An office terminal security management method, device, equipment and medium

Abstract

The application discloses an office terminal security management method, device and equipment and medium, and relates to the field of office terminal security management, and the method comprises the steps of: encrypting the unique identification of the office terminal and initial security configuration information based on a hybrid encryption algorithm, generating an encrypted label containing a key index; uploading data to a management platform by scanning the encrypted label through a mobile terminal, calling a private key to decrypt the encrypted key according to the key index, and binding the encrypted key with the unique identification to realize warehousing; binding identity information by scanning the encrypted label, associating the identity information with the unique identification and the encrypted key after verification, and pushing the security configuration to realize taking, so that the safety control and dynamic identity binding of the whole life cycle of the office terminal are realized.

Description

Technical Field

[0001] This application relates to the field of office terminal security management, specifically to an office terminal security management method, device, equipment, and medium. Background Technology

[0002] The field of office terminal security management mainly focuses on traditional asset tag management, ordinary QR code management, and asset traceability technology based on RFID (Radio Frequency Identification).

[0003] In traditional asset tagging management, companies record basic information about office terminals by affixing paper labels or metal nameplates, and manage the data using manual inventory or simple forms and ledgers. Ordinary QR code management technology encodes asset information on office terminals into public QR codes and affixes them to the device surface. Managers can scan the codes to read the information, enabling asset inventory, issuance registration, and other operations. RFID-based asset traceability technology embeds RFID chips in office terminals to store detailed asset information, enabling long-distance, simultaneous identification of multiple tags using RFID readers. However, existing technologies suffer from the following problems: lack of identity binding and access control, failing to achieve encrypted binding between users and assets; insufficient physical security risk control, with traditional tags easily tampered with, forged, or detached, and ordinary QR codes lacking encryption mechanisms, making information easily copied; lack of network and data security monitoring, failing to link QR codes or RFID tags with the terminal's system security status and software usage; disconnect between management processes and security control, failing to embed security audits into the entire process of asset requisition, transfer, and return; and insufficient information security and interaction efficiency, with ordinary QR codes providing publicly available information, failing to achieve rapid interaction of encrypted information, and unable to complete multi-dimensional control such as identity verification and security status checks during the scanning process, making it difficult to balance management efficiency and information security. Summary of the Invention

[0004] This application provides a method, device, equipment, and medium for managing the security of office terminals, which can achieve dynamic identity binding and comprehensive monitoring, while taking into account both information security and interaction efficiency, and reducing deployment costs and asset risks.

[0005] In a first aspect, embodiments of this application provide an office terminal security management method, the office terminal security management method comprising: The unique identifier and initial security configuration information of the office terminal are encrypted using a hybrid encryption algorithm to generate an encrypted tag containing ciphertext data, key ciphertext, and key index, which corresponds to the office terminal. By scanning the encryption tag with a mobile terminal, the encrypted data, key ciphertext, and key index are uploaded to the management platform. The management platform uses the key index to call the private key to decrypt the key ciphertext, obtain the office terminal encryption key, and bind it to the unique identifier of the office terminal, thus realizing the entry of the office terminal into the database. By scanning the encrypted tag and binding identity information with a mobile terminal, and after the management platform verifies the identity information, the identity information is associated with the unique identifier of the office terminal and the encryption key of the office terminal, and the security configuration corresponding to the current identity information is pushed to the office terminal, thus realizing the use of the office terminal.

[0006] In conjunction with the first aspect, in one implementation, the office terminal security management method encrypts the unique identifier and initial security configuration information of the office terminal based on a hybrid encryption algorithm, specifically including: Obtain the unique identifier of the office terminal, initial security configuration information, and temporary symmetric key; The unique identifier of the office terminal and the initial security configuration information are symmetrically encrypted using a temporary symmetric key to obtain ciphertext data. The public key of the management platform is used to perform asymmetric encryption on the temporary symmetric key to obtain the key ciphertext. Based on the ciphertext data, the key ciphertext, and the key index, an encrypted tag is generated by integrating and encoding.

[0007] In conjunction with the first aspect, in one embodiment, the office terminal security management method further includes, before scanning the encrypted tag and binding identity information via a mobile terminal: Determine the state of the conductive loop within the encrypted tag: If the conductive circuit is closed, the tag is determined to be physically intact, and the step of binding identity information is executed. If the conductive circuit is open, the tag's physical integrity is deemed compromised, a physical tampering warning signal is generated, the binding of identity information is prohibited, and the issuance of security configuration is refused.

