CN112016130A - Terminal data leakage protection method - Google Patents

Abstract

The invention discloses a terminal data leakage protection method, which is characterized in that a UUID identification code is installed on a terminal, an installation path is hidden, and installation directory access and tampering are limited; opening a file at a terminal provided with the UUID identification code, and decrypting the file; encrypting the function of the file generated in operation automatically in real time; when the file in the terminal is opened by separating from the terminal environment, the opening is invalid, and if a malicious program is used for forcibly opening the file, the file is immediately and automatically destroyed or opened or is messy code. The method can implement automatic encryption protection on the whole process of the file, has the characteristics of forced encryption, automatic encryption, real-time encryption, dynamic encryption, invisible encryption and lossless encryption, and can automatically encrypt and decrypt the file without user intervention in the editing and using processes of the file.

Description

A method for preventing data leakage of terminal

technical field

The invention relates to the field of data protection, in particular to a terminal data leakage protection method.

Background technique

Usually, the information security protection system is composed of three links: server, network and terminal.

The lack of security in any link will make the security protection useless. That is to say, the three links of server, network and terminal must form a security closed loop.

However, in the information security system, the weakest link is the terminal security protection. At present, the technical means of terminal security protection are extremely limited, and there are many security risks in the terminal. The biggest problem is that the terminal generally has the risk of data leakage.

In recent years, most of the leaks are "internal leaks" rather than "external thefts". According to statistics, more than 80% of information leakage incidents are caused by internal employee data leakage.

It can be seen that preventing data leakage of internal personnel is the top priority of information security solutions. That is to say, if the information security system lacks terminal data leakage protection, especially the data leakage protection of internal personnel, it is incomplete. There are great security risks.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a terminal data leakage protection method aiming at the defects of the prior art.

In order to achieve the above purpose, the present invention adopts the following technical solutions:

A terminal data leakage prevention method, comprising the following steps:

S1. Install the UUID identification code on the terminal, hide the installation path, restrict access to the installation directory and restrict tampering;

S2. Open the file in the terminal where the UUID identification code has been installed, and decrypt the file;

S3. Real-time automatic function encryption for files generated during operation;

S4. When the file in the terminal is opened out of the terminal environment, it is displayed that the opening is invalid.

S5. If a malicious program is used in step S4 to forcibly open the file, it will be automatically destroyed immediately or opened or garbled.

Further, the operation files in the step S3 include temporary files, random files, export files and saved files.

Further, the terminal further includes setting a permission whitelist and a document grouping whitelist.

Further, the authority whitelist includes a list of different level groups divided according to administrative levels. The high-level group can review the ciphertext of the low-level group, and the low-level group cannot open the ciphertext of the high-level group.

Further, the document grouping whitelist includes the highest-level management group, department group and instant project group.

Further, the file in the terminal also includes a designated file outsourcing management step, including setting the opening password, opening times, and expiration time of the document outside the terminal.

Further, the UUID identification code in the terminal corresponds to a unique decoding key.

By adopting the technical scheme of the present invention, the beneficial effects of the present invention are: the method of the present invention can implement automatic encryption protection for the whole process of the file, and has the characteristics of forced encryption, automatic encryption, real-time encryption, dynamic encryption, invisible encryption and lossless encryption. And during use, encryption and decryption are performed automatically without user intervention. The method facilitates the operation of terminal files with different permissions through the setting of various permissions. At the same time, the method also enables the terminal to have the function of preventing file leakage, thereby further avoiding the leakage of files.

Description of drawings

FIG. 1 is a flowchart of a method for preventing data leakage of a terminal provided by the present invention.

Detailed ways

The embodiments of the present invention are described below through specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments may be combined with each other under the condition of no conflict.

It should be noted that the drawings provided in the following embodiments are only used to illustrate the basic concept of the present invention in a schematic way, so the drawings only show the components related to the present invention rather than the number, shape and number of components in actual implementation. For dimension drawing, the type, quantity and proportion of each component can be changed at will in actual implementation, and the component layout may also be more complicated.

Embodiment 1.

As shown in the figure, a terminal data leakage prevention method includes the following steps:

S1. Install the UUID identification code on the terminal, hide the installation path, restrict access to the installation directory and restrict tampering;

S2. Open the file in the terminal where the UUID identification code has been installed, and decrypt the file;

S3. Real-time automatic function encryption of the files generated during the operation; in the step S3, the operation files include temporary files, random files, export files and saved files.

S4. When the file in the terminal is opened out of the terminal environment, it is displayed that the opening is invalid.

S5. If a malicious program is used in step S4 to forcibly open the file, it will be automatically destroyed immediately or opened or garbled.

