Sandbox-based file operation processing method, apparatus, and electronic device

Abstract

Provided in the embodiments of the present application are a sandbox-based file operation processing method, an apparatus, and an electronic device. The sandbox-based operation processing method comprises: an electronic device, in response to an access request for a DLP file, creating a first sandbox clone of a first application, and opening the DLP file by means of the first sandbox clone, and then, in response to a first operation, acquiring a second sandbox clone for processing the first operation, and processing the first operation by means of the second sandbox clone, the first sandbox clone being associated with the DLP file, and management and control policies of the first sandbox clone and the second sandbox clone being the same as a management and control policy of the DLP file. Therefore, the security of the DLP file can be ensured; in addition, the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and the plurality of sandbox clones working cooperatively can reserve an operating environment and configuration information of the DLP file, so as to facilitate scenario reproduction when the DLP file is opened next time by a managed and controlled user, thus improving user experience.

Description

Sandbox-based file operation processing method, device, and electronic device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 28, 2023, with application number 202311280981.5 and application name “Sandbox-based file operation processing method, device and electronic device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of the present application relate to the field of smart terminal technology, and in particular to a sandbox-based file operation processing method, device, and electronic device. Background Art

[0003] To ensure data security, many companies deploy data loss prevention (DLP) services within their internal networks.

[0004] Before files are transmitted, they can be encrypted locally and authorized by selecting a user list. During the processing, file encryption and decryption control can also be carried out by combining components such as file management, system capability management services, permission management services and / or user-mode file systems (fuse).

[0005] DLP management applications implement sandbox-level control by creating a sandbox clone of the application. Encrypted permissioned documents are only viewable within the sandbox clone of the authorized user. Furthermore, due to the permissions controlled within the sandbox environment, the transmission of encrypted permissioned documents is restricted. This security-focused design maximizes the protection of document data.

[0006] Due to the sandbox-based management and control, sandbox applications cannot launch other external applications to share data based on usage scenarios. Therefore, the collaborative processing of the same business by multiple applications will be restricted, especially for read-only documents.

[0007] Summary of the Invention

[0008] The present application provides a sandbox-based file operation processing method, device and electronic device. The present application also provides a computer-readable storage medium to enable processing of operations on DLP files through associated sandbox clones. The management and control policies of the associated sandbox clones are the same as those of the DLP files, ensuring the security of the DLP files. In addition, the associated sandbox clones can perform data communication and collaboratively process business, thereby restoring the user's last usage scene and improving the user experience.

[0009] In a first aspect, the present application provides a sandbox-based file operation processing method, including: in response to an access request for a data leakage protection DLP file, creating a first sandbox clone of a first application, and opening the DLP file through the first sandbox clone; wherein, the first sandbox clone is associated with the DLP file; in response to a first operation on the DLP file, obtaining a second sandbox clone for processing the first operation; wherein, the second sandbox clone includes a sandbox clone of a second application, and the control policy of the first sandbox clone and the second sandbox clone is the same as the control policy of the DLP file; and processing the first operation through the second sandbox clone.

[0010] In the above-mentioned sandbox-based operation processing method, the electronic device creates a first sandbox clone of the first application in response to an access request for the DLP file, opens the above-mentioned DLP file through the first sandbox clone, and then, in response to the first operation for the above-mentioned DLP file, obtains a second sandbox clone for processing the above-mentioned first operation, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone can be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the control strategy of the first sandbox clone and the second sandbox clone is the same as the control strategy of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones working together can retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time, thereby improving the user experience.

[0011] In one possible implementation, obtaining the second sandbox clone for processing the first operation includes: querying the sandbox clone associated with the first sandbox clone; in response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, creating the second sandbox clone, and associating the second sandbox clone with the first sandbox clone.

[0012] In one possible implementation, before obtaining the second sandbox clone that processes the first operation, it also includes: receiving a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file, and the first operation processing request is used to request the second sandbox clone to process the first operation.

[0013] In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone, obtaining a second application that monitors the first operation; and notifying the second application of the first operation.

[0014] In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, it also includes: determining whether the second application is a trusted application; if the second application is a trusted application, executing the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone.

[0015] In a possible implementation, determining whether the second application is a trusted application includes determining whether the second application is in a data table; wherein the data table stores configured trusted applications.

