CN111046403A

CN111046403A - Electronic document safety management system

Info

Publication number: CN111046403A
Application number: CN201911243082.1A
Authority: CN
Inventors: 成佳鑫
Original assignee: Xi'an Heguangchen Technology Co Ltd
Current assignee: Xi'an Heguangchen Technology Co Ltd
Priority date: 2019-12-06
Filing date: 2019-12-06
Publication date: 2020-04-21

Abstract

The invention discloses an electronic document security management system, which comprises a control module, a server and a client, wherein the client comprises a file driving transparent encryption and decryption module which is used for detecting whether secret-related data exist or not and carrying out corresponding encryption and decryption processing on the secret-related data according to a security strategy; a clipboard control module for restricting any copying, clipboard operations from a trusted process to an untrusted process; and the process identification module is used for extracting the process related information, judging the legality of the process according to the process related information, allowing the corresponding operation if the process is legal, and rejecting the corresponding operation if the process is not legal. The invention takes data security as a core, establishes an all-dimensional file data information security management system covering the life cycle and the application range of the file, and can effectively prevent information leakage caused by non-subjective events such as hacker intrusion, loss of storage media and the like. The invention introduces the file driving transparent encryption and decryption module, thereby improving the safety of the electronic document.

Description

Electronic document safety management system

Technical Field

The invention belongs to the technical field of computer document security, and relates to an electronic document security management system.

Background

With the development of computer technology and office automation technology, electronic file archives have come into play. Electronic documents and electronic files are documents and files generated in digital equipment and environment, stored in digital form on carriers such as magnetic tapes, magnetic disks, optical disks and the like, read and processed by digital equipment such as one year computers and the like, and transmitted over a communication network. The advent of electronic documents has moved files and archives from "tangible" to "intangible" and has brought vitality and vitality to the work of archives, but at the same time has also presented new challenges to the work of archives. Among them, the security and confidentiality problems of electronic documents are a new issue facing archive workers.

The computer network is an open system, and many application systems are often in an unprotected state. The computer network has the characteristic of wide area, and the information resources in the computer network have the characteristics of density, sharing and public property, which provide a possible opportunity for various harassment and destructive behaviors such as information stealing, embezzlement and the like, and bring great risk to the confidentiality of electronic documents. For electronic documents, whether they are circulation and approval or filing and utilization, the whole circulation process needs to be carried out on the network, and the dependence on the computer system is strong. Electronic documents face serious network security privacy concerns. To ensure the security of electronic documents, effective security measures should be taken in the managed computer system.

Security of electronic documents involves many factors. It puts more demands on management and technology, software and hardware, etc. The archive workers should continuously summarize experience and training in the working practice, so that the electronic document management work gradually goes to scientification and systematization, operates in the same, efficient and safe environment, and serves the public.

Disclosure of Invention

The invention aims to provide an electronic document security management system, which introduces a file drive transparent encryption and decryption module and improves the security of an electronic document.

The technical scheme adopted by the invention is that the electronic document safety management system comprises a control module, a server and a client; the control module is used for storing the security control management strategy, determining whether the client and the server are bound or not, and sending the security control management strategy to the bound client; the server is used for receiving the binding request of the client and completing the binding with the client by the authorization of the security management control module; the client comprises a file driving transparent encryption and decryption module, a clipboard control module and a process identification module; the file driving transparent encryption and decryption module is used for detecting whether the operation of the confidential data exists according to the security control management strategy and carrying out corresponding encryption and decryption processing on the confidential data; a clipboard control module for restricting any copying, clipboard operations from a trusted process to an untrusted process according to a security control management policy; and the process identification module is used for extracting process related information according to the security control management strategy, judging the legality of the process according to the process related information, if the process is legal, allowing the corresponding operation, and otherwise, rejecting the corresponding operation.

The present invention is also characterized in that,

the trusted process is an application program protected by the file-driven transparent encryption and decryption module, and the untrusted process is an application program unprotected by the file-driven transparent encryption and decryption module.

