Summary of the invention
For the deficiencies in the prior art, what the present invention proposed is a kind of sensitive data full life cycle management method of implanting based on finger print information, can prevent that sensitive information from passing through data file and disorderly passing and loss, can grasp the Life cycle state of this sensitive document by sensitive data management platform and the finger print information of implanting file comprehensively, reach the controlled effect to sensitive information.
The technical scheme that the present invention realizes is as follows:
A kind of sensitive data full life cycle management method of implanting based on finger print information, setting up under sensitive data management service end and the terminal monitoring client, in the client deploy filter Driver on FSD of processing the sensitive data file, its method is, at first, and the finger print information that pre-defines, when file writes or revises, filter Driver on FSD is resolved this document form, and content is scanned comprehensively, in case find responsive key word then generate the fingerprint rule according to the sensitive data operating strategy.Determine the position that fingerprint is implanted and carry out implant procedure according to the concrete form of file, then relevant information is sent to background data base behind the finger print information implantation success, realize the monitoring of sensitive document Life cycle by the sensitive document management platform, and show.
Finger print information implantation period for when the sensitive data file produces, when sensitive data is operated, the sensitive data transmission implants when landing or when the sensitive data storage.Can grasp the Life cycle state of this sensitive document by the finger print information of sensitive data management platform and implantation file comprehensively.
Further scheme of the present invention can be: described implantation finger print information hereof should comprise the key elements such as summary, terminal IP and MAC, identity information, the behavioural information of sensitive data part.
Further scheme of the present invention can be: the finger print information of described host-host protocol adopts the special purpose system algorithm to be encrypted.
Further scheme of the present invention can be: described fingerprint implantation position should reach is not maliciously deleted, is distorted, is forged texts, can seek a plurality of implantation positions and use dynamic algorithm to carry out the selection of implantation position.
Further scheme of the present invention can be: the finger print information of described implantation carried out completeness check before file uses, then file can't use when finger print information is destroyed.
The inventive method can realize following safe effect:
The present invention identifies and retrieval by responsive key word and keyword relevance linkage information, can prevent that sensitive information from passing through data file and disorderly passing and loss, reaches the controlled effect to sensitive information; In case the sensitive data File lose can be reviewed sensitive data by the finger print information management platform and lose generating source, review the compliance of sensitive document operation, be used for the evidence obtaining of investigating the responsible person concerned; And the implantation by finger print information, can grasp dynamically the distribution of the whole network sensitive information, reached comprehensive supervision of sensitive information; And by the association between the finger print information, can fully understand that this sensitive data file produces place, biography loser, recipient, user and final storage location, has reached the effect of sensitive data file Life cycle security management and control and supervision.
Embodiment
For technological means, creation characteristic that the present invention is realized, reach purpose and effect is easy to understand, below in conjunction with embodiment, further set forth the present invention.
Referring to Fig. 1, the full life cycle management method of the sensitive data file of implanting based on finger print information of the present invention is mainly used in monitoring and management sensitive data in lifecycle process such as generation, storage, operation, transmission and destructions.It comprises operational module, and this operational module comprises representing of filter Driver on FSD, keyword scan engine, finger print information generation, finger print information embedding, fingerprint information data storehouse and Life cycle.Setting up under sensitive data management service end and the terminal monitoring client, disposing client control software in terminal, carrying out on the one hand the strategy that service end pushes, on the other hand sensitive document is being carried out the fingerprint implantation and carries out information reporting.Dispose database service and set up corresponding database table in service end, dispose Web Application Server and be used for inquiry and obtain the relevant data information that the monitoring of data Life cycle is showed.Process the client deploy filter Driver on FSD of sensitive data file, by implant finger print information in the sensitive data file, the circulation process of tracking and monitoring fingerprint reaches the Life cycle monitoring of sensitive data file and the effect of management with this.Its step is as follows:
At first, the analyzing step of operation file; When operation file write or revises, filter Driver on FSD was resolved this operation file form; In the present embodiment, file system filter driver calls scanning engine, and scanning engine is determined file layout and resolve that next is inquired about responsive keyword scan demand and content is identified automatically.
Then, the generation step of fingerprint rule; Scan when filter Driver on FSD is resolved this operation file form and to content comprehensively, then carry out related information scanning if find the responsive key word that pre-defines, generate the fingerprint rule according to the sensitive data operating strategy, otherwise finish the implantation of finger print information.