[0016] In one possible implementation, the first sandbox clone and the second sandbox clone constitute a sandbox group; the method further includes: in response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, the second operation processing request being used to request a third application to process the second operation; creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; and processing the second operation through the third sandbox clone.

[0017] In one possible implementation, after the second sandbox clone processes the first operation, the method further includes: detecting a write operation of the second sandbox clone on the DLP file; and in response to the write operation, the first sandbox clone reading the modified DLP file.

[0018] In one possible implementation, the first operation includes selecting the content of the DLP file by the first sandbox clone, and the DLP file is a read-only file; processing the first operation by the second sandbox clone includes translating the selected content in the DLP file by the second sandbox clone.

[0019] In a second aspect, the present application provides a document operation and processing device, which is included in an electronic device and has the function of implementing the electronic device behavior in the first aspect and possible implementations of the first aspect. The functions can be implemented through hardware or through hardware executing corresponding software implementations. The hardware or software includes one or more modules or units corresponding to the above functions. For example, a creation module, an opening module, an acquisition module, and a processing module.

[0020] In a third aspect, the present application provides an electronic device comprising: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, enable the electronic device to perform the method provided in the first aspect.

[0021] It should be understood that the second and third aspects of this application are consistent with the technical solutions of the first aspect of this application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here.

[0022] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the method provided in the first aspect.

[0023] In a fifth aspect, the present application provides a computer program, which, when executed by a computer, is used to execute the method provided in the first aspect.

[0024] In one possible design, the program in the fifth aspect may be stored in whole or in part on a storage medium packaged with the processor, or may be stored in whole or in part on a memory not packaged with the processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] FIG1 is a schematic structural diagram of an electronic device provided by an embodiment of the present application;

[0026] FIG2 is a schematic diagram of an application scenario of a sandbox-based operation processing method provided by an embodiment of the present application;

[0027] FIG3 is a diagram illustrating an implementation architecture of a sandbox-based operation processing method according to an embodiment of the present application;

[0028] FIG4 is a flowchart of a sandbox-based operation processing method provided by one embodiment of the present application;

[0029] FIG5 is a schematic diagram of a file owner configuring a trusted application according to an embodiment of the present application;

[0030] FIG6 is a schematic diagram of a first sandbox clone proactively requesting association with a second sandbox clone according to an embodiment of the present application;

[0031] FIG7 is a schematic diagram of an external application passively associating with a first sandbox clone according to an embodiment of the present application;

[0032] FIG8 is a schematic structural diagram of an electronic device provided in another embodiment of the present application;

[0033] FIG9 is a schematic structural diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0034] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0035] Currently, sandbox-based control mechanisms prevent sandbox applications from launching other external applications to share data based on usage scenarios. Therefore, the ability for multiple applications to collaboratively process the same business is limited, especially for read-only documents. Furthermore, existing sandbox mechanisms do not support the automatic configuration of the same control policy across multiple sandbox applications, and therefore cannot support multiple applications with the same policy collaborating on the same document. Furthermore, existing DLP technologies do not support sandbox applications launching external applications, especially read-only control. Furthermore, operations within sandbox applications are not perceived by external applications, preventing collaborative processing. This makes many common collaborative operation scenarios impossible for users, resulting in a poor user experience.

[0036] Based on the above problems, an embodiment of the present application provides a sandbox-based operation processing method, in which operations on DLP files are processed through associated sandbox clones, and the above-mentioned associated sandbox clones are managed by the DLP management application. The control strategy of the above-mentioned associated sandbox clones is the same as the control strategy of the DLP files, and the above-mentioned associated sandbox clones can share data, such as encrypted files, etc.; and, in an embodiment of the present application, the associated sandbox clone provides a monitoring interface to the outside world, and the events triggered by the associated sandbox clone can be monitored by external applications. The DLP management application can create a sandbox clone of the external application, and add the created sandbox clone of the external application to the above-mentioned associated sandbox clone to collaboratively process operations on DLP files.

[0037] The sandbox-based operation processing method provided in the embodiments of the present application can be applied to electronic devices, wherein the above-mentioned electronic devices can be smart phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks or personal digital assistants (PDAs) and other devices; the embodiments of the present application do not impose any restrictions on the specific types of electronic devices.

[0038] Exemplarily, Figure 1 is a structural diagram of an electronic device provided by an embodiment of the present application. As shown in Figure 1, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0039] It should be understood that the structures illustrated in the embodiments of the present application do not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0040] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). The different processing units may be independent devices or integrated into one or more processors.

