected target file to the second terminal, allowing the second terminal to download and store it locally. The second user then forwards the target file to the first user's first terminal via email or instant messaging software.

[0030] During the security detection phase, the first terminal receives the target file sent by the second terminal and caches it in the application's temporary file directory (such as a browser cache, email client temporary storage, or instant messaging software receiving folder). In response to the first user's access operation on the target file, it initiates a first access request to the operating system to establish an I / O connection with the target file. At this time, the security detection agent running on the first terminal intercepts the first access request through user-mode and / or kernel-mode modules. Based on the first access request, it obtains the security tag information of the target file. Subsequently, it performs a tag integrity check on the target file based on the signature information field in the security tag information to identify whether the security tag information has been tampered with or corrupted. It also performs an access consistency check on the target file based on the access information field in the security tag information to determine whether there is a risk of unauthorized access.

[0031] During the access control phase, if the tag integrity check or access consistency check fails, the security detection agent blocks the first access request, reports the risk information to the security management system, and displays a prompt message guiding the first user to initiate a document approval process with the approval system. If both the tag integrity check and the access consistency check pass, the security detection agent modifies the security tag information of the target file based on the first user's identity information and allows the first access request, allowing the first user to access the target file normally.

[0032] In the aforementioned file access control process, during the access authentication phase, file access requests are pre-approved to ensure that users can only access the target file on the server after approval, thus controlling the compliant distribution of the target file from the source. During the file issuance phase, security tag information is injected into the metadata of the target file through the file access gateway, making the target file traceable and controllable even after it leaves the server. During the security detection phase, in response to access operations targeting the target file, the security detection proxy deployed on the terminal intercepts access requests targeting the target file and performs tag integrity checks and access consistency checks based on the security tag information of the target file. This allows the system to identify whether the target file has been tampered with and whether the current user is an authorized user before the content of the target file is accessed. During the access control phase, the security detection proxy blocks access requests when the checks fail, ensuring that even if the target file is transmitted to the terminal, unauthorized users cannot access the file content.

[0033] The entire process involves two aspects. First, by performing pre-access authentication on the server side and writing security tag information into the metadata of the target file before it is distributed, the target file carries security verification information bound to the authorized user when it leaves the server, providing a prerequisite for the terminal side to identify and block unauthorized access. Second, through a security detection proxy deployed on the terminal side, access requests for the target file are intercepted after the user initiates an access operation. Based on the security tag information of the target file, tag integrity checks and access identity consistency checks are performed. If the checks fail, the access is blocked. This ensures that the target file can still be effectively identified and controlled after it is stored locally on the terminal, avoiding the risk of data leakage during the cross-terminal transfer of the target file and improving the security of file access.

[0034] The file access control method provided in the embodiments of this specification can be applied to, for example, Figure 2 In the application environment shown, both the first terminal 10 and the second terminal 20 communicate with the server 30 via a communication network. The data storage system 40 can store data that the server 30 needs to process, such as user data requiring authorized access. The data storage system 40 can be integrated onto the server 30 or placed on a cloud or other network server. The first terminal 10 and the second terminal 20 can be, but are not limited to, various smartphones, tablets, personal computers, laptops, etc., and the second terminal 20 runs a security detection agent. The server 30 can be implemented using a standalone server or a server cluster consisting of multiple servers, and a file access gateway runs on the server 30.

[0035] In some possible embodiments, in response to an access operation for a target file, the second terminal 20 sends a second access request for the target file to the server 30. The second access request includes the second user identity information of the second terminal. The server 30 receives the second access request and, in response, determines whether the second user of the second terminal has the right to access the target file based on the second user identity information. If the second user has the right to access the target file, the server 30 injects security tag information into the metadata of the target file through a file access gateway and sends the target file to the second terminal 20. The second terminal 20 receives the target file and sends it to the first terminal 10. In response to the access operation for the target file, the first terminal 10, through a security detection proxy, intercepts the first access request triggered by the access operation, extracts security tag information from the target file based on the first access request, performs pre-access checks on the target file based on the security tag information, including tag integrity checks and access consistency checks. If the pre-access checks fail, the first access request is blocked, and risk information is sent to the server 20.

[0036] It is worth noting that the security detection agent can be a standalone security software or a functional module integrated into a terminal application. Server 30 can deploy multiple systems, such as a business system for receiving second access requests, an approval system for determining whether a second user has permission to access the target file, and a security control system for receiving risk information. The file access gateway can run as an independent service on server 30 or as a functional module of a business system within server 30. These systems can be deployed on the same server or on different servers; this specification does not limit this approach in the embodiments.

[0037] In one embodiment, such as Figure 3 As shown, a file access control method is provided, which is applied to... Figure 2 The following steps are used as an example to illustrate the application environment shown: S302: In response to the access operation for the target file, the second terminal 20 sends a second access request for the target file to the server 30.

[0038] The target file refers to a specified file containing sensitive information, such as Word, Excel, or PPT files containing user personal information or core business information. There can be one or multiple target files. Access operations can include, but are not limited to, file downloads and file previews. The second access request includes the target file's file identifier information and the second user's identity information for the second terminal 20. The second user's identity information is information that uniquely identifies the user currently using the second terminal 20, such as user ID, user account, or user name, and is used by the server 30 in subsequent steps to determine whether the user has the right to access the target file.

[0039] Optionally, in response to a file download operation for a target file triggered by a second user through the business system interface, the second terminal 20 sends a second access request for the target file to the server 30. This request includes the file identification information of the target file and the second user identity information of the second terminal 20.

[0040] S304: Server 30 receives a second access request.

[0041] The server 30 is equipped with a business system for receiving second access requests, an approval system for determining whether a second user has the right to access the target file, and a security control system for receiving risk information. Additionally, a file access gateway is deployed and runs on the server 30. This file access gateway receives the target file pushed by the business system, injects security tag information into the metadata of the target file after approval, and then sends the target file with the injected security tag information to the terminal.