The file driving transparent encryption and decryption module is used for driving and judging an encrypted target address issued by a strategy at a network layer, judging whether to encrypt or not by a driver when a user accesses a certain application system, monitoring a browser at a client, and once a file is stored or downloaded additionally, starting to encrypt: when uploading the locally delivered document to the application system server, the client side judges and monitors to upload the decrypted document to the server.

The client user can utilize the system to encrypt own files, the files are authorized according to the role distribution, the files are uploaded to the FTP server to be stored, the user with administrator authority can authorize common users to enable the common users to operate the encrypted files in an off-line state, meanwhile, when the electronic document online security system is opened, the documents needing to be protected are protected, the unauthorized users are prevented from opening, modifying, moving and the like, the behaviors of the users for operating the documents are recorded, and the client uses java swing to write and compile the documents

The control module controls the editing, copying and storing of the outgoing file, and can selectively control the access of external users.

The electronic document security management system provided by the invention has the beneficial effects that the data security is taken as a core, an omnibearing file data information security management system covering the life cycle and the application range of a file is established, and information leakage caused by non-subjective events such as hacker intrusion, storage medium loss and the like can be effectively prevented. The invention realizes the security of the document, introduces the control module and improves the security of the electronic document.

Detailed Description

The present invention will be described in detail with reference to the following embodiments.

The system comprises a control module, a server and a client; the control module is used for storing the security control management strategy, determining whether the client and the server are bound or not, and sending the security control management strategy to the bound client; the server is used for receiving the binding request of the client and completing the binding with the client by the authorization of the security management control module; the client comprises a file driving transparent encryption and decryption module, a clipboard control module and a process identification module; the file driving transparent encryption and decryption module is used for detecting whether the operation of the confidential data exists according to the security control management strategy and carrying out corresponding encryption and decryption processing on the confidential data; the clipboard control module is used for limiting any copying and clipping operations from the trusted process to the untrusted process according to the security control management strategy, wherein the trusted process is an application program protected by the file-driven transparent encryption and decryption module, and the untrusted process is an application program not protected by the file-driven transparent encryption and decryption module; and the process identification module is used for extracting process related information according to the security control management strategy, judging the legality of the process according to the process related information, if the process is legal, allowing the corresponding operation, and otherwise, rejecting the corresponding operation.

Claims

1. The electronic document security management system is characterized by comprising a control module, a server and a client; the control module is used for storing the security control management strategy, determining whether the client and the server are bound or not, and sending the security control management strategy to the bound client; the server is used for receiving the binding request of the client and completing the binding with the client by the authorization of the security management control module; the client comprises a file driving transparent encryption and decryption module, a clipboard control module and a process identification module; the file driving transparent encryption and decryption module is used for detecting whether the operation of the confidential data exists according to the security control management strategy and carrying out corresponding encryption and decryption processing on the confidential data; the clipboard control module for restricting any copying, clipboard operations from a trusted process to an untrusted process according to a security control management policy; the process identification module is used for extracting process related information according to a security control management strategy, judging the legality of the process according to the process related information, if the process is legal, allowing the corresponding operation, and if the process is not legal, rejecting the corresponding operation.

2. The system of claim 1, wherein the file driver transparent encryption/decryption module is an encrypted target address issued by a network layer driver judgment policy, and when a user accesses an application system, the driver judges whether to encrypt the file, and monitors the browser at the client, and once the file is stored or downloaded, the driver starts to encrypt the file: when uploading the locally delivered document to the application system server, the client side judges and monitors to upload the decrypted document to the server.

3. The system of claim 1, wherein the client user can encrypt his own file, authorize the file to be assigned by role, upload the file to the FTP server for storage, and authorize a general user to operate the encrypted file in an offline state by using the system, and protect the file to be protected when the online security system of the electronic document is opened, so as to prevent unauthorized users from opening, modifying, moving, etc. the file is operated by the user, and record the behavior of the user in operating the file, and the client is written by java swing.

4. The system of claim 3, wherein the control module controls editing, copying, and saving of outgoing documents, and selectively controls access by external users.

5. The system for security management of electronic documents according to claim 3, wherein said trusted process is an application protected by said file driven transparent encryption/decryption module, and said untrusted process is an application not protected by said file driven transparent encryption/decryption module.