[0041] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0042] Processor 110 may also include a memory for storing instructions and data. In some embodiments, the memory in processor 110 is a cache memory. This memory can store instructions or data that have just been used or are being recycled by processor 110. If processor 110 needs to use the same instruction or data again, it can directly access the memory. This avoids duplicate accesses, reduces processor 110 latency, and thus improves system efficiency.

[0043] For ease of understanding, the following embodiments of this application will take an electronic device having the structure shown in Figure 1 as an example, and combine the accompanying drawings and application scenarios to specifically explain the sandbox-based operation processing method provided in the embodiments of this application.

[0044] FIG2 is a schematic diagram of an application scenario for a sandbox-based operation processing method provided by one embodiment of the present application. In this embodiment, a DLP management application processes operations on DLP files through associated sandbox clones. As shown in FIG2 , to manage the associated sandbox clones, the DLP management application creates a sandbox group for the DLP files. The DLP management application manages the sandbox group corresponding to the DLP files and the lifecycle of the sandbox group. The control policy of the sandbox group is the same as the control policy of the DLP files. Applications subsequently added to the sandbox group are uniformly configured with the same control policy as the DLP files by the DLP management application. In FIG2 , application A is the first application to process the DLP files. In a specific implementation, the DLP management application creates a sandbox clone of application A and processes the DLP files through the sandbox clone of application A. The sandbox clone of application A and the DLP files are controlled by the same policy. After the DLP management application creates the sandbox group corresponding to the DLP files, it adds the sandbox clone of application A to the sandbox group. If application A needs application B to collaboratively process a business, application A can send a request to the DLP management application. The DLP management should query whether there is a sandbox clone of application B in the sandbox group. If there is a sandbox clone of application B in the sandbox group, the DLP management application will directly pull up the sandbox clone of application B, and the sandbox clone of application A and the sandbox clone of application B will share data and jointly process the business. If the sandbox clone of application A and the sandbox clone of application B also need application C when working together, the sandbox clone of application A or the sandbox clone of application B can send a request, and the DLP management application will query whether the sandbox clone of application C is in the sandbox group. If not, the DLP management application will create a sandbox clone of application C and add the sandbox clone of application C to the sandbox group for data sharing and collaborative processing of business.

[0045] Figure 3 is an implementation architecture diagram of a sandbox-based operation processing method provided by an embodiment of the present application. In Figure 3, the owner user of the document interacts with the DLP management application, sets the control policy and generates a DLP file for the corresponding document. The DLP management application creates a sandbox group corresponding to the DLP file, and configures the control policy of the sandbox group to be the same as the control policy set by the owner user. When a controlled user accesses the above-mentioned DLP document, application A needs to be used to collaboratively process the access request of the above-mentioned controlled user. The DLP management application creates a sandbox clone of application A and adds the sandbox clone of application A to the sandbox group corresponding to the above-mentioned DLP file. Through the above process, the DLP management application can add multiple external applications to the sandbox group, which can form a small system. Multiple sandbox applications working together can retain the operating environment and configuration information of the DLP file, making it convenient for the controlled user to reproduce the scene the next time he opens the DLP file.

[0046] This embodiment of the present application proposes a sandbox-based operation processing method that processes operations targeting DLP files through associated sandbox clones. Associated sandbox clones can share data and collaboratively process the same business. The DLP management application can associate sandbox clones in both active and passive ways, and provides a monitoring mechanism that allows external applications to monitor the operations of associated sandbox clones. This allows the DLP management application to associate with the sandbox clones of the monitoring external applications to collaboratively process operations targeting DLP files.

[0047] FIG4 is a flow chart of a sandbox-based operation processing method provided by one embodiment of the present application. The sandbox-based operation processing method provided by this embodiment can be implemented by a DLP management application in the electronic device 100. As shown in FIG4 , the sandbox-based operation processing method may include:

[0048] In step 401 , the electronic device 100 creates a first sandbox clone of a first application in response to an access request for a DLP file, and opens the DLP file through the first sandbox clone.

[0049] In some examples, the first sandbox clone is associated with the DLP file described above.

[0050] In step 402 , the electronic device 100 obtains a second sandbox clone for processing the first operation in response to the first operation on the DLP file.