[0042] Optionally, the business system on server 30 receives a second access request through a network interface.

[0043] S306: In response to the second access request, server 30 determines whether the second user of the second terminal 20 has the right to access the target file based on the second user's identity information.

[0044] Optionally, in response to the second access request, the business system on server 30 pushes the target file to the file access gateway and triggers the approval system on server 30 to conduct process approval. The approval system determines whether the second user on the second terminal 20 has the right to access the target file based on the second user's identity information.

[0045] Specifically, the approval system on server 30 first determines the set of user identities authorized to access the target file based on the file identification information of the target file, such as a set of user employee IDs. Then, it checks whether the set of authorized user identities includes the second user's identity information. If it does, the approval system determines that the second user has the right to access the target file and injects security tag information into the target file's metadata through the file access gateway; if it does not, the approval system determines that the second user does not have the right to access the target file and rejects the second access request.

[0046] In this embodiment, during the access authentication phase, the server 30 responds to the file access request through the business system and performs pre-approval of the file access request through the approval system. This ensures that the user can only access the target file on the server after approval, thereby controlling the compliant distribution of the target file from the source and improving the security of file access.

[0047] S308: When a second user has the right to access the target file, server 30 injects security tag information into the metadata of the target file through the file access gateway.

[0048] The metadata of the target file refers to the data set in the target file used to describe information such as file attributes, source, and structure. It can be stored in specific locations such as custom attribute files or core attribute files of the target file. Security labeling information includes access information fields and signature information fields. The access information fields are used to identify file access context information and include fields for the accessible user (e.g., user ID, user account, user name), access source (e.g., access channel identifier), and access time (e.g., access timestamp). The accessible user identity field includes secondary user identity information. The signature information fields are used to digitally sign each field in the security labeling information to promptly identify tampering or corruption of the security labeling information. Signature information fields include a signature algorithm identifier field and a signature result field. The signature result field is obtained by calculating the hash value of a string concatenated from all other fields in the security labeling information in a preset order.

[0049] Understandably, the metadata of the target file is logically and storage-wise independent of the target file's main content. Since security tag information is injected into the metadata, the operation of injecting security tag information into the metadata does not affect the integrity and readability of the main content, thus achieving decoupling between the security tag information and the file's main content. Correspondingly, editing or modifying the file's main content, as well as operations such as compressing or copying the target file, will not result in the loss of security tag information, ensuring that the file remains continuously traceable and controllable during its circulation process.

[0050] Optionally, if the second user has permission to access the target file, the server 30 may inject security tag information into the metadata of the target file through the file access gateway in any of the following ways: Method 1: Write security tag information into the target file's custom properties. Specifically, server 30 adds security tag information, such as the field names and values ​​of the access information fields and the field names and values ​​of the signature information fields, to the target file's custom properties one by one through the file access gateway. After injection, all injected field contents, i.e., security tag information, can be viewed in the target file's "Custom Properties" tab. This method is suitable for various target file formats that support custom property extensions, such as Word, Excel, and PPT.

[0051] Method 2: Write security tag information into the target file's core attribute file ( / docProps / core.xml). Specifically, the server parses the target file's compressed package structure through the file access gateway, locates the target file's core attribute file, and injects the security tag information, including the field names and values ​​of the access information fields and the field names and values ​​of the signature information fields, into the extended nodes of this core attribute file. After injection, the server repackages, compresses, and updates the target file. This method is suitable for various target file formats using the Office Open XML standard, such as Word, Excel, and PPT.

[0052] In this embodiment, during the file issuance stage, the server 30 injects security tag information into metadata independent of the file's main content through a file access gateway. On the one hand, since the security tag information includes access information fields and signature information fields, the target file remains traceable and manageable even after it leaves the server. On the other hand, because the security tag information is decoupled from the file's main content, operations such as editing or modifying the file's main content, as well as compression or copying the target file, will not result in the loss of the security tag information. This ensures the continuity of file traceability and file control, thereby improving the security of file access.

[0053] S310: Server 30 sends the target file with injected security tag information to the second terminal 20.

[0054] Optionally, server 30 sends the target file, which has been injected with security tag information, to second terminal 20 through a file access gateway.

[0055] S312: The second terminal 20 receives the target file.

[0056] The target file is obtained by the second terminal sending a second access request containing the second user's identity information to the server, and the server determining that the second user of the second terminal has the right to access the target file based on the second user's identity information in the second access request, injecting security tag information into the metadata of the target file through the file access gateway running on the server and sending it to the second terminal.

[0057] Optionally, the second terminal 20 stores the received target file in a designated directory on local storage media (e.g., a download folder). The second user can then open or use the target file through the second terminal 20.

[0058] S314: The second terminal 20 sends the target file to the first terminal 10.

[0059] Optionally, the second terminal 20 sends the target file, which has been injected with security tag information, to the first terminal 10 via email, instant messaging software, or other network transmission methods. After receiving the target file sent by the second terminal 20, the first terminal 10 stores the target file in the application's temporary file directory, such as the browser cache, email client temporary storage area, or instant messaging software receiving folder.

[0060] S316: In response to an access operation targeting a target file, the first terminal 10 intercepts the first access request triggered by the access operation through a security detection proxy.

[0061] The first terminal 10 runs a security detection agent. This agent can be either a standalone security software on the first terminal 10 or a functional module embedded in an application on the first terminal 10 (such as a terminal security application). It intercepts access requests when a target file is detected being accessed and verifies the security tag information of the target file to control access to it. The security detection agent includes user-mode modules and / or kernel-mode modules. The user-mode modules run as dynamic link libraries or plugins in the application process space of the first terminal 10, while the kernel-mode modules run as drivers in the operating system kernel space of the first terminal 10.

