WO2015085906A1 - 企业数据的保护方法和装置 - Google Patents

企业数据的保护方法和装置 Download PDF

Info

Publication number
WO2015085906A1
WO2015085906A1 PCT/CN2014/093391 CN2014093391W WO2015085906A1 WO 2015085906 A1 WO2015085906 A1 WO 2015085906A1 CN 2014093391 W CN2014093391 W CN 2014093391W WO 2015085906 A1 WO2015085906 A1 WO 2015085906A1
Authority
WO
WIPO (PCT)
Prior art keywords
call
record
event
user
enterprise
Prior art date
Application number
PCT/CN2014/093391
Other languages
English (en)
French (fr)
Inventor
王力
王鹏程
李旋
刘伟
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2015085906A1 publication Critical patent/WO2015085906A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present invention relates to the field of information security, and in particular, to a method and apparatus for protecting enterprise data.
  • BYOD Back Your Own Device
  • the mobile terminal needs to save enterprise data for work, such as mail, short message, call record, contact information, etc., and also save the user's private data. .
  • the mobile terminal of the enterprise employee can access the mobile internet or the public/home network at any time and any place, and the enterprise data in the mobile terminal is also exposed to the attack from the Internet, Security flaws.
  • the same mobile terminal has both personal applications and enterprise applications and data. Personal applications can access and access enterprise data at will, so that there is a risk that enterprise data is illegally uploaded, shared, and leaked by personal applications.
  • the mobile terminal is easy to lose, and the sensitive enterprise data stored in the mobile terminal is also exposed to the risk of leaking. The loss of the device means not only the leakage and loss of sensitive business information, but also the lost device may become a springboard for attacking the enterprise network. .
  • attackers have begun to turn their attention from PCs to mobile terminals. Mobile terminals have become a new breeding ground for security risks, and it is easy to become a springboard for hackers to infiltrate enterprise intranets.
  • the manner in which the private data of the enterprise data and the user is confusingly stored in the mobile terminal is poor in security, and the risk of leaking the data is easily caused by the leakage of the enterprise data, and the enterprise data is easily obtained by the malicious program.
  • the present invention has been made in order to provide a protection method suitable for enterprise data and a corresponding enterprise data protection device that overcomes the above problems or at least partially solves the above problems.
  • a method of protecting enterprise data includes: establishing a work area for storing enterprise data in the mobile terminal; wherein the data of the work area is stored in an encrypted manner; monitoring system events, and determining whether the system event conforms to the enterprise or the user setting The rule is defined; when the system event meets the rules set by the enterprise or the user, the operation corresponding to the event is performed in the work area.
  • the rules set by the enterprise include: the enterprise corresponding to the system event is in the enterprise set by the enterprise In the address book; the rules set by the user include: the contact corresponding to the system event is in the address book of the user personally imported into the work area.
  • monitoring system events and determining whether the rules set by the enterprise or the user are met including: monitoring system events, and determining whether the contact corresponding to the system event is a work contact;
  • the work contact is a contact in the corporate address book set by the enterprise or in the address book that the user personally imports into the work area.
  • the system event includes any one of the following: receiving a text message, sending a text message, making a call, answering a call, and a missed call.
  • monitoring the system event includes: performing event reception by using a broadcast receiver specified in the operating system, and when receiving the event, determining that a current event corresponding to the event occurs Make a phone call or answer a phone call.
  • the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.
  • the operation corresponding to the event is performed in the work area, including: when the sender of the short message is the work contact, Intercept the SMS into the system inbox and store the SMS in the workspace.
  • the operation corresponding to the event is performed in the work area, including: when the recipient of the short message is a work contact, The transmission record intercepting the short message enters the system outbox, and the transmission record of the short message is stored in the work area.
  • the system event is a call
  • the operation corresponding to the event is performed in the work area, including: when the call is through the communication saved in the work area
  • the dial record recorded by the operating system is deleted and recorded in the work area.
  • the method further includes: determining whether the user has set a call record of the work contact displayed in the call record of the operating system; deleting the dial record recorded by the operating system, including : When the call record of the work contact is not displayed in the call log of the operating system, the dial record recorded by the operating system is deleted.