[0051] In some examples, the second sandbox clone is a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policies of the above-mentioned DLP files. The control policies of DLP files may include: document access rights, document outbound rights, document automatic backup rights and / or document copy rights, etc. In this embodiment, the first sandbox clone is associated with the DLP file, and the second sandbox clone is associated with the first sandbox clone. In this way, the DLP file, the first sandbox clone and the second sandbox clone can form a small system. The collaborative work of multiple sandbox clones can retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene the next time he opens the DLP file.

[0052] In some examples, the first operation on the above-mentioned DLP file may include: selecting the content of the DLP file and requesting translation, or selecting the content of the DLP file and searching, etc., which is not limited in this embodiment. For example, after the electronic device 100 receives the access request for the DLP file from the controlled user, it creates a first sandbox clone of the first application and opens the above-mentioned DLP file through the first sandbox clone. During the process of the controlled user browsing the DLP file, there is a need to translate part of the content of the DLP file. Then, the controlled user can select the content to be translated in the DLP file and request translation of the selected content. Then, the operation of the controlled user selecting the content to be translated and requesting translation is the operation on the above-mentioned DLP file. Then, in response to this operation of the controlled user on the above-mentioned DLP file, the DLP management application obtains the second sandbox clone from the sandbox clone associated with the first sandbox clone, which can execute the translation of the selected content.

[0053] Referring to Figure 2 , to manage the sandbox clones associated with the first sandbox clone, the DLP management application on electronic device 100 can, after creating the first sandbox clone of the first application, create a sandbox group corresponding to the DLP file and add the first sandbox clone to the sandbox group. Then, in response to a first operation on the DLP file, the DLP management application retrieves a second sandbox clone from the sandbox group to handle the first operation.

[0054] In some examples, the electronic device 100 obtains the second sandbox clone for processing the above operations as follows: the electronic device 100 queries the sandbox clone associated with the first sandbox clone, and in response to the fact that the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application in the electronic device 100 creates the above-mentioned second sandbox clone and associates the second sandbox clone with the first sandbox clone.

[0055] In step 403 , the electronic device 100 processes the first operation through the second sandbox clone.

[0056] In some examples, after the electronic device 100 processes the first operation through the second sandbox clone, the electronic device 100 detects the write operation of the second sandbox clone on the DLP file. In response to the write operation, the first sandbox clone can read the modified DLP file.

[0057] In some examples, the first sandbox clone and the second sandbox clone can constitute a sandbox group; in this way, in response to the second operation on the above-mentioned DLP file, the electronic device 100 can receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone, and the above-mentioned second operation processing request is used to request a third application to process the above-mentioned second operation; then, the electronic device 100 creates a third sandbox clone of the above-mentioned third application, adds the third sandbox clone to the above-mentioned sandbox group, and processes the above-mentioned second operation through the third sandbox clone.

[0058] In some examples, referring to FIG5 , before the electronic device 100 creates the second sandbox clone and associates the second sandbox clone with the first sandbox clone, the electronic device 100 may also first determine whether the second application is a trusted application. If the second application is a trusted application, the electronic device 100 performs the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone. Specifically, the electronic device 100 may determine whether the second application is a trusted application by determining whether the second application is in a data table; wherein the data table stores configured trusted applications. The trusted application may be configured by the DLP file owner, as shown in FIG5 , which is a schematic diagram of a file owner configuring a trusted application according to one embodiment of the present application. Specifically, the file owner may configure the trusted application by storing the name or package name of the trusted application in a data table. In this way, the electronic device 100 may determine whether the name or package name of the second application is in the configured data table. If so, the electronic device 100 may determine that the second application is a trusted application. If the name or package name of the second application is not in the configured data table, the electronic device 100 may determine that the second application is not a trusted application. In addition, the file owner can also configure indication information of whether the application is a trusted application in the configuration file of the application installation package. In this way, the electronic device 100 can determine whether the second application is a trusted application based on the above indication information in the configuration file of the second application installation package.

[0059] In addition, whether the second application is a trusted application can also be determined by the application market review. If the second application passes the review of the application market, the electronic device 100 can determine that the second application is a trusted application; if the second application fails to pass the review of the application market, the electronic device 100 can determine that the second application is not a trusted application.

[0060] In this embodiment, the manner of associating the sandbox clones may include active and passive methods. The two joining methods are described below respectively.

[0061] In one implementation, before obtaining the second sandbox clone to handle the first operation, the electronic device 100 receives a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file. The first operation processing request is used to request the second sandbox clone to handle the first operation. In other words, the active method is for the first sandbox clone to actively request the DLP management application to create a second sandbox clone of the second application and associate the second sandbox clone with the first sandbox clone.