[0062] Optionally, an application on the first terminal 10 (e.g., a browser, email client, instant messaging software, file explorer) responds to a file download or preview operation on the target file by initiating a first access request to the operating system to attempt to establish an I / O connection with the target file. At this time, a security detection agent running on the first terminal 10 intercepts the first access request through a user-mode module and / or a kernel-mode module. Specifically, the user-mode module can intercept the first access request by hooking target functions (such as Windows' CreateFile, ReadFile, and open file operation functions), and the kernel-mode module can intercept the first access request by registering a file system filter driver.

[0063] S318: The first terminal 10 extracts security tag information from the target file according to the first access request through the security detection agent.

[0064] Understandably, the security detection agent on the first terminal 10 first determines the temporary path of the target file on the first terminal 10 based on the first access request, i.e., the file path under the aforementioned temporary file directory. Then, it opens the target file according to this temporary path and reads the target file's metadata. Finally, it extracts security tag information from the target file's metadata. It is worth noting that if the target file's metadata does not contain security tag information or the security tag information is in an incorrect format, the security detection agent on the first terminal 10 determines that the target file has not been signed by the file access gateway and can directly allow the first access request.

[0065] S320: The first terminal 10 performs a pre-access inspection of the target file based on the security label information through the security detection agent.

[0066] The pre-access checks include label integrity checks and access consistency checks. The label integrity check identifies whether security label information has been tampered with or corrupted. The access consistency check determines whether the file access corresponding to the access request carries the risk of unauthorized access.

[0067] Optionally, the security detection agent on the first terminal 10 performs a tag integrity check on the target file based on the security tag information as follows: First, the target signature algorithm is determined based on the signature algorithm identifier field in the security tag information; then, the string composed of multiple fields in the security tag information is signed based on the target signature algorithm to obtain the current signature result; next, the current signature result is compared with the original signature result in the signature result field; if they match, it means that the security tag information has not been tampered with or damaged, and the tag integrity check is deemed to have passed; if they do not match, it means that the security tag information has been tampered with or damaged, and the tag integrity check is deemed to have failed.

[0068] The security detection agent on the first terminal 10 performs an access consistency check on the target file based on the security label information as follows: It determines whether the accessible user identity field contains the first user identity information of the first terminal; if it does, it means the current accessing user is an accessible user of the target file, and the access consistency check passes; if it does not, it means the current accessing user is not an accessible user of the target file, and the access consistency check fails. Understandably, the accessible user identity field stores the identity information of the currently authorized user (i.e., the second user identity information). When the target file is forwarded to another user and that user obtains access rights through approval, the security detection agent can update the original accessing user identity information in the accessible user identity field to include the identity information of the currently authorized user. In some possible implementations, the security detection agent can use an overwrite update method to replace the original accessing user identity information with the identity information of the currently authorized user; in other possible implementations, the security detection agent can also use an append update method to add the identity information of the currently authorized user to the original accessing user identity information to support scenarios where multiple users have access rights simultaneously.

[0069] In this embodiment, during the security detection phase, server 30 responds to access operations targeting the target file by intercepting access requests to the target file through a security detection proxy deployed on the terminal. Based on the security tag information of the target file, it performs tag integrity detection and access consistency detection. This enables independent permission verification for each access to the target file even after the target file leaves the server and is transferred to the terminal. This effectively identifies unauthorized access behavior during cross-terminal transfer and ensures that the security tag information is not tampered with, thereby improving access security throughout the entire lifecycle of the target file.

[0070] S322: If the first terminal 10 fails the pre-access check, it blocks the first access request through the security detection proxy.

[0071] Understandably, the operating system of the first terminal 10 is the system software running on the first terminal 10. It provides a runtime environment for applications on the first terminal 10 by uniformly managing and scheduling the hardware and software resources of the first terminal 10. The file system of the first terminal 10 is a core subsystem within the operating system kernel, used to manage the organization, storage, and access of files on non-volatile storage media. Since the target file is stored in a temporary file directory on the non-volatile storage media, when an application needs to perform read, write, or other operations on the target file, it will trigger a corresponding first access request through the file system.

[0072] Optionally, if the first terminal 10 fails the tag integrity check or the access consistency check, it may block the first access request through the user-space module and / or kernel-space module of the security detection agent. Specifically, the user-space module may block the first access request by preventing the application from sending the first access request to the operating system of the first terminal 10, and the kernel-space module may block the first access request by discarding the first access request before it reaches the file system of the first terminal 10.

[0073] In this embodiment, during the access control phase, the server 30 blocks access requests when the security detection proxy fails, ensuring that even if the target file is transmitted to the terminal, unauthorized users cannot access the file content. At the same time, when the detection passes, the access request is allowed. This enables independent permission verification for each file access on the terminal side, achieving full-link real-time control from file distribution to terminal access. This effectively avoids the risk of unauthorized access caused by file transfer across terminals and improves access security throughout the entire file lifecycle.

[0074] The aforementioned file access control method, on the one hand, uses a file access gateway deployed on the server to write security tag information into the metadata of the target file after authentication and before it is distributed. This ensures that the target file carries security verification information bound to the accessible user when it leaves the server, providing a prerequisite for the terminal to identify and block unauthorized access. On the other hand, a security detection proxy deployed on the terminal intercepts access requests for the target file after the user initiates an access operation. It performs tag integrity checks and access identity consistency checks based on the security tag information of the target file. If the checks fail, the access is blocked. This ensures that the target file can still be effectively identified and controlled after it is stored locally on the terminal, avoiding the risk of data leakage during the cross-terminal transfer of the target file and improving the security of file access.

