CN102968600B - Full life-cycle management method for sensitive data file based on fingerprint information implantation - Google Patents

Full life-cycle management method for sensitive data file based on fingerprint information implantation Download PDF

Info

Publication number
CN102968600B
CN102968600B CN201210424071.5A CN201210424071A CN102968600B CN 102968600 B CN102968600 B CN 102968600B CN 201210424071 A CN201210424071 A CN 201210424071A CN 102968600 B CN102968600 B CN 102968600B
Authority
CN
China
Prior art keywords
sensitive
implantation
finger print
file
print information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201210424071.5A
Other languages
Chinese (zh)
Other versions
CN102968600A (en
Inventor
从正海
杨维永
刘金锁
黄益彬
朱世顺
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Corp of China SGCC
Nari Technology Co Ltd
State Grid Electric Power Research Institute
Original Assignee
State Grid Corp of China SGCC
Nanjing NARI Group Corp
State Grid Electric Power Research Institute
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Corp of China SGCC, Nanjing NARI Group Corp, State Grid Electric Power Research Institute filed Critical State Grid Corp of China SGCC
Priority to CN201210424071.5A priority Critical patent/CN102968600B/en
Publication of CN102968600A publication Critical patent/CN102968600A/en
Priority to PCT/CN2013/086011 priority patent/WO2014067428A1/en
Application granted granted Critical
Publication of CN102968600B publication Critical patent/CN102968600B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/64Protecting data integrity, e.g. using checksums, certificates or signatures

Abstract

The invention discloses a full life-cycle management method for a sensitive data file based on fingerprint information implantation. The method comprises the steps of: implanting the pre-defined fingerprint information to an electronic data file through a file filter driver and uploading the implanting condition of the fingerprint information to a database of a sensitive data management platform; and monitoring and displaying the full life-cycle of the sensitive file through the sensitive data management platform. The method provided by the invention is mainly used to monitor and manage the full life-cycle process of the sensitive data such as generation, storage, operation, transmission and destroy, so that the effects of monitoring and managing the full life-cycle of the sensitive data file is realized and the sensitive information is prevented from being diffused disorderly and missing through the data file, so as to realize the effect of controlling the sensitive information. A missing generation source of the sensitive data can be traced through a fingerprint information management platform and the compliance of operation of the sensitive file is traced to take the evidence for investigating associated persons in charge, so as to monitor the sensitive information completely.