[0062] FIG6 is a schematic diagram of a first sandbox clone actively requesting to associate with a second sandbox clone, provided by an embodiment of the present application. As shown in FIG6 , the first sandbox clone actively requests the DLP management application in the electronic device 100 to launch the second application. The DLP management application first queries whether the sandbox clone of the second application (i.e., the second sandbox clone) is in the sandbox clone associated with the first sandbox clone. If the second sandbox clone exists in the sandbox clone associated with the first sandbox clone, the DLP management application directly launches the second sandbox clone and notifies the first sandbox clone that the second sandbox clone has been successfully launched. If the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application creates a second sandbox clone, associates the second sandbox clone with the first sandbox clone, launches the second sandbox clone, and notifies the first sandbox clone that the second sandbox clone has been successfully launched.

[0063] One application scenario of this implementation method is: when a document visitor with read-only permission uses the sandbox clone of Word (the first sandbox clone) to read a DLP document, the translation software needs to be translated collaboratively. The document visitor can actively initiate a translation request, and the sandbox clone of Word acts as the request initiator to request the DLP management application to pull up the translation software for collaborative work. The DLP management application queries whether there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of Word. If not, the DLP management application creates a sandbox clone of the translation software and associates the sandbox clone of the translation software with the sandbox clone of Word, and then translates the above-mentioned DLP document through the sandbox clone of the translation software; if there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of Word, the DLP management application directly pulls up the sandbox clone of the translation software without repeatedly creating the sandbox clone, and then translates the above-mentioned DLP document through the sandbox clone of the translation software. The control policy of the associated sandbox clone is the same as the control policy of the DLP file.

[0064] This implementation solves the problem that document visitors with read-only permissions cannot launch external applications for collaborative work, and ensures the security of data communication. Based on the existing DLP protection mechanism, it enables visitors to launch external applications in reasonable scenarios, greatly improving the visitor's user experience. In addition, the associated sandbox clones are subject to the same control policy, ensuring data security.

[0065] In another implementation, before creating a second sandbox clone and associating it with the first sandbox clone, if the second sandbox clone does not exist in the sandbox clones associated with the first sandbox clone, the electronic device 100 can obtain a second application that monitors the above operation and notify the second application of the above operation. In other words, the passive joining method is to allow the external application to passively join the sandbox clone associated with the first sandbox clone through the monitoring mechanism.

[0066] Figure 7 is a schematic diagram of an external application passively associating with a first sandbox clone provided by an embodiment of the present application. As shown in Figure 7, when the first sandbox clone triggers operation A for a DLP file, and the external second application is monitoring operation A through a monitoring mechanism, the DLP management application can notify the external second application that a usage scenario in the sandbox has triggered operation A, and the DLP management application can create a second sandbox clone for the external second application and associate the second sandbox clone with the first sandbox clone, and then the second sandbox clone works collaboratively with the first sandbox clone.

[0067] For example, after the electronic device 100 receives an access request for a DLP file from a user with read-only access permissions, it creates a first sandbox clone of the first application and opens the above DLP file through the first sandbox clone. Obviously, for the user with read-only access permissions, the DLP file is a read-only file. Assume that the DLP file is an English document, and the specific content may be as follows: "Some people, no matter how old they are, are always young; Some people, regardless of whether it is honor or disgrace, are calm and calm;..." The read-only access user needs to translate part of the content in the above English document. The read-only access user can use the mouse to select the content to be translated. Here, it is assumed that "Some people, regardless of whether it is honor or disgrace, are calm and calm;" is the part selected by the read-only access user with the mouse. The read-only access user requires the translation software to translate the selected sentence. Then, the read-only access user's operation of "selecting" this sentence with the mouse can be used as a trigger operation for the external translation software to monitor. After the external translation software monitors the above selection operation through the monitoring mechanism, the DLP management application creates a sandbox clone of the translation software, associates the sandbox clone of the translation software with the first sandbox clone, and then uses the sandbox clone of the translation software to translate the selected content in the above DLP file.

[0068] This implementation solves the problem that external applications cannot perceive the operations of applications within the sandbox. Through the monitoring mechanism, a sandbox clone of the external application can be created and associated with the sandbox clone of the application that opens the DLP file. The two work together to improve the user experience.