[0008] In conjunction with the first aspect, in one implementation method, the office terminal security management method, after the management platform verifies the identity information, associates and binds the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, specifically including: The management platform compares the current identity information with the pre-bound information to determine if they match. If they match, the security configuration corresponding to the current identity information will be pushed to the office terminal; If there is a discrepancy, an authorization instruction is received, and the identity information is updated according to the authorization instruction. The management platform then adjusts the terminal security configuration based on the identity information permissions.

[0009] In conjunction with the first aspect, in one embodiment, the office terminal security management method further includes: The management platform receives system security status data reported by office terminals. The system security status data is compared with a preset security baseline: If the preset security baseline is met, the security configuration corresponding to the current identity information will be pushed to the office terminal; If the default security baseline is not met, a restriction instruction will be generated to restrict network access permissions for the office terminal or to push restrictive security configurations.

[0010] In conjunction with the first aspect, in one implementation method, the office terminal security management method further includes: The location information of office terminals is obtained through the management platform, and the real-time location information of the office terminals is compared with the preset electronic fence: When the real-time location information of the office terminal exceeds the preset electronic fence, a location anomaly warning is triggered, and a restriction instruction is issued to restrict the network access or application access of the office terminal.

[0011] In conjunction with the first aspect, in one implementation, the office terminal security management method, after triggering a location anomaly warning, further includes: Generate security alarm data and call the communication interface to push the security alarm data to the preset management terminal and the mobile terminal corresponding to the currently bound identity information; Receive anomaly cause reporting information and review instructions for the anomaly cause reporting information: If the audit instruction indicates authorized movement, then the restriction instruction is lifted; If the audit instruction indicates that it is unauthorized, it will be escalated to a security incident and traced and logged.

[0012] Secondly, embodiments of this application provide an office terminal security management device, the office terminal security management device comprising: The encryption module is used to encrypt the unique identifier and initial security configuration information of the office terminal based on a hybrid encryption algorithm, and generate an encrypted tag containing ciphertext data, key ciphertext and key index, which corresponds to the office terminal. The decryption module is used to scan the encryption tag via a mobile terminal, upload the ciphertext data, key ciphertext, and key index to the management platform, and the management platform uses the key index to call the private key to decrypt the key ciphertext to obtain the office terminal encryption key and bind it to the unique identifier of the office terminal, thereby realizing the entry of the office terminal into the database. The control module is used to scan encrypted tags and bind identity information via mobile terminals. After the management platform verifies the identity information, it associates and binds the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, and pushes the security configuration corresponding to the current identity information to the office terminal, thereby realizing the use of the office terminal.

[0013] Thirdly, this application provides an office terminal security management device, which includes a processor, a memory, and an office terminal security management program stored in the memory and executable by the processor. When the office terminal security management program is executed by the processor, it implements the steps of the above-described office terminal security management method.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing an office terminal security management program, wherein when the office terminal security management program is executed by a processor, it implements the steps of the above-described office terminal security management method.

[0015] The beneficial effects of the technical solutions provided in this application include: By encrypting and binding office terminals with user identities using encrypted tags, and employing a hybrid encryption algorithm and tamper-proof tag design, dynamic identity binding is achieved through real-time data interaction between mobile terminals and the platform. This solves the problem of accountability and enables real-time monitoring of network and data security risks such as operating system vulnerabilities and pirated software, thereby strengthening physical security and reducing asset risks. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the office terminal security management method of this application; Figure 2 This is a schematic diagram of the functional modules of the office terminal security management device of this application; Figure 3 This is a schematic diagram of the hardware structure of the office terminal security management device in this application. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0019] In a first aspect, embodiments of this application provide a method for managing the security of office terminals.

[0020] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the office terminal security management method of this application. Figure 1 As shown, the office terminal security management methods include: The unique identifier and initial security configuration information of the office terminal are encrypted using a hybrid encryption algorithm to generate an encrypted tag containing ciphertext data, key ciphertext, and key index, which corresponds to the office terminal. By scanning the encryption tag with a mobile terminal, the encrypted data, key ciphertext, and key index are uploaded to the management platform. The management platform uses the key index to call the private key to decrypt the key ciphertext, obtain the office terminal encryption key, and bind it to the unique identifier of the office terminal, thus realizing the entry of the office terminal into the database. By scanning the encrypted tag and binding identity information with a mobile terminal, and after the management platform verifies the identity information, the identity information is associated with the unique identifier of the office terminal and the encryption key of the office terminal, and the security configuration corresponding to the current identity information is pushed to the office terminal, thus realizing the use of the office terminal.