Description

A kind of lifecycle management of the sensitive data file based on finger print information implantation Method
Technical field
The present invention relates to the data safety protection of field of information security technology, more particularly to one kind is based on finger print information plant The full life cycle management method of the sensitive data file entering.
Background technology
Developing rapidly with computer technology, information system application deeply extensively, and is applied to every field.But with And come to create sensitive data leakage safety problem, to have sensitive data e-file produce, transmission, circulation cannot Management and control.
In concerning security matters unit or large enterprise, widely implement safety prevention measure, including computer room safety, network every From, fire wall, intrusion detection, encrypted transmission identity authorization system etc..But there is the safety problem of sensitive information data but Always cannot due attention.Meanwhile, market before also lacks effective sensitive data full life cycle management method.
Content of the invention
For the deficiencies in the prior art, proposed by the present invention is a kind of full life of sensitive data based on finger print information implantation Cycle management method, can prevent sensitive information from disorderly passing by data file and running off, by sensitive data management platform and plant The finger print information entering file can grasp the Life cycle state of this sensitive document comprehensively, reaches the controlled effect to sensitive information Really.
The technical scheme that the present invention realizes is as follows:
A kind of sensitive data full life cycle management method based on finger print information implantation, is setting up sensitive data management clothes Under business end and terminal monitoring client, the client processing sensitive data file disposes filter Driver on FSD, its method is, First, the finger print information pre-defining, in file write or modification, filter Driver on FSD solves to this document form Analysis, and content is scanned comprehensively, once finding sensitive keys word, fingerprint rule is generated according to sensitive data management strategy. The position of fingerprint implantation is determined according to the concrete form of file and executes implant procedure, then by correlation after finger print information implantation success Information is sent to background data base, realizes the monitoring of sensitive document Life cycle by sensitive document management platform, and carries out Display.
Finger print information implantation period be when sensitive data file produces, when sensitive data is operated, Sensitive data transmission is implanted with when landing or when sensitive data stores.By sensitive data management platform and plant The finger print information entering file can grasp the Life cycle state of this sensitive document comprehensively.
The further scheme of the present invention can be:Described implantation finger print information hereof should comprise sensitive data portion Summary, terminal IP and the key element such as MAC, identity information, behavioural information dividing.
The further scheme of the present invention can be:The finger print information of described host-host protocol carries out adding using special purpose system algorithm Close.
The further scheme of the present invention can be:Described fingerprint implantation position should reach maliciously do not deleted, distorted, pseudo- Make and other effects, multiple implantation positions can be found and carry out the selection of implantation position using dynamic algorithm.
The further scheme of the present invention can be:The finger print information of described implantation carried out integrity before file use Verification, when finger print information is destroyed, then file cannot use.
The inventive method can realize following safe effect:
The present invention passes through sensitive keys word and keyword relevance linkage information identification and retrieval, can prevent sensitive information from passing through to count Disorderly pass according to file and run off, reach the controlled effect to sensitive information;Once sensitive data file is lost, can be believed by fingerprint Breath management platform is reviewed sensitive data and is lost occurring source, reviews the compliance of sensitive document operation, is used for investigating responsible person concerned Evidence obtaining;And by the implantation of finger print information, can dynamically grasp the distribution of the whole network sensitive information, reach sensitive letter Comprehensive supervision of breath;And by the association between finger print information, can fully understand that this sensitive data file produces place, biography Loser, receiver, user and final storage location, have reached sensitive data file Life cycle security management and control and supervision Effect.
Brief description
The schematic flow sheet of Fig. 1 present invention.
Specific embodiment
Technological means, creation characteristic, reached purpose and effect for making the present invention realize are easy to understand, with reference to Specific embodiment, is expanded on further the present invention.
Referring to Fig. 1, the full life cycle management method of the sensitive data file based on finger print information implantation of the present invention, master It is used for monitoring and manage sensitive data in lifecycle process such as generation, storage, operation, transmission and destructions.It includes work Make module, this operational module includes filter Driver on FSD, keyword scan engine, finger print information generates, finger print information embeds, refers to The representing of stricture of vagina information database and Life cycle.Under setting up sensitive data management service end and terminal monitoring client, Terminal disposition client control software, the strategy that on the one hand execution service end pushes, on the other hand fingerprint is carried out to sensitive document Implant row information of going forward side by side to report.Dispose database service in service end and set up corresponding database table, dispose Web application service Device is used for inquiring about and obtains the relevant data message that the monitoring of data Life cycle is shown.Process the client of sensitive data file Upper deployment filter Driver on FSD, by sensitive data file implant finger print information, the circulation process of tracking and monitoring fingerprint, The effect of the Life cycle monitoring to sensitive data file and management is reached with this.Its step is as follows:
First, the analyzing step of operation file;In operation file write or modification, filter Driver on FSD is to this operation literary composition Part form is parsed;In the present embodiment, file system filter driver calls scanning engine, and scanning engine automatically determines tray Formula is simultaneously parsed, and secondly inquiry sensitive keys word scans demand and content is identified.