  • system event when the system event is answering the call, when the system event meets the rules set by the enterprise or the user, performing operations corresponding to the event in the work area, including: when the caller number of the phone is the number of the work contact
  • the call record generated by the answering call is deleted in the operating system's call log and copied to the work area.
  • the method further includes: prompting the user whether The call record generated by the answering call is deleted in the call record of the operating system; the call record generated by the answering call is deleted in the call record of the operating system, including: when the user selects to delete, the answering call is generated.
  • the call history is deleted in the operating system's call log.
  • the operation corresponding to the event is performed in the work area, including: when the caller number of the missed call is the number of the work contact, the record of the missed call is deleted in the call record of the operating system, and Copy to the workspace.
  • the method further includes: prompting the user whether The record of the missed call is deleted in the call record of the operating system; the record of the missed call is deleted in the call record of the operating system, including: the record of the missed call when the user selects to delete Deleted in the call log of the operating system.
  • the method further includes: when the user wants to access the data in the work area, prompting the user to input the unlock code; receiving and verifying whether the unlock code input by the user is correct; and allowing the user to access the work when the unlock code input by the user is correct.
  • the data in the zone when the user wants to access the data in the work area, prompting the user to input the unlock code; receiving and verifying whether the unlock code input by the user is correct; and allowing the user to access the work when the unlock code input by the user is correct.
  • a protection device for enterprise data comprises: an establishing module configured to establish a working area for storing enterprise data in the mobile terminal; wherein the data of the working area is stored in an encrypted manner; and the monitoring module is configured to monitor system events, And determining whether the system event meets the rules set by the enterprise or the user; the execution module is configured to perform an operation corresponding to the event in the work area when the system event meets the rules set by the enterprise or the user.
  • the rules set by the enterprise include: the contact corresponding to the system event is in the enterprise address book set by the enterprise; the rule set by the user includes: the contact corresponding to the system event is in the personal import of the user into the work area. In the address book.
  • the monitoring module is configured to monitor system events, determine whether the contact corresponding to the system event is a work contact; wherein the work contact is in the enterprise address book set by the enterprise or is manually imported into the work area by the user Contacts in your address book.
  • the system event includes any one of the following: receiving a text message, sending a text message, making a call, answering a call, and a missed call.
  • the monitoring module is configured to monitor the system event according to the following: receiving the event through a broadcast receiver specified in the operating system, when receiving the event, It is determined that a call event or a call event corresponding to the event currently occurs.
  • the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.
  • the executing module is configured to intercept the short message into the system inbox when the sender of the short message is the working contact, and store the short message in the working area.
  • the executing module is configured to: when the recipient of the short message is a working contact, intercept the sending record of the short message into the system outbox, and store the sending record of the short message to the working area. in.
  • the execution module is configured to delete the dial record recorded by the operating system when the call is dialed out through the address book saved in the work area, and record in the work area.
  • the device further includes: a determining module, configured to determine whether the user has set a call record of the working contact in the call record of the operating system; the executing module is further configured to display when the call record is not set in the operating system When the work contact's call record is recorded, the dial record recorded by the operating system is deleted.
  • a determining module configured to determine whether the user has set a call record of the working contact in the call record of the operating system
  • the executing module is further configured to display when the call record is not set in the operating system
  • the dial record recorded by the operating system is deleted.
  • the executing module is configured to: when the incoming call number of the phone is the number of the working contact, the call record generated by the answering call is deleted in the operating system's call record, and is copied to In the work area.
  • the device further includes: a first prompting module configured to prompt the user whether to record the call generated by the answering call in the operating system The call record is deleted; the execution module is further configured to delete the call record generated by the answering call in the call record of the operating system when the user selects to delete.
  • the execution module is configured to delete the record of the missed call in the call record of the operating system when the incoming call number of the missed call is the number of the work contact. And copy it into the workspace.
  • the device further includes: a second prompting module configured to prompt the user whether to record the missed call in the operating system The call record is deleted; the execution module is further configured to delete the record of the missed call in the call record of the operating system when the user selects to delete.