[0021] In this embodiment, the office terminal is encrypted and bound to the user's identity through an encrypted tag. A hybrid encryption algorithm and tamper-proof tag design are adopted. Through real-time data interaction between the mobile terminal and the platform, dynamic identity binding is achieved, solving the problem of accountability and real-time monitoring of network and data security risks such as operating system vulnerabilities and pirated software. This strengthens physical security and reduces asset risks.

[0022] Furthermore, in one embodiment, the office terminal security management method encrypts the unique identifier and initial security configuration information of the office terminal based on a hybrid encryption algorithm, specifically including: Obtain the unique identifier of the office terminal, initial security configuration information, and temporary symmetric key; Specifically, the system obtains the unique identifier and initial security configuration information of the office terminal, and then randomly generates a high-strength, one-time symmetric key as a temporary symmetric key. The unique identifier of the office terminal and the initial security configuration information are symmetrically encrypted using a temporary symmetric key to obtain ciphertext data. Specifically, the unique identifier of the office terminal and the initial security configuration information are symmetrically encrypted using a temporary key to obtain ciphertext data. This step ensures the processing efficiency of encrypting large amounts of data.

[0023] The public key of the management platform is used to perform asymmetric encryption on the temporary symmetric key to obtain the key ciphertext. Based on the ciphertext data, the key ciphertext, and the key index, an encrypted tag is generated by integrating and encoding.

[0024] Specifically, the management platform's public key is used to perform asymmetric encryption on the temporary symmetric key to obtain the key ciphertext. This step ensures that the management platform, which only holds the corresponding private key, can decrypt the symmetric key. The ciphertext data, key ciphertext, and key index are integrated into a data structure and encoded to generate the final encrypted tag.

[0025] Furthermore, in one embodiment, the office terminal security management method further includes, before scanning the encrypted tag and binding identity information via a mobile terminal: Determine the state of the conductive loop within the encrypted tag: If the conductive circuit is closed, the tag is determined to be physically intact, and the step of binding identity information is executed. If the conductive circuit is open, the tag's physical integrity is deemed compromised, a physical tampering warning signal is generated, the binding of identity information is prohibited, and the issuance of security configuration is refused.

[0026] Specifically, the encrypted tag is made of a fragile substrate and an embedded breakage detection circuit. The tag also integrates a fragile conductive loop composed of extremely fine wires, such as a serpentine or mesh loop. This loop is pre-installed in the fragile substrate layer during the tag's production, serving as a physical integrity sensor. If the conductive loop is closed and exhibits stable electrical characteristics, the tag is deemed physically intact, and the identity information binding process is initiated. If the conductive loop is open, the tag is deemed physically damaged. When any device scans this tag, the system will detect the open loop signal during the verification process, generate a physical tampering warning signal, prohibit the identity information binding process, and refuse to issue security configurations.

[0027] Furthermore, in one embodiment, the office terminal security management method, after the management platform verifies the identity information, associates and binds the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, specifically including: The management platform compares the current identity information with the pre-bound information to determine if they match. If they match, the security configuration corresponding to the current identity information will be pushed to the office terminal; If there is a discrepancy, an authorization instruction is received, and the identity information is updated according to the authorization instruction. The management platform then adjusts the terminal security configuration based on the identity information permissions.

[0028] Specifically, if there is a discrepancy, the user needs to scan the tag, submit a transfer application and their own identity information. After the administrator authorizes the user through the management platform, the management platform updates the user's identity binding information and adjusts the terminal security configuration according to the user's permissions, thus forming a dynamic identity binding mechanism.

[0029] Furthermore, in one embodiment, the office terminal security management method further includes: The management platform receives system security status data reported by office terminals. The system security status data is compared with a preset security baseline: If the preset security baseline is met, the security configuration corresponding to the current identity information will be pushed to the office terminal; Specifically, if the system security status data on the office terminal meets the preset security baseline, then the security configuration corresponding to the current identity information is pushed to the office terminal; If the preset security baseline is not met, a restriction instruction will be generated to restrict the network access permissions of the office terminal or push restrictive security configurations. Specifically, if the system security status data on the office terminal does not meet the preset security baseline, the network access permissions of the office terminal will be restricted, or restrictive security configurations will be pushed.

[0030] Furthermore, in one embodiment, the office terminal security management method further includes: The location information of office terminals is obtained through the management platform, and the real-time location information of the office terminals is compared with the preset electronic fence: When the real-time location information of the office terminal exceeds the preset electronic fence, a location anomaly warning is triggered, and a restriction instruction is issued to restrict the network access or application access of the office terminal.