[0075] In one embodiment, such as Figure 4 As shown, another file access control method is provided. Taking the application of this method to the first terminal as an example, the method includes the following steps: S402: In response to an access operation targeting a file, the first access request triggered by the access operation is intercepted by a security inspection proxy.

[0076] The target file can be one or more. If there are multiple target files, each target file is injected with security tag information before being transmitted to the first terminal. The security tag information includes signature information fields and access information fields. Specifically, the signature information fields include a signature algorithm identifier field and a signature result field. The signature result field is calculated based on the hash value of a string obtained by concatenating all other fields in the security tag information (excluding the signature result field itself) in a preset order. The access information fields include an accessible user identity field, an access source field, and an access time field. The accessible user identity field stores the identity information of the user currently authorized to access the target file, i.e., the user identity information who obtained access to the target file through an approval process.

[0077] In one possible implementation, the security detection agent includes a user-mode module and / or a kernel-mode module; intercepting the first access request triggered by the access operation through the security detection agent includes: hooking function calls of an application running in the first terminal through the user-mode module to intercept the first access request when the application initiates a first access request to the operating system of the first terminal; and / or intercepting the first access request before the first access request triggered by the access operation reaches the file system of the first terminal through the kernel-mode module.

[0078] The security detection agent may consist of only kernel-mode modules, only user-mode modules, or both. The user-mode modules run as dynamic link libraries or plugins in the application process space of the first terminal. The kernel-mode modules run as drivers in the operating system kernel space of the first terminal 10.

[0079] Optionally, when the security detection agent only includes a user-mode module, the user-mode module running in the application process space intercepts the application's first access request by hooking the target function used to initiate the first access request (such as Windows file operation functions like CreateFile, ReadFile, and open). This approach is convenient to deploy and responds quickly, but the user-mode module cannot effectively intercept when the application accesses files directly through kernel space.

[0080] When the security detection agent only includes kernel-mode modules, these modules, running in the operating system kernel space, intercept access requests before they reach the file system via file system filter drivers. This approach offers high privileges and comprehensive coverage, capable of intercepting all file access requests, including those from system processes, and is unaffected by application escape behavior; however, its deployment and maintenance are relatively complex.

[0081] When the security detection agent includes both kernel-mode and user-mode modules, the two modules intercept the first access request at two levels: user-mode and kernel-mode, respectively. Specifically, the user-mode module intercepts the first access request when the application calls the target function that initiates the first access request (such as Windows' CreateFile, ReadFile, and open file operation functions), enabling a rapid response. The kernel-mode module intercepts the first access request before it enters the file system processing flow, achieving comprehensive interception. Through the coordinated interception of the user-mode and kernel-mode modules, the user-mode module can provide a rapid response to regular function calls at the application layer, while the kernel-mode module can provide supplementary interception for requests entering the file system at the kernel layer. Their combined efforts effectively prevent bypassing of a single interception point.

[0082] In the above implementation, the user-space module hooks requests when they are called by the application, enabling rapid interception before the request enters kernel space. The kernel-space module intercepts all file access requests before the first access request reaches the file system via a file system filter driver. The two modules can be deployed independently or work together. When deployed independently, the user-space module provides a lightweight, fast-response interception solution suitable for general application scenarios; the kernel-space module provides a high-privilege, comprehensive interception solution suitable for high-security scenarios. When working together, the user-space module provides rapid response at the application layer, while the kernel-space module provides supplementary interception at the kernel layer. This complementary approach allows for the fastest possible request interception, preventing bypass of single interception points and effectively improving the comprehensiveness and reliability of interception, thereby enhancing the security of file access control on the terminal side.

[0083] S404: Extract security tag information from the target file based on the first access request via the security detection agent.

[0084] Optionally, after intercepting the first access request, the security detection agent locates the target file based on the first access request, and then extracts the security tag information injected into the target file before it is transmitted to the first terminal from the target file's metadata.

[0085] In one possible implementation, the security detection agent extracts security tag information from the target file based on the first access request, including: determining the temporary path of the target file based on the first access request; reading the metadata of the target file based on the temporary path; and extracting security tag information from the metadata.

[0086] The metadata of the target file is logically and stored independently of the main content of the target file. The first access request carries the file path information of the target file.

[0087] Specifically, the first terminal uses a security detection agent to parse the temporary path of the target file on the first terminal from the first access request. This path could be a temporary file directory pointing to the application, such as a browser cache, email client temporary storage, or instant messaging software receiving folder. The security detection agent opens the target file based on this temporary path, reads its metadata, and extracts pre-injected security tag information from it. If the file corresponding to the temporary path does not contain security tag information or the security tag information is incorrectly formatted, the security detection agent determines that the target file has not been signed by the file access gateway and can directly allow access to the target file.

[0088] Through the above implementation method, the security detection agent determines the temporary path of the target file on the first terminal based on the first access request, reads the metadata of the target file based on the temporary path, and then extracts the pre-injected security tag information from the metadata. This allows the security detection agent to accurately locate the target file and obtain the security tag information in its metadata based on the file path information carried in the first access request, providing an accurate data foundation for subsequent tag integrity detection and access consistency detection. Simultaneously, since the security tag information is stored in the metadata of the target file, and the metadata is independent of the file's main content, reading the metadata does not affect the normal use of the target file, thus ensuring that file access control is non-intrusive to business operations and improving the feasibility and compatibility of the solution.

[0089] S406: The security detection agent performs integrity checks on the target file based on the signature information class field.

[0090] Optionally, after the security detection agent extracts the security tag information, it first performs a tag integrity check on the target file based on the signature information class field to confirm whether the security tag information of the target file has been tampered with or damaged during transmission and storage. The core of the tag integrity check lies in the integrity verification based on digital signatures, that is, by recalculating the signature result of the security tag information and comparing it with the original stored signature result, it confirms whether the security tag information is complete and trustworthy.