  • the device further includes: a third prompting module, configured to prompt the user to input an unlocking code when the user wants to access data in the working area; and the verification module is configured to receive and verify whether the unlocking code input by the user is correct; The module is configured to allow the user to access data in the workspace when the verification module verifies that the unlock code entered by the user is correct.
  • a third prompting module configured to prompt the user to input an unlocking code when the user wants to access data in the working area
  • the verification module is configured to receive and verify whether the unlocking code input by the user is correct
  • the module is configured to allow the user to access data in the workspace when the verification module verifies that the unlock code entered by the user is correct.
  • a computer program comprising computer readable code, when the computer readable code is run on a mobile terminal, causing the mobile terminal to perform any of the above described The method of protecting corporate data.
  • a computer readable medium wherein the computer program described above is stored.
  • the invention provides a method and device for protecting enterprise data, which establishes a work area for storing enterprise data in a mobile terminal, and saves it in an encrypted manner, and simultaneously monitors system events, when conforming to rules set by enterprises or users The operation corresponding to the event is performed in the work area. It can be seen that the invention can avoid leakage of enterprise data caused by attacks by malicious programs. Even if the mobile terminal is lost, since the work area is encrypted, other people cannot read the enterprise data, thereby ensuring the security of the enterprise data, and whether or not Obtained by a malicious program.
  • FIG. 1 is a flow chart of a method for protecting enterprise data according to an embodiment of the present invention
  • FIG. 2 is a flow chart of a specific method for protecting enterprise data according to an embodiment of the present invention
  • FIG. 3 is a structural block diagram of an apparatus for protecting enterprise data according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a specific application scenario of an enterprise data protection apparatus according to an embodiment of the present invention.
  • FIG. 5 is a block diagram schematically showing a mobile terminal for performing a protection method of enterprise data according to the present invention
  • Fig. 6 schematically shows a storage unit for holding or carrying program code for implementing a protection method of enterprise data according to the present invention.
  • the work area and the personal area can be defined as follows:
  • the definition of the work area and the personal area In the process of using the device, in order to conveniently manage the personal data and work data in the device, a part of the disk storage space can be drawn in the device, and new permission information can be configured, which can be used for storage and management work. data.
  • the remaining disk storage space of the device can be used to store and manage personal data or other materials, and the remaining disk storage space can have initial permission information.
  • the disk storage space for storing work data can be called a work area
  • the disk storage space for storing personal data can be called a personal area.
  • the personal area and the work area may have different UIs (User Interfaces) for convenience of operation, but some system files may be used in common.
  • UIs User Interfaces
  • Embodiments of the present invention provide a method for protecting enterprise data. This method improves the protection device of enterprise data.
  • the protection device of the enterprise data can be installed on a plurality of portable devices of the user, such as a game console, a laptop computer, a portable media player, a tablet computer, a tablet computer, a PDA (Personal Digital Assistant, a handheld computer). , mobile computers, as well as mobile phones and more.
  • the user's input type can be sliding input, gesture input, touch input, and voice input.
  • FIG. 1 is a flowchart of a method for protecting enterprise data according to an embodiment of the present invention, the method including steps S102 to S106.
  • S104 Monitor system events and determine whether the system events meet the rules set by the enterprise or the user.
  • the embodiment of the invention provides a method for protecting enterprise data, which establishes a working area for storing enterprise data in a mobile terminal, and saves it in an encrypted manner, and simultaneously monitors system events, when the rules set by the enterprise or the user are met. The operation corresponding to the event is performed in the work area. It can be seen that the method provided by the embodiment of the present invention can avoid leakage of enterprise data caused by attacks by malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, thereby ensuring the security of the enterprise data. Sex, and can not be obtained by malicious programs.
  • This embodiment is a specific application scenario of the foregoing first embodiment. Through the embodiment, the method provided by the present invention can be more clearly and specifically illustrated.
  • FIG. 2 is a flow chart of a specific method for protecting enterprise data, including steps S201 to S212, according to an embodiment of the present invention.
  • the enterprise data in the mobile terminal is protected, and the first step is to perform step S201 to establish a working area for storing enterprise data in the mobile terminal.