Then, the generation step of fingerprint rule;While filter Driver on FSD parses to this operation file form simultaneously Content being scanned comprehensively, if finding the sensitive keys word pre-defining, being executed related information scanning, according to sensitive number Generate fingerprint rule according to management strategy, otherwise terminate the implantation of finger print information.
Again, finger print information implantation step;The position of finger print information implantation is determined according to the concrete form of file and executes Implant procedure;This implant procedure is to call fingerprint to implant the implantation that interface routine completes finger print information, the position tool of fingerprint implantation Have multiple, implantation position is calculated using dynamic algorithm, maliciously do not deleted, distort and forge and other effects to reach;Wherein, transmit The finger print information of agreement is encrypted using special purpose system algorithm.The finger print information of implantation had been carried out before operation file use Whole property verification, when finger print information is destroyed, then operation file cannot use.
In the present embodiment, finger print information includes the summary info of sensitive data file, sensitivity rank, behavioural information, terminal Assets information(Including IP, MAC, system account), user's assets information(Including address name, person in charge, user unit one belongs to And department)Deng.Finger print information implantation period be when sensitive data file produces, sensitive data is operated when Wait, sensitive data transmission is implanted with when landing or when sensitive data stores.
Finally, data base and monitoring sensitive document Life cycle step are uploaded;Then by phase after finger print information implantation success Pass information is sent to the data base of sensitive data management platform, and realizes the full life of sensitive document by sensitive document management platform The monitoring in cycle, and shown.This sensitive document management platform is that user passes through upper layer application management program and sensitive data The data base of management platform interacts, and realizes Life cycle monitoring and the management of sensitive data file.
Above-mentioned finger print information implantation specifically includes following steps:
1)End users operation sensitive data file;
2)File system filter driver calls sensitive keys word scanning engine;
3)Sensitive keys word scanning engine automatically determines file format and is parsed;
4)Inquiry sensitive keys word scanning demand simultaneously is identified to content scanning;
5)As found, having sensitive keys word then scans to the related information of sensitive keys word, otherwise executes the 8th step;
6)Determine sensitive document rank, inquiry finger print information create-rule storehouse generates finger print information, and passes through file filter Drive the functional interface calling implantation finger print information;
7)Finger print information is uploaded data base;
8)Complete finger print information implantation.
Client control software carrying out practically step is as follows:
1)User's downloading service system data, generation sensitive data, editor's sensitivity data;
2)Client control software probe is to new data file;
3)Client control software loads the identification of sensitive keys word and search engine;
4)Client control software loads keyword strategy and search strategy;
5)Execution keyword recognition and information retrieval;
6)According to retrieval result, automatically obtain terminal identity information and assets information;
7)According to fingerprint create-rule, produce fingerprint;
8)Implant fingerprint in file specified location;
9)The auxiliary information being associated with fingerprint is generated according to finger print information;
10)Asynchronous upload finger print information and auxiliary information are in service client database.
For elaborating said method, now lift typical interactive examples of the present embodiment:User's downloading service system When data, operation sensitive data, client control software generates finger print information implantation according to content information and user's assets information To in file, and in the data base of the management end reporting.System manager signs in data safety control platform and clicks on inquiry system It can be realized that there being which sensitive document in current network, sensitive document flows through in which station terminal system, and which eventually falls in Station terminal, and the terminal flowing through is with the presence or absence of sensitive document.
The present invention is complete by setting up sensitive data management service end and terminal monitoring client, sensitive data management service end Become the management and control of the Life cycle of sensitive data, for tactful issue, the issuing of rule, the analysis of finger print information etc., terminal Monitor client is mainly used in executing the strategy that service end pushes, the operation of monitoring file, installs finger print information, on finger print information Pass etc., the full Life Cycle of this sensitive document can be grasped by the finger print information of sensitive data management platform and implantation file comprehensively Phase state, is effectively prevented sensitive information from disorderly being passed by data file and running off, reaches the controlled effect to sensitive information;And Sensitive data is reviewed by finger print information management platform and loses occurring source, review the compliance of sensitive document operation, be used for investigating The evidence obtaining of responsible person concerned;And by the implantation of finger print information, can dynamically grasp the distribution of the whole network sensitive information, reach Arrive comprehensive supervision of sensitive information;And by the association between finger print information, this sensitive data file can be fully understanded Produce place, pass loser, receiver, user and final storage location, reach sensitive data file Life cycle safety Management and control and the effect monitoring.
Ultimate principle and principal character and the advantages of the present invention of the present invention have been shown and described above.The technology of the industry , it should be appreciated that the present invention is not restricted to the described embodiments, the simply explanation described in above-described embodiment and description is originally for personnel The principle of invention, without departing from the spirit and scope of the present invention, the present invention also has various changes and modifications, these changes Change and improvement both falls within scope of the claimed invention.Claimed scope by appending claims and its Equivalent thereof.