[0091] In one possible implementation, the signature information field includes a signature algorithm identifier field and a signature result field. The security detection agent performs a mark integrity check on the target file based on the signature information field, including: performing the following steps through the security detection agent: determining the target signature algorithm based on the signature algorithm identifier field; performing a signature calculation on the string composed of multiple fields in the security mark information based on the target signature algorithm to obtain the current signature result; comparing the current signature result with the original signature result in the signature result field; if they are consistent, the mark integrity check is deemed to have passed; otherwise, the mark integrity check is deemed to have failed.

[0092] Specifically, the security detection agent first reads the corresponding target signature algorithm, such as SHA-1 (Secure Hash Algorithm 1), from the signature algorithm identifier field of the security label information. Then, the agent concatenates all fields in the security label information except the signature result field (such as the accessible user identity field, access source field, access time field, etc.) into a continuous string in a preset order, performs a signature operation on this string using the determined target signature algorithm, and generates the current signature result. Next, the agent reads the signature result field from the signature information class fields, retrieves the original signature result stored therein, and compares the newly calculated current signature result with the original signature result. If they match, it means the security label information has not been tampered with or damaged since it was issued by the file access gateway, and the label integrity check passes; if they do not match, it means the security label information has been tampered with or damaged, and the label integrity check fails.

[0093] The above implementation method ensures that the security label information on which subsequent access control decisions are based is true and reliable, avoids access control failure caused by tampering with the security label information, and improves the reliability of file access control on the terminal side.

[0094] S408: Determine whether the tag integrity check passed through the security detection agent. If yes, proceed to S410; otherwise, proceed to S416.

[0095] Optionally, if the label integrity check passes, it means that the security label information has not been tampered with or damaged, and the security label information is trustworthy. In this case, the security detection agent continues to perform the access consistency check. If the label integrity check fails, it means that the security label information has been tampered with or damaged, that is, the security label information is untrustworthy. In this case, the security detection agent directly blocks the first access request.

[0096] S410: The security inspection agent performs access consistency checks on the target file based on the access information class field.

[0097] Optionally, after the tag integrity check passes, the security detection agent further performs an access consistency check on the target file based on the access information class field to determine whether the first user initiating the first access request is an authorized user of the target file. The core of the access consistency check is to compare the authorized user identity information recorded in the access information class field with the actual user identity information of the current terminal, and determine whether to allow the current access based on the comparison result.

[0098] In one possible implementation, the access information field includes an accessible user identity field; the security detection agent performs access consistency detection on the target file based on the access information field, including: the security detection agent performs the following steps: determining whether the accessible user identity field contains the first user identity information of the first terminal; if yes, the access consistency detection is deemed to have passed; if no, the access consistency detection is deemed to have failed.

[0099] Specifically, the security detection agent reads the identity information (such as user ID, user account, etc.) of the currently authorized user to access the target file from the accessible user identity field of the security tag information. Simultaneously, the security detection agent obtains the identity information of the currently logged-in user on the first terminal (i.e., the first user identity information) by calling the user identity query interface provided by the first terminal's operating system or by interacting with the asset management software running on the terminal. Subsequently, the security detection agent compares the user identity information in the accessible user identity field with the first user identity information on the first terminal to determine whether the accessible user identity field contains the first user identity information. If it does, it means the current accessing user is an authorized user of the target file, and the access consistency check passes; if it does not, it means the current accessing user is not an authorized user of the target file, and the access consistency check fails.

[0100] Through the above implementation method, even after the target file is transferred from the server to the terminal, independent permission verification can still be performed on each access to the target file. On the basis of ensuring that the security marking information is not tampered with, unauthorized access behavior during the cross-terminal transfer process can be effectively identified, thereby improving the access security of the target file throughout its entire life cycle.

[0101] S412: Determine whether the access consistency check has passed through the security detection agent. If yes, proceed to S414; otherwise, proceed to S416.

[0102] Optionally, if the access consistency check passes, it means that the current user is an authorized user of the target file. In this case, the security detection agent allows the first access request, and the first user can access the target file normally. If the tag integrity check fails, it means that the current user is not an authorized user of the target file. In this case, the security detection agent blocks the first access request, and the first user needs to initiate a file approval process to obtain access permissions to the target file. Only after the approval is approved can the user access the target file normally.

[0103] S414: Allow the first access request through the security inspection agent.

[0104] Understandably, if both the tag integrity check and the access consistency check pass, the security detection agent determines that the current accessing user is an accessible user. In this case, the security detection agent no longer intercepts the first access request, allowing it to continue to be passed to the file system. After receiving the response from the file system, the application on the first terminal can read the contents of the target file, enabling the first user to access the target file normally.

[0105] S416: Block the first access request through a security inspection proxy.

[0106] Optionally, if the tag integrity check or access consistency check fails, the security detection agent blocks the first access request to prevent unauthorized access to the target file.

[0107] In one possible implementation, blocking the first access request via a security detection proxy includes: preventing the application from sending the first access request to the operating system of the first terminal via a user-mode module and returning an access denied response to the application; and / or discarding the first access request before it reaches the file system of the first terminal via a kernel-mode module and returning an access denied response to the application that initiated the first access request.

[0108] Specifically, when the security detection agent includes only a user-mode module, the user-mode module running in the application process space hooks the target function used to initiate the first access request, blocks the application from sending the first access request to the operating system, and returns an access denied response (such as returning an error code) to the application. When the security detection agent includes only a kernel-mode module, the kernel-mode module running in the operating system kernel space uses a file system filter driver to discard the request packet corresponding to the first access request before it reaches the file system, and returns an access denied response to the application through the operating system. When the security detection agent includes both a user-mode module and a kernel-mode module, any of the above methods or a combination of both can be used to implement the blocking; this specification does not limit this approach.