No matter what file name is saved in this method or what file format is converted, it will be protected by strict encryption, and even if some file recovery tools are used, the plaintext content of the encrypted document cannot be obtained. Without authorization, even the author of the document cannot access the content of the document.

This method document is used as usual after the terminal is authorized by the authority, without manual encryption and decryption, and cannot be used outside. It fundamentally prevents data leakage. The encrypted file is used normally in the environment, and it will be invalid when it leaves the environment.

The method can effectively prevent the data leakage of internal personnel, especially the data leakage protection of internal personnel, and avoid the potential security risks of the existence of confidential documents. It is especially suitable for, for example, the program source code of a software company, the drawing files of an engineering design company, the process and formula of a manufacturing company, and the military secrets involved in a military industrial enterprise. Once lost to the outside of the company, competitors or hostile forces, it will cause Immeasurable loss.

And the method realizes the function of non-sensing automatic encryption, can implement automatic encryption protection for the whole process of the file, and has the characteristics of forced encryption, automatic encryption, real-time encryption, dynamic encryption, invisible encryption and lossless encryption. Encryption and decryption are performed automatically without user intervention, and the user is virtually unaware. Senseless decryption does not require transition of plaintext and does not generate plaintext on disk. Once the encrypted file leaves the environment, it cannot be opened or it is garbled. Senseless encryption solves document security problems from the root.

UUID is the abbreviation of Universally Unique Identifier, a standard for software construction and a part of the Open Software Foundation in the field of distributed computing environments. The purpose is to allow all elements in the distributed system to have unique identification information, without the need to specify identification information through the central control terminal. This way, everyone can create UUIDs that don't conflict with everyone else. In such a case, there is no need to consider the problem of duplication of names when the database is created. The UUID identification code in the terminal corresponds to a unique decoding key.

Embodiment two,

Install the UUID identifier on the terminal, hide the installation path, restrict access to the installation directory and restrict tampering, and then set the permission whitelist and document grouping whitelist on the terminal.

It is preferable to set both at the same time, which is not only convenient for daily operation, but also more convenient for document management and direct hierarchical coordination of operators.

The authority whitelist includes a list of different level groups divided according to administrative levels. For example, the high-level group can review the ciphertext of the low-level group, but the low-level group cannot open the ciphertext of the high-level group. And you can also set different levels of modification permissions, whether to allow external file permissions, and other permissions between different types of operations. Depending on the nature of the document itself, various operations at different levels can be set on a one-to-one basis.

Wherein, the document grouping whitelist includes the highest-level management group, department group and instant project group. For example, according to the division, it is possible to set the ciphertext in the group to communicate or not to communicate with different work groups, and the ciphertext cannot access each other. For another example, the highest-level management group is used for controlled ciphertext exchange between different working groups. Only those who participate in the exchange group can access the files of the exchange group. The exchange group can be created on demand, enabling cross-departmental projects. Work can be carried out very easily.

Embodiment three,

On the basis of the above Embodiment 1 or Embodiment 2, the file in the terminal further includes a designated file outgoing management step, including setting the opening password, opening times, and expiration time of the document outside the terminal. It is very convenient for ciphertext to go out to work, and can carry documents to work, and always ensure that the documents are only stored on the protected secret disk.

Note that the above are only preferred embodiments of the present invention and applied technical principles. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and can also include more other equivalent embodiments without departing from the concept of the present invention. The scope is determined by the scope of the appended claims.

Claims (7)

1. A terminal data leakage protection method is characterized by comprising the following steps:

s1, installing a UUID identification code at the terminal, hiding the installation path, limiting the access of the installation directory and limiting the tampering;

s2, opening the file at the terminal with the UUID identification code installed, and decrypting the file;

s3, encrypting the function of the file generated in the operation automatically in real time;

s4, when the file in the terminal is opened out of the terminal environment, displaying the opening invalidity,

s5, if the file is forced to be opened by the malicious program in the step S4, the file is immediately and automatically destroyed or opened or is messy code.

2. The method for protecting terminal data leakage according to claim 1, wherein the operation files in step S3 include temporary files, random files, export files and saved files.

3. The method for protecting data leakage of a terminal according to claim 1, wherein the terminal further comprises a set authority white list and a document grouping white list.

4. The method as claimed in claim 3, wherein the permission white list includes different hierarchical group lists according to administrative levels.

5. The method as claimed in claim 3, wherein the document grouping white list includes a top management group, a department group and an instant project group.

6. The method for protecting data leakage of a terminal according to claim 1, wherein the file in the terminal further comprises a step of specifying file outgoing management, which comprises setting an open password, open times and expiration time of the file outside the terminal.

7. The method as claimed in claim 1, wherein the UUID id of the terminal is associated with a unique decoding key.

Images