Claims (1)

1. a kind of management method of the Life cycle of the sensitive data file based on finger print information implantation, is setting up sensitive data Under management service end and terminal monitoring client, the client processing sensitive data file disposes filter Driver on FSD, its It is characterised by, its method is:First, the analyzing step of operation file;In operation file write or modification, filter Driver on FSD This operation file form is parsed;
Then, the generation step of fingerprint rule;While described filter Driver on FSD parses to this operation file form simultaneously Content being scanned comprehensively, if finding the sensitive keys word pre-defining, being executed related information scanning, according to sensitive number Generate fingerprint rule according to management strategy, otherwise terminate the implantation of finger print information;
Again, finger print information implantation step;The position of finger print information implantation is determined according to the concrete form of file and executes implantation Operation;
Finally, data base and monitoring sensitive document Life cycle step are uploaded;Then by related letter after finger print information implantation success Breath is sent to the data base of sensitive data management platform, and realizes sensitive document Life cycle by sensitive document management platform Monitoring, and shown, in the analyzing step of described operation file, described filter Driver on FSD is by calling sensitive keys Word scanning engine, sensitive keys word scanning engine automatically determines operation file form and is parsed, the life of described fingerprint rule Become in step, sensitive keys word scanning engine inquiry sensitive keys word simultaneously scans demand and operation file content is identified; If finding sensitive keys word, executing related information scanning, determining sensitive document rank again and generating the fingerprint letter of this document Breath;
In described finger print information implantation step, the position of described fingerprint implantation has multiple finger print information implantation positions, using dynamic State algorithm calculates implantation position;
In described finger print information implantation step, the scanning result according to execution related information scanning and fingerprint production rule produce and refer to Stricture of vagina information, calls fingerprint to implant the implantation that interface routine completes finger print information;
Above-mentioned upload data base and monitoring sensitive document Life cycle step in, user pass through upper layer application management program with quick The data base of sense data management platform interacts, and realizes Life cycle monitoring and the management of sensitive data file;
Described finger print information includes the summary info of sensitive data file, sensitivity rank, behavioural information, terminal wealth information, use Family assets information;
The period of described finger print information implantation be when sensitive data file produces, sensitive data is operated when Wait, sensitive data transmission is implanted with when landing or when sensitive data stores;
The finger print information of described implantation carried out completeness check before file use, then operated when finger print information is destroyed File cannot use.
CN201210424071.5A 2012-10-30 2012-10-30 Full life-cycle management method for sensitive data file based on fingerprint information implantation Active CN102968600B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201210424071.5A CN102968600B (en) 2012-10-30 2012-10-30 Full life-cycle management method for sensitive data file based on fingerprint information implantation
PCT/CN2013/086011 WO2014067428A1 (en) 2012-10-30 2013-10-25 Full life-cycle management method for sensitive data file based on fingerprint information implantation

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201210424071.5A CN102968600B (en) 2012-10-30 2012-10-30 Full life-cycle management method for sensitive data file based on fingerprint information implantation

Publications (2)

Publication Number Publication Date
CN102968600A CN102968600A (en) 2013-03-13
CN102968600B true CN102968600B (en) 2017-02-15

Family

ID=47798736

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201210424071.5A Active CN102968600B (en) 2012-10-30 2012-10-30 Full life-cycle management method for sensitive data file based on fingerprint information implantation

Country Status (2)

Country Link
CN (1) CN102968600B (en)
WO (1) WO2014067428A1 (en)

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102968600B (en) * 2012-10-30 2017-02-15 国网电力科学研究院 Full life-cycle management method for sensitive data file based on fingerprint information implantation
CN103514390A (en) * 2013-09-18 2014-01-15 吴先洪 Method and device for data self-destroying and digital device
CN103973708B (en) * 2014-05-26 2018-09-07 中电长城网际系统应用有限公司 A kind of determination method and system for the event that leaks
CN105824812B (en) * 2015-01-04 2019-07-30 北京神州泰岳信息安全技术有限公司 The automatic identifying method and device of file type sensitive data
US9892269B2 (en) 2015-06-11 2018-02-13 Qualcomm Incorporated Techniques for data monitoring to mitigate transitive problem in object-oriented contexts
EP3716126B1 (en) * 2015-10-23 2022-08-24 Oracle International Corporation Automatic operation detection on protected field with support for federated search
CN106446215A (en) * 2016-09-30 2017-02-22 广州特道信息科技有限公司 Internet big data evidence collecting system
CN108632318B (en) * 2017-03-21 2022-02-22 腾讯科技(深圳)有限公司 Data verification method, data sending method, related device and system
CN107483422B (en) * 2017-08-03 2020-10-27 深信服科技股份有限公司 Data leakage tracing method and device and computer readable storage medium
CN107577939B (en) * 2017-09-12 2020-11-06 中国石油集团川庆钻探工程有限公司 Data leakage prevention method based on keyword technology
CN108449324B (en) * 2018-02-14 2021-05-14 北京明朝万达科技股份有限公司 Method and system for safely exchanging data between networks
CN108900474A (en) * 2018-06-05 2018-11-27 苏州科达科技股份有限公司 The transmission method of sensitive information, device and electronic equipment
CN109522423B (en) * 2018-11-01 2020-12-11 深圳市商舟网科技有限公司 Fingerprint implanting and information identifying method, device, computer equipment and storage medium
CN109697346B (en) * 2018-11-29 2021-03-23 合肥工业大学 Government affair file management system based on big data
CN110135128A (en) * 2019-05-22 2019-08-16 北京明朝万达科技股份有限公司 A kind of document handling method and device
CN110704873B (en) * 2019-09-25 2021-05-25 全球能源互联网研究院有限公司 Method and system for preventing sensitive data from being leaked
CN111159703B (en) * 2019-12-31 2022-12-06 奇安信科技集团股份有限公司 Virtual machine data leakage detection method and device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101401061A (en) * 2005-05-09 2009-04-01 普罗维拉公司 Cascading security architecture
CN101430752A (en) * 2008-12-22 2009-05-13 哈尔滨工业大学 Sensitive data switching control module and method for computer and movable memory device
CN102006302A (en) * 2010-12-03 2011-04-06 中国软件与技术服务股份有限公司 Method for identifying security classification of electronic file