[0031] Specifically, when the real-time location information of an office terminal exceeds the preset electronic fence, a location anomaly warning is triggered, and a restriction command is issued to restrict the office terminal's network access permissions or application access permissions. The management platform records the office terminal's location information in real time.

[0032] Furthermore, in one embodiment, the office terminal security management method, after triggering a location anomaly warning, further includes: Generate security alarm data and call the communication interface to push the security alarm data to the preset management terminal and the mobile terminal corresponding to the currently bound identity information; Specifically, security alarm data is generated, which includes alarms with key information such as office terminal ID, model, bound user, abnormal location coordinates, and preset electronic fence range. The security alarm data is pushed to the preset management terminal and the mobile terminal corresponding to the currently bound identity information by calling the communication interface. The communication interface can be email, SMS, enterprise internal instant messaging tools, etc.

[0033] Receive anomaly cause reporting information and review instructions for the anomaly cause reporting information: If the audit instruction indicates authorized movement, then the restriction instruction is lifted; Specifically, if the audit instruction indicates authorized movement, this alarm can be marked as a false alarm or authorized, and the electronic fence of the office terminal can be temporarily adjusted and the restriction instruction can be lifted.

[0034] If the audit instruction indicates that it is unauthorized, it will be escalated to a security incident and traced and logged.

[0035] Specifically, if the audit instruction indicates that it is unauthorized, it will be immediately escalated to a security incident, the emergency response procedure will be initiated, and historical data will be traced.

[0036] Secondly, embodiments of this application also provide an office terminal security management device.

[0037] In one embodiment, reference is made to Figure 2 , Figure 2 This is a functional module diagram of an embodiment of the office terminal security management device of this application. Figure 2 As shown, the office terminal security management device includes: an encryption module, a decryption module, and a control module.

[0038] The encryption module is used to encrypt the unique identifier and initial security configuration information of the office terminal based on a hybrid encryption algorithm, and generate an encrypted tag containing ciphertext data, key ciphertext and key index, which corresponds to the office terminal. The decryption module is used to scan the encryption tag via a mobile terminal, upload the ciphertext data, key ciphertext, and key index to the management platform, and the management platform uses the key index to call the private key to decrypt the key ciphertext to obtain the office terminal encryption key and bind it to the unique identifier of the office terminal, thereby realizing the entry of the office terminal into the database. The control module is used to scan encrypted tags and bind identity information via mobile terminals. After the management platform verifies the identity information, it associates and binds the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, and pushes the security configuration corresponding to the current identity information to the office terminal, thereby realizing the use of the office terminal.

[0039] The functions of each module in the above-mentioned office terminal security management device correspond to the steps in the above-mentioned office terminal security management method embodiment, and their functions and implementation processes will not be described in detail here.

[0040] Thirdly, embodiments of this application provide an office terminal security management device, which can be a personal computer (PC), laptop computer, server, or other device with data processing capabilities.

[0041] Reference Figure 3 , Figure 3 This is a schematic diagram of the hardware structure of the office terminal security management device involved in the embodiments of this application. In the embodiments of this application, the office terminal security management device may include a processor, a memory, a communication interface, and a communication bus.

[0042] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0043] Communication interfaces include input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the office terminal security management device, as well as interfaces used for interconnecting the office terminal security management device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0044] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0045] The processor can be a general-purpose processor, which can call the office terminal security management program stored in the memory and execute the office terminal security management method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the office terminal security management program is called can be referred to in the various embodiments of the office terminal security management method of this application, and will not be repeated here.

[0046] Those skilled in the art will understand that Figure 3 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0047] Fourthly, embodiments of this application also provide a computer-readable storage medium.

[0048] The present application provides a computer-readable storage medium storing an office terminal security management program, wherein when the office terminal security management program is executed by a processor, it implements the steps of the office terminal security management method described above.

[0049] The method implemented when the office terminal security management program is executed can be referred to in the various embodiments of the office terminal security management method of this application, and will not be repeated here.

[0050] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0051] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0052] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0053] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0054] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0055] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0056] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for managing the security of office terminals, characterized in that, The office terminal security management method includes: The unique identifier and initial security configuration information of the office terminal are encrypted using a hybrid encryption algorithm to generate an encrypted tag containing ciphertext data, key ciphertext, and key index, which corresponds to the office terminal. By scanning the encryption tag with a mobile terminal, the encrypted data, key ciphertext, and key index are uploaded to the management platform. The management platform uses the key index to call the private key to decrypt the key ciphertext, obtain the office terminal encryption key, and bind it to the unique identifier of the office terminal, thus realizing the entry of the office terminal into the database. By scanning the encrypted tag and binding identity information with a mobile terminal, and after the management platform verifies the identity information, the identity information is associated with the unique identifier of the office terminal and the encryption key of the office terminal, and the security configuration corresponding to the current identity information is pushed to the office terminal, thus realizing the use of the office terminal.