[0109] In this way, the security detection agent can effectively block the first access request from user space and / or kernel space when it detects the risk of unauthorized access, preventing the target file content from being read by unauthorized users and improving the security of file access.

[0110] S418: Display a prompt message.

[0111] The prompt message indicates that the target file cannot be accessed and guides the user to initiate the file approval process.

[0112] Optionally, after the security detection agent blocks the first access request, a prompt message pops up on the display interface of the first terminal to inform the first user of the reason why the access was denied and guide the user to initiate a file approval process to obtain access rights.

[0113] Specifically, after blocking the first access request, the security detection agent calls the user interface provided by the operating system of the first terminal to display a prompt message, such as "You do not have permission to access this file. Please initiate an approval process to obtain access" or similar information. The prompt message may include a clickable link or button, which the first user can click to be redirected to the application page of the approval system and initiate a file approval operation for the target file. In this way, the first terminal can provide clear guidance for subsequent operations to the user while blocking unauthorized access, improving user experience and process efficiency.

[0114] S420: Send risk information for the first access request to the server.

[0115] Optionally, after the first access request is blocked, the security detection agent reports the risk information corresponding to the first access request, i.e., the relevant risk information of this unauthorized access event, to the server so that the server can record, audit, and follow up. The risk information includes the file owner information of the target file, the identification information of the first terminal, the first user identity information of the first terminal, the access timestamp of the target file, and the reason for blocking. The file owner information includes, but is not limited to, the identity information of the user who created the target file; the identification information of the first terminal includes, but is not limited to, the device name, device number, and MAC address of the first terminal; the first user identity information includes, but is not limited to, the user's employee ID and user account currently logged into the first terminal; and the reasons for blocking include, but are not limited to, failure to pass the tag integrity check or access consistency check.

[0116] Specifically, after blocking the first access request, the security detection agent collects and packages the risk information of the first access request, and then sends it to the server's security management system via the communication network. Upon receiving this risk information, the security management system records and stores it, which can be used to automatically generate security work orders or for offline follow-up and audit analysis by security engineers. Through this method, the first terminal can work with the server to achieve full-link recording and tracing of unauthorized access behavior, thereby providing data support for data security management and risk handling.

[0117] S422: In response to a file approval operation on the target file, send a file approval request for the target file to the server.

[0118] Optionally, after seeing the prompt displayed on the first terminal, the first user can trigger a file approval operation for the target file by clicking the "Initiate Approval" link in the prompt. In response to the file approval operation, the first terminal sends a file approval request for the target file to the server. This file approval request includes the first user's identity information (such as the user's account) and the target file's file identification information (such as the file number). Upon receiving the file approval request, the approval system on the server reviews the request according to a preset approval strategy.

[0119] Specifically, in response to a document approval request, the approval system on the server first determines the set of authorized user identities, such as a set of user employee IDs, based on the file identifier information of the target file. Then, it checks whether the first user's identity information is included in this set of authorized user identities. If it is, the approval system determines that the first user has the right to access the target file and sends an approval approval message to the first terminal; if it is not, the approval system determines that the first user does not have the right to access the target file and sends an approval rejection message to the first terminal.

[0120] It is worth noting that this embodiment only describes one preferred implementation of this specification. The preset approval strategy may also be to send an approval notification to the file owner based on the file owner information of the target file, and have the file owner confirm whether to authorize it; or to automatically match the corresponding approval process personnel based on the sensitivity level of the target file, and have the approval process personnel confirm whether to authorize it. The embodiments described above do not specifically limit the above preset approval strategies.

[0121] In this embodiment, after the security detection proxy blocks unauthorized access, the first terminal can provide a convenient way for the user requesting access to obtain permissions, thereby improving the efficiency of file access while ensuring the security of access to the target file.

[0122] S424: In response to the approval information sent by the server, the security detection agent modifies the security label information based on the first user's identity information and allows the first access request.

[0123] Optionally, after the first terminal receives the approval information sent by the server, the security detection agent updates the accessible user identity field in the security label information to include the first user's identity information based on the approval information, and then allows the first access request, so that the first user can access the target file normally.

[0124] Specifically, the security label information can be updated in two ways: an overwrite update or an append update. An overwrite update replaces the original user identity information in the accessible user identity field with the first user's identity information; an append update adds the first user's identity information to the original user identity information in the accessible user identity field. After the security label information is modified, the first user becomes the new accessible user for the target file. The security detection agent allows the first access request, permitting the application to continue sending the request to the operating system and complete reading the target file content, allowing the first user to access the target file normally.

[0125] In this embodiment, after the first user obtains authorization through approval, the first terminal updates the accessible user identity field to the first user's identity information through a security detection proxy, so that the first user's subsequent access operations to the target file can successfully pass the access consistency detection, realizing dynamic authorization control and improving the flexibility and reliability of file access control.

[0126] The aforementioned file access control method, on the one hand, uses a security detection proxy to perform tag integrity checks and access consistency checks based on the security tag information in the target file's metadata before access. If the checks fail, the access request is blocked, thus extending security control from the server side to every file access behavior on the terminal side. This ensures that even after the file leaves the server and flows to the terminal, the risk of unauthorized access due to cross-terminal propagation can still be effectively identified. On the other hand, after the first access request is blocked by the security detection proxy, a prompt message is displayed to guide the user to initiate an approval process. Upon approval, the accessible user's identity in the security tag information is updated, and the access request is allowed, enabling the user to access the file normally after authorization. This achieves dynamic authorization control from blocking to re-authorization to allowing access. The entire process ensures the access security of the target file throughout its entire lifecycle while also considering the user's file access efficiency, improving the flexibility and reliability of file access control.