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7444355B1 (en) * 2003-09-30 2008-10-28 Emc Corporation System and method for assigning management responsibility for manageable entities
US8161526B2 (en) * 2007-10-22 2012-04-17 International Business Machines Corporation Protecting sensitive information on a publicly accessed data processing system
CN102004883B (en) * 2010-12-03 2012-06-13 中国软件与技术服务股份有限公司 Trace tracking method for electronic files
CN102054027A (en) * 2010-12-13 2011-05-11 宇龙计算机通信科技(深圳)有限公司 Storing and searching method of mobile terminal file, system and mobile terminal
CN102968600B (en) * 2012-10-30 2017-02-15 国网电力科学研究院 Full life-cycle management method for sensitive data file based on fingerprint information implantation

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101401061A (en) * 2005-05-09 2009-04-01 普罗维拉公司 Cascading security architecture
CN101430752A (en) * 2008-12-22 2009-05-13 哈尔滨工业大学 Sensitive data switching control module and method for computer and movable memory device
CN102006302A (en) * 2010-12-03 2011-04-06 中国软件与技术服务股份有限公司 Method for identifying security classification of electronic file

Also Published As

Publication number Publication date
WO2014067428A1 (en) 2014-05-08
CN102968600A (en) 2013-03-13

Similar Documents

Publication Publication Date Title
CN102968600B (en) Full life-cycle management method for sensitive data file based on fingerprint information implantation
CN105868635B (en) Method and apparatus for coping with Malware
CN104137114B (en) Centralized operation management
JP5191376B2 (en) Risk-based authentication system, risk information acquisition server, and risk-based authentication method
US20090055443A1 (en) Recording a Log of Operations
US11769010B2 (en) Document management workflow for redacted documents
US20130042306A1 (en) Determining machine behavior
US8204949B1 (en) Email enabled project management applications
KR20070054391A (en) Apparatus and method for blocking access to phishing web page
CN106874461A (en) A kind of workflow engine supports multi-data source configuration security access system and method
US20200081927A1 (en) Automated accessibility testing
CN109005142B (en) Website security detection method, device, system, computer equipment and storage medium
CN106445485A (en) Software version consistency detection system and detection method thereof
CN106650799A (en) Electronic evidence classification extraction method and system
ATE467970T1 (en) INPUT AND OUTPUT VALIDATION TO PROTECT DATABASE SERVERS
CN107292770A (en) A kind of construction information management method and system based on planar bar code technology
KR20170101624A (en) System for monitoring digital contents and method for processing thereof
KR102022058B1 (en) Method and system for detecting counterfeit of web page
CN107818264B (en) Environment-friendly public welfare activity monitoring method and device and computer readable storage medium
KR20130093230A (en) System for detecting and managing copyright infringement contents on web
CN114996675A (en) Data query method and device, computer equipment and storage medium
CN111627539A (en) System, equipment and medium for evaluating posts of functional departments
TW201126367A (en) Detection methods and devices of web mimicry attacks
US7987513B2 (en) Data-use restricting method and computer product
CN112650659B (en) Buried point setting method and device, computer equipment and storage medium

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20171127

Address after: Nan Shui Road Gulou District of Nanjing city of Jiangsu Province, No. 8 210003

Co-patentee after: NARI Technology Development Co., Ltd.

Patentee after: State Grid Electric Power Research Insititute

Co-patentee after: State Grid Corporation of China

Address before: Nan Shui Road Gulou District of Nanjing city of Jiangsu Province, No. 8 210003

Co-patentee before: Nanjing Nari Co., Ltd.

Patentee before: State Grid Electric Power Research Insititute

Co-patentee before: State Grid Corporation of China