2. The office terminal security management method as described in claim 1, characterized in that, The unique identifier and initial security configuration information of the office terminal are encrypted using a hybrid encryption algorithm, specifically including: Obtain the unique identifier of the office terminal, initial security configuration information, and temporary symmetric key; The unique identifier of the office terminal and the initial security configuration information are symmetrically encrypted using a temporary symmetric key to obtain ciphertext data. The public key of the management platform is used to perform asymmetric encryption on the temporary symmetric key to obtain the key ciphertext. Based on the ciphertext data, the key ciphertext, and the key index, an encrypted tag is generated by integrating and encoding.

3. The office terminal security management method as described in claim 1, characterized in that, Before scanning the encrypted tag and binding identity information via a mobile device, the process also includes: Determine the state of the conductive loop within the encrypted tag: If the conductive circuit is closed, the tag is determined to be physically intact, and the step of binding identity information is executed. If the conductive circuit is open, the tag's physical integrity is deemed compromised, a physical tampering warning signal is generated, the binding of identity information is prohibited, and the issuance of security configuration is refused.

4. The office terminal security management method as described in claim 1, characterized in that, After the management platform verifies the identity information, it will associate and bind the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, specifically including: The management platform compares the current identity information with the pre-bound information to determine if they match. If they match, the security configuration corresponding to the current identity information will be pushed to the office terminal; If there is a discrepancy, an authorization instruction is received, and the identity information is updated according to the authorization instruction. The management platform then adjusts the terminal security configuration based on the identity information permissions.

5. The office terminal security management method as described in claim 1, characterized in that, The office terminal security management method also includes: The management platform receives system security status data reported by office terminals. The system security status data is compared with a preset security baseline: If the preset security baseline is met, the security configuration corresponding to the current identity information will be pushed to the office terminal; If the default security baseline is not met, a restriction instruction will be generated to restrict network access permissions for the office terminal or to push restrictive security configurations.

6. The office terminal security management method as described in claim 1, characterized in that, The office terminal security management method also includes: The location information of office terminals is obtained through the management platform, and the real-time location information of the office terminals is compared with the preset electronic fence: When the real-time location information of the office terminal exceeds the preset electronic fence, a location anomaly warning is triggered, and a restriction instruction is issued to restrict the network access or application access of the office terminal.

7. The office terminal security management method as described in claim 6, characterized in that, After triggering the location anomaly warning, the following is also included: Generate security alarm data and call the communication interface to push the security alarm data to the preset management terminal and the mobile terminal corresponding to the currently bound identity information; Receive anomaly cause reporting information and review instructions for the anomaly cause reporting information: If the audit instruction indicates authorized movement, then the restriction instruction is lifted; If the audit instruction indicates that it is unauthorized, it will be escalated to a security incident and traced and logged.

8. An office terminal security management device, characterized in that, The office terminal security management device includes: The encryption module is used to encrypt the unique identifier and initial security configuration information of the office terminal based on a hybrid encryption algorithm, and generate an encrypted tag containing ciphertext data, key ciphertext and key index, which corresponds to the office terminal. The decryption module is used to scan the encryption tag via a mobile terminal, upload the ciphertext data, key ciphertext, and key index to the management platform, and the management platform uses the key index to call the private key to decrypt the key ciphertext to obtain the office terminal encryption key and bind it to the unique identifier of the office terminal, thereby realizing the entry of the office terminal into the database. The control module is used to scan encrypted tags and bind identity information via mobile terminals. After the management platform verifies the identity information, it associates and binds the identity information with the unique identifier of the office terminal and the encryption key of the office terminal, and pushes the security configuration corresponding to the current identity information to the office terminal, thereby realizing the use of the office terminal.

9. An office terminal security management device, characterized in that, The office terminal security management device includes a processor, a memory, and an office terminal security management program stored in the memory and executable by the processor, wherein when the office terminal security management program is executed by the processor, it implements the steps of the office terminal security management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an office terminal security management program, wherein when the office terminal security management program is executed by a processor, it implements the steps of the office terminal security management method as described in any one of claims 1 to 7.

Images