[0127] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0128] Based on the above-mentioned inventive concept of the file access control method applied to the first terminal, such as Figure 5 As shown in the embodiments of this specification, a first file access control device 500 is also provided for implementing the file access control method applied to a first terminal as described above. The first file access control device 500 operates a security detection agent, and the device includes: The operation response module 501 is used to respond to an access operation on the target file by intercepting the first access request triggered by the access operation through a security detection proxy; the target file is injected with security tag information before being transmitted to the first terminal; Information extraction module 502 is used to extract security tag information from the target file based on the first access request through the security detection agent; The access detection module 503 is used to perform pre-access detection on the target file based on the security label information through the security detection agent; the pre-access detection includes label integrity detection and access consistency detection. The request blocking module 504 is used to block the first access request through a security detection proxy if the access pre-access detection fails.

[0129] In one possible implementation, the security detection agent includes a user-mode module and / or a kernel-mode module; the operation response module 501 is specifically used to: hook function calls of the application running in the first terminal through the user-mode module to intercept the first access request when the application initiates a first access request to the operating system of the first terminal; and / or intercept the first access request before the first access request triggered by the access operation reaches the file system of the first terminal through the kernel-mode module.

[0130] In one possible implementation, the information extraction module is specifically used to: determine the temporary path of the target file based on the first access request; read the metadata of the target file based on the temporary path; and extract security tag information from the metadata.

[0131] In one possible implementation, the security marking information includes a signature information class field and an access information class field; the access detection module 503 is specifically used to: perform marking integrity detection on the target file based on the signature information class field through the security detection agent; and if the marking integrity detection passes, perform access consistency detection on the target file based on the access information class field through the security detection agent.

[0132] In one possible implementation, the signature information field includes a signature algorithm identifier field and a signature result field; the access detection module 503 is specifically used to: perform the following steps through the security detection agent: determine the target signature algorithm based on the signature algorithm identifier field; perform signature calculation on the string composed of multiple fields in the security mark information according to the target signature algorithm to obtain the current signature result; compare whether the current signature result is consistent with the original signature result in the signature result field; if yes, the mark integrity detection is determined to pass; if no, the mark integrity detection is determined to fail.

[0133] In one possible implementation, the access information field includes an accessible user identity field; the access detection module 503 is specifically used to: perform the following steps through the security detection agent: determine whether the accessible user identity field contains the first user identity information of the first terminal; if yes, then determine that the access consistency detection has passed; if no, then determine that the access consistency detection has failed.

[0134] In one possible implementation, the security detection agent includes a user-mode module and / or a kernel-mode module; the request blocking module 504 is specifically configured to: block the application from sending a first access request to the operating system of the first terminal through the user-mode module, and return an access denied response to the application; and / or discard the first access request before it reaches the file system of the first terminal through the kernel-mode module, and return an access denied response to the application that initiated the first access request.

[0135] In one possible implementation, the first file access control device 500 further includes a risk handling module, used to: display a prompt message; the prompt message indicates that the target file cannot be accessed and guides the user to initiate a file approval process; send risk information of the first access request to the server; the risk information includes the file owner information of the target file, the identification information of the first terminal, and the first user identity information of the first terminal.

[0136] In one possible implementation, the first file access control device 500 further includes an authentication request module, configured to: in response to a file approval operation for the target file, send a file approval request for the target file to the server, the file approval request including first user identity information, so that the server: in response to the file approval request, determine whether the first user of the first terminal has the right to access the target file based on the first user identity information, and if the first user has the right to access the target file, send approval information to the first terminal; in response to the approval information sent by the server, modify the security label information based on the first user identity information through a security detection proxy, and allow the first access request.

[0137] Based on the above-mentioned inventive concept of file access control method applied to servers, such as Figure 6 As shown in the embodiments of this specification, a second file access control device 600 is also provided for implementing the file access control method applied to a server as described above. The second file access control device 600 is equipped with a file access gateway, and the device includes: The request receiving module 601 is used to receive a second access request for a target file sent by the second terminal; the second access request includes the second user identity information of the second terminal; The request response module 602 is used to respond to the second access request and determine whether the second user of the second terminal has the right to access the target file based on the second user identity information; Information injection module 603 is used to inject security tag information into the metadata of the target file through the file access gateway when the second user has the right to access the target file; The file sending module 604 is used to send a target file with injected security tag information to a second terminal.

[0138] This specification also provides an electronic device, which may be a first terminal, and its internal structure diagram may be as follows: Figure 7 As shown. Please see below. Figure 7 The electronic device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with an external first terminal; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a file access control method. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the electronic device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the electronic device, or external keyboards, touchpads, or mice, etc.

[0139] It is worth noting that this electronic device can also be a server, and its internal structure diagram can be as follows: Figure 8 As shown. Please see below. Figure 8This electronic device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores user data with authorized access. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with an external first terminal via a network connection. The processor executes computer programs to implement a file access control method.

[0140] Those skilled in the art will understand that Figure 7 and Figure 8 The structures shown are merely block diagrams of a portion of the structure related to the scheme described in this specification, and do not constitute a limitation on the electronic devices to which the scheme described in this specification is applied. Specific electronic devices may include more or fewer components than those shown in the figures, or may combine certain components, or may have different component arrangements.

[0141] In one possible implementation, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0142] This specification also provides a computer storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps in the above embodiments. If the constituent modules of the above-described electronic device are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer storage medium.

[0143] In one possible implementation, a computer storage medium is provided that stores a computer program, which, when executed by a processor, implements the steps in the above method embodiments.

[0144] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0145] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this specification are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0146] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0147] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims.

[0148] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the features, data, and information involved in this specification were all obtained under full authorization.