[0069] In the above-mentioned sandbox-based operation processing method, the electronic device 100 creates a first sandbox clone of the first application in response to an access request for the DLP file, opens the above-mentioned DLP file through the first sandbox clone, and then, in response to the first operation for the above-mentioned DLP file, obtains a second sandbox clone for processing the above-mentioned first operation, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone can be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the control strategy of the first sandbox clone and the second sandbox clone is the same as the control strategy of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones working together can retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time, thereby improving the user experience.

[0070] It is understood that some or all of the steps or operations in the above embodiments are merely examples, and the present application embodiments may also perform other operations or variations of various operations. In addition, the various steps may be performed in a different order than those presented in the above embodiments, and it is possible that not all of the operations in the above embodiments need to be performed.

[0071] It is understandable that, in order to realize the above functions, the electronic device includes hardware and / or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed in this application, this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to be beyond the scope of this application.

[0072] This embodiment can divide the electronic device into functional modules based on the above-mentioned method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0073] FIG8 is a schematic diagram of the structure of an electronic device provided in another embodiment of the present application. In the case where each functional module is divided according to each function, FIG8 shows a possible schematic diagram of the composition of an electronic device 800 involved in the above embodiment. As shown in FIG8 , the electronic device 800 may include: a creation module 801, an opening module 802, an acquisition module 803, and a processing module 804.

[0074] The creation module 801 is configured to create a first sandbox clone of the first application in response to an access request for the DLP file; wherein the first sandbox clone is associated with the DLP file;

[0075] An opening module 802 is configured to open the DLP file through the first sandbox clone;

[0076] An acquisition module 803 is configured to, in response to the first operation on the DLP file, acquire a second sandbox clone that processes the first operation; wherein the second sandbox clone includes a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file;

[0077] The processing module 804 is configured to process the first operation through the second sandbox clone.

[0078] It should be noted that all relevant contents of each step involved in the method embodiment shown in Figure 4 of the present application can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0079] The electronic device 800 provided in this embodiment is used to execute the sandbox-based operation processing method provided in the embodiment shown in Figure 4 of this application, and thus can achieve the same effect as the above method.

[0080] FIG9 is a schematic structural diagram of an electronic device provided in yet another embodiment of the present application. Compared with the electronic device shown in FIG8 , the difference is that the electronic device 900 shown in FIG9 may further include: a query module 805 and an association module 806;

[0081] The query module 805 is used to query the sandbox clones associated with the first sandbox clone;

[0082] The creation module 801 is further configured to create a second sandbox clone in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone;

[0083] The association module 806 is configured to associate the second sandbox clone with the first sandbox clone.

[0084] In some examples, the electronic device 800 may further include: a receiving module 807;

[0085] The receiving module 807 is used to receive a first operation processing request initiated by the first sandbox clone in response to the first operation on the above-mentioned DLP file before the acquisition module 803 obtains the second sandbox clone that processes the above-mentioned first operation, and the above-mentioned first operation processing request is used to request the second sandbox clone to process the above-mentioned first operation.

[0086] In some examples, the electronic device 800 may further include: a notification module 808;

[0087] The acquisition module 803 is further configured to acquire a second application that monitors the first operation in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone before the association module 806 associates the second sandbox clone with the first sandbox clone.

[0088] The notification module 808 is configured to notify the second application of the first operation.

[0089] In some examples, the electronic device 800 may further include: a determination module 809;

[0090] Determination module 809 is configured to determine whether the second application is a trusted application before association module 806 associates the second sandbox clone with the first sandbox clone. If the second application is a trusted application, creation module 801 and association module 806 execute the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone. In this embodiment, determination module 809 is specifically configured to determine whether the second application is in a data table; the data table stores configured trusted applications.

[0091] In this embodiment, the first sandbox clone and the second sandbox clone constitute a sandbox group; the receiving module 807 is further configured to receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone in response to the second operation on the DLP file, wherein the second operation processing request is used to request the third application to process the second operation;

[0092] The creation module 801 is further configured to create a third sandbox clone of the third application and add the third sandbox clone to the sandbox group.

[0093] The processing module 804 is further configured to process the second operation through the third sandbox clone.

[0094] In some examples, the first operation may include a selection operation of the first sandbox clone on the content of the above-mentioned DLP file, and the above-mentioned DLP file is a read-only file; thus, the processing module 804 is specifically used to translate the selected content in the above-mentioned DLP file through the second sandbox clone.