Again, finger print information implantation step; Determine the position that finger print information is implanted and carry out implant procedure according to the concrete form of file; This implant procedure is to call fingerprint to implant the implantation that interface routine is finished finger print information, and the position that fingerprint is implanted has a plurality of, adopts dynamic algorithm to calculate implantation position, is not maliciously deleted, distorts and forge texts to reach; Wherein, the finger print information of host-host protocol adopts the special purpose system algorithm to be encrypted.The finger print information of implanting carried out completeness check before operation file uses, then operation file can't use when finger print information is destroyed.
In the present embodiment, finger print information comprises the summary info of sensitive data file, responsive rank, behavioural information, terminal wealth information (comprising IP, MAC, system's account), user's assets information (comprising address name, person in charge, user unit one belongs to and department) etc.The period that finger print information is implanted for when the sensitive data file produces, when sensitive data is operated, the sensitive data transmission implants when landing or when the sensitive data storage.
At last, uploading data storehouse and monitoring sensitive document Life cycle step; Then relevant information is sent to the database of sensitive data management platform behind the finger print information implantation success, and realize the monitoring of sensitive document Life cycle by the sensitive document management platform, and show.The database that this sensitive document management platform is the user by upper layer application supervisory routine and sensitive data management platform carries out alternately, realizes the Life cycle monitoring and management of sensitive data file.
Above-mentioned finger print information is implanted and specifically be may further comprise the steps:
1) terminal user operates the sensitive data file;
2) file system filter driver calls responsive keyword scan engine;
3) responsive keyword scan engine is automatically determined file layout and is resolved;
4) the responsive keyword scan demand of inquiry and content identified scanning;
5) have responsive key word then to the related information scanning of responsive key word as finding, go on foot otherwise carry out the 8th;
6) determine the sensitive document rank, query fingerprints creating info rules storehouse generates finger print information, and calls the functional interface of implanting finger print information by filter Driver on FSD;
7) with finger print information uploading data storehouse;
8) finishing finger print information implants.
The concrete operating procedure of client control software is as follows:
1) user's downloading service system data, generation sensitive data, editor's sensitivity data;
2) the client control software probe is to new data file;
3) the responsive keyword recognition of client control Bootload and search engine;
4) client control Bootload key word strategy and search strategy;
5) carry out keyword recognition and information retrieval;
6) according to result for retrieval, automatic acquisition terminal identity information and assets information;
7) according to the fingerprint create-rule, produce fingerprint;
8) implant fingerprint at the file assigned address;
9) generate the supplementary that is associated with fingerprint according to finger print information;
10) asynchronous finger print information and the supplementary uploaded is in the service end database.
For elaborating said method, now lift a typical interactive examples of present embodiment: when user's downloading service system data, operation sensitive data, client control software is implanted in the file according to content information and user's assets information generation finger print information, and in the database of the management end that reports.The system manager signs in to data security management and control platform and clicks inquiry system, can recognize which sensitive document is arranged in the current network, sensitive document at which station terminal circulated, and finally fell which station terminal, and whether the terminal that circulated exists sensitive document.
The present invention is by setting up sensitive data management service end and terminal monitoring client, sensitive data management service end is finished the management and control of the Life cycle of sensitive data, be used for issuing of strategy, issuing of rule, the analysis of finger print information etc., the terminal monitoring client is mainly used in carrying out the strategy that service end pushes, the operation of monitoring file, finger print information is installed, finger print information is uploaded etc., can grasp the Life cycle state of this sensitive document by the finger print information of sensitive data management platform and implantation file comprehensively, prevent that effectively sensitive information from passing through data file and disorderly passing and loss, reach the controlled effect to sensitive information; And review sensitive data by the finger print information management platform and lose generating source, review the compliance of sensitive document operation, be used for the evidence obtaining of investigating the responsible person concerned; And the implantation by finger print information, can grasp dynamically the distribution of the whole network sensitive information, reached comprehensive supervision of sensitive information; And by the association between the finger print information, can fully understand that this sensitive data file produces place, biography loser, recipient, user and final storage location, has reached the effect of sensitive data file Life cycle security management and control and supervision.
More than show and described ultimate principle of the present invention and principal character and advantage of the present invention.The technician of the industry should understand; the present invention is not restricted to the described embodiments; that describes in above-described embodiment and the instructions just illustrates principle of the present invention; without departing from the spirit and scope of the present invention; the present invention also has various changes and modifications, and these changes and improvements all fall in the claimed scope of the invention.The claimed scope of the present invention is defined by appending claims and equivalent thereof.