[0149] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

Claims

1. A file access control method, characterized in that, Applied to a first terminal, the first terminal running a security detection agent, the method includes: In response to an access operation targeting a target file, the security detection proxy intercepts the first access request triggered by the access operation; the target file is injected with security tag information before being transmitted to the first terminal; The security detection agent extracts security tag information from the target file based on the first access request; The security detection agent performs pre-access detection on the target file based on the security tag information; the pre-access detection includes tag integrity detection and access consistency detection. If the access pre-access check fails, the first access request is blocked by the security detection proxy.

2. The method as described in claim 1, characterized in that, The security detection agent includes a user-mode module and / or a kernel-mode module; The interception of the first access request triggered by the access operation through the security detection proxy includes: The user-mode module hooks the function calls of the application running in the first terminal to intercept the first access request when the application initiates the first access request to the operating system of the first terminal. and / or The kernel-mode module intercepts the first access request before it reaches the file system of the first terminal.

3. The method as described in claim 1, characterized in that, The step of extracting security tag information from the target file through the security detection agent according to the first access request includes: Determine the temporary path of the target file based on the first access request; Read the metadata of the target file according to the temporary path; Extract the security tag information from the metadata.

4. The method as described in claim 1, characterized in that, The security label information includes signature information fields and access information fields; The pre-access detection of the target file by the security detection agent based on the security label information includes: The security detection agent performs integrity checks on the target file based on the signature information class field. If the mark integrity check passes, the security detection agent performs an access consistency check on the target file based on the access information class field.

5. The method as described in claim 4, characterized in that, The signature information fields include a signature algorithm identifier field and a signature result field; The step of performing integrity checks on the target file using the security detection agent based on the signature information class field includes: The following steps are performed by the security detection agent: The target signature algorithm is determined based on the signature algorithm identifier field. The string composed of multiple fields in the security tag information is signed using the target signature algorithm to obtain the current signature result. Compare whether the current signature result is consistent with the original signature result in the signature result field; If so, the mark integrity check is deemed to have passed; If not, the mark integrity check is deemed to have failed.

6. The method as described in claim 4, characterized in that, The access information field includes the accessible user identity field; The step of performing access consistency checks on the target file through the security detection agent based on the access information class field includes: The following steps are performed by the security detection agent: Determine whether the accessible user identity field contains the first user identity information of the first terminal; If so, the access consistency check is deemed to have passed; If not, the access consistency check is deemed to have failed.

7. The method as described in claim 1, characterized in that, The security detection agent includes a user-mode module and / or a kernel-mode module; The step of blocking the first access request through the security detection proxy includes: The user-mode module prevents the application from sending the first access request to the operating system of the first terminal and returns an access denied response to the application. and / or The kernel-mode module discards the first access request before it reaches the file system of the first terminal and returns an access denied response to the application that initiated the first access request.

8. The method as described in claim 1, characterized in that, After blocking the first access request through the security detection proxy, the method further includes: Display a prompt message; the prompt message is used to indicate that the target file cannot be accessed and to guide the user to initiate a file approval process; The risk information of the first access request is sent to the server; the risk information includes the file owner information of the target file, the identification information of the first terminal, and the first user identity information of the first terminal.

9. The method as described in claim 8, characterized in that, After displaying the prompt information, the method further includes: In response to a file approval operation for the target file, a file approval request for the target file is sent to the server. The file approval request includes the first user's identity information, so that the server: in response to the file approval request, determines whether the first user of the first terminal has the right to access the target file based on the first user's identity information, and if the first user has the right to access the target file, sends approval information to the first terminal. In response to the approval information sent by the server, the security detection agent modifies the security tag information based on the first user identity information and allows the first access request.

10. The method as described in claim 1, characterized in that, Before intercepting the first access request triggered by the access operation via the security detection proxy in response to an access operation targeting the target file, the method further includes: The server receives a target file sent by a second terminal. The target file is obtained by the second terminal sending a second access request to the server, which includes the second user's identity information. After the server determines that the second user of the second terminal has the right to access the target file based on the second user's identity information in the second access request, it injects the security tag information into the metadata of the target file through a file access gateway running on the server and sends it to the second terminal.

11. A file access control system, characterized in that, The file access control system includes: a first terminal, a second terminal, and a server. The first terminal runs a security detection agent, and the server runs a file access gateway. The second terminal is configured to send a second access request for the target file to the server in response to an access operation for the target file; the second access request includes the second user identity information of the second terminal; The server is configured to receive the second access request, respond to the second access request, determine whether the second user of the second terminal has the right to access the target file based on the second user identity information; if the second user has the right to access the target file, inject security tag information into the metadata of the target file through the file access gateway; and send the target file to the second terminal. The second terminal is also used to receive the target file and send the target file to the first terminal; The first terminal is configured to, in response to an access operation targeting the target file, intercept a first access request triggered by the access operation through the security detection proxy; extract security tag information from the target file based on the first access request through the security detection proxy; perform pre-access detection on the target file based on the security tag information through the security detection proxy; the pre-access detection includes tag integrity detection and access consistency detection; and if the pre-access detection fails, block the first access request through the security detection proxy.

12. A file access control device, characterized in that, Applied to a first terminal, the first terminal running a security detection agent, the device includes: An operation response module is used to respond to an access operation targeting a target file by intercepting a first access request triggered by the access operation through the security detection proxy; the target file is injected with security tag information before being transmitted to the first terminal; The information extraction module is used to extract security tag information from the target file based on the first access request through the security detection agent; An access detection module is used to perform pre-access detection on the target file based on the security tag information through the security detection agent; the pre-access detection includes tag integrity detection and access consistency detection. The request blocking module is used to block the first access request through the security detection proxy if the access fails the pre-access detection.

13. An electronic device, characterized in that, include: A processor and a memory; the memory stores a computer program, and the processor executes the computer program to implement the method steps of any one of claims 1-10.

14. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the method steps as claimed in any one of claims 1-10.

15. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-10.

Images