[0095] It should be noted that all relevant contents of each step involved in the method embodiments shown in Figures 4 to 7 of the present application can be referred to the functional description of the corresponding functional modules and will not be repeated here.

[0096] The electronic device 800 provided in this embodiment is used to execute the sandbox-based operation processing method provided in the embodiments shown in Figures 4 to 7 of this application, and thus can achieve the same effect as the above method.

[0097] It should be understood that the electronic device 800 may correspond to the electronic device 100 shown in Figure 1. Among them, the functions of the opening module 802, the acquisition module 803, the processing module 804, the association module 805, the receiving module 806, the acquisition module 807, the notification module 808 and the judgment module 809 may be implemented by the processor 110 in the electronic device 100 shown in Figure 1.

[0098] In the case of adopting an integrated unit, the electronic device 800 may include a processing module, a storage module, and a communication module.

[0099] The processing module can be used to control and manage the operation of the electronic device 800. For example, it can be used to support the electronic device 800 in executing the steps performed by the above modules. The storage module can be used to support the electronic device 800 in storing program code and data. The communication module can be used to support the electronic device 800 in communicating with other devices.

[0100] Among them, the processing module can be a processor or a controller, which can implement or execute the various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and so on. The storage module can be a memory. The communication module can specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip and / or a Wi-Fi chip.

[0101] In one embodiment, when the processing module is a processor and the storage module is a memory, the electronic device 800 involved in this embodiment may be a device having the structure shown in FIG. 1 .

[0102] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer-readable storage medium is run on a computer, the computer executes the method provided in the embodiments shown in Figures 4 to 7 of the present application.

[0103] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is run on a computer, the computer executes the method provided in the embodiments shown in Figures 4 to 7 of the present application.

[0104] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0105] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0107] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0108] The above description is merely a specific embodiment of the present application. Any person skilled in the art may easily conceive of variations or substitutions within the technical scope disclosed in this application, and such variations or substitutions shall be within the scope of protection of this application. The scope of protection of this application shall be subject to the scope of protection of the claims.

Claims

1. A sandbox-based file operation processing method, characterized in that: include: In response to an access request for a data leakage prevention (DLP) file, create a first sandbox clone of a first application, and open the DLP file through the first sandbox clone; wherein the first sandbox clone is associated with the DLP file; In response to a first operation on the DLP file, obtaining a second sandbox clone that processes the first operation; wherein the second sandbox clone includes a sandbox clone of a second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file; The first operation is processed by the second sandbox clone.

2. The method according to claim 1, characterized in that The obtaining of a second sandbox clone for processing the first operation comprises: Querying the sandbox clone associated with the first sandbox clone; In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, the second sandbox clone is created and associated with the first sandbox clone.

3. The method according to claim 1, characterized in that Before obtaining the second sandbox clone that processes the first operation, the method further includes: In response to a first operation on the DLP file, a first operation processing request initiated by the first sandbox clone is received, where the first operation processing request is used to request a second sandbox clone to process the first operation.

4. The method according to claim 2, characterized in that: Before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, obtaining a second application that monitors the first operation; The second application is notified of the first operation.

5. The method according to any one of claims 2 to 4, characterized in that: Before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: Determining whether the second application is a trusted application; If the second application is a trusted application, the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone are performed.

6. The method according to claim 5, characterized in that The determining whether the second application is a trusted application includes: Determine whether the second application is in a data table; wherein the data table stores configured trusted applications.

7. The method according to claim 1, characterized in that The first sandbox clone and the second sandbox clone constitute a sandbox group; the method further includes: In response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, where the second operation processing request is used to request a third application to process the second operation; Creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; The second operation is processed by the third sandbox clone.

8. The method according to claim 1, characterized in that After the second sandbox clone processes the first operation, the method further includes: Detecting a write operation of the second sandbox clone on the DLP file; In response to the write operation, the first sandbox clone reads the modified DLP file.

9. The method according to claim 1, characterized in that: The first operation includes a selection operation of the first sandbox clone on the content of the DLP file, and the DLP file is a read-only file; Processing the first operation by the second sandbox clone includes: The selected content in the DLP file is translated by the second sandbox clone.

10. An electronic device, characterized in that: include: one or more processors; Memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, enable the electronic device to perform the method as described in any one of claims 1-9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 9.

Images