  • the purpose of establishing the working area is to store data generated in the work, and to store the data in the work area and the data in the personal area in isolation to manage the data in the work area.
  • the data of the work area is saved in an encrypted manner, and the user can set an unlock password for the data of the work area, and the user is allowed to access the work area when the unlock code input by the user is correct.
  • the data is saved in an encrypted manner, and the user can set an unlock password for the data of the work area, and the user is allowed to access the work area when the unlock code input by the user is correct.
  • Launcher is the launcher or desktop in Android, and can enter other applications from icons on the desktop.
  • step S202 is performed to monitor the system event and determine whether the system event meets the rules set by the prior enterprise or the user. If it is met, the operation corresponding to the event is performed in the work area. If not, the operation corresponding to the system event is performed in the personal area.
  • system events involved in this embodiment may include receiving a short message, sending a short message, making a call, receiving a call, generating a missed call, sending and receiving an email, and the like, which can be supported by the mobile terminal.
  • two different address records can be preset in the mobile terminal, one of which is a corporate address book for work and the other is a private communication of the user.
  • Record, address book can be saved with contact phone, email, instant messaging and other contact information.
  • the enterprise address book is set in the above working area, and the enterprise address book stores contacts related to the work of the user.
  • the contact included in the enterprise address book may be all colleagues of the department where the user is located.
  • the enterprise address book can also be synchronized with the server side, that is, the user's corporate address book is periodically updated according to the server, for example, the corporate address book management personnel newly joined.
  • the contact will also be updated to the user's corporate directory.
  • the contacts imported by the user may be stored, and the contacts may be closely related to the working relationship of the user. A contact who is not in the department.
  • the user A belongs to the administrative department, and the work with the personnel department is relatively close. At this time, the user A can import all the contacts of the personnel department into the work area. At this time, the contact and the user A in the corporate address book
  • the contacts that individuals import into the workspace together constitute User A's work contacts.
  • User B also belongs to the administrative department, and it is more closely related to the work of the International Department. At this time, User B can import all the contacts of the International Department into the work area. At this time, the contacts in the corporate address book. Together with the contacts that User B personally imports into the workspace, User B's work contacts are formed.
  • the setting of the personal import contact enables different users to set the work according to their own needs.
  • the contact person in the area is convenient for the user to operate, and also ensures the security of the enterprise data.
  • the private address book is set in a non-work area and may include contacts related to the user's personal, such as relatives, friends, and the like.
  • the contact of the work area can coincide with the contact in the user's private address book.
  • the contact A is the colleague of the user and the friend of the user, and the contact A can be saved in the corporate address book at the same time.
  • private address book to ensure the security of corporate data.
  • step S202 when determining whether the system event meets the rules set by the enterprise or the user in advance, the following steps may be specifically determined:
  • System events are monitored to determine if the contact corresponding to the system event is a work contact. When it is a work contact, it confirms that it meets the preset rule. At this time, the corresponding operation is performed in the work area according to the category of the system event. When it is not a work contact, it is confirmed that the preset rule is not met. At this time, the corresponding operation is performed in the non-work area according to the category of the system event.
  • the work contact is a contact in the enterprise address book set by the above enterprise or in the address book of the user personally imported into the work area.
  • the system event is specifically introduced by taking a system event as an example of receiving a short message, sending a short message, making a call, answering a call, and a missed call.
  • a system event as an example of receiving a short message, sending a short message, making a call, answering a call, and a missed call.
  • the following describes the specific implementation process of the above five system events.
  • the system event is to receive a text message event.
  • step S202 determines whether the contact corresponding to the received short message event is a work contact. When it is a work contact, step S203 is performed, and when it is not a work contact, step S204 is performed.
  • Step S203 intercepting the short message into the system inbox, and storing the short message in the work area.
  • the short message record saved in the working area can also be uploaded to the server, which is convenient for the administrator to manage operations.
  • step S204 the short message is stored in the system inbox.
  • Step S203 intercepts the short message entering the system inbox and storing the short message in the work area, thereby realizing the separation of the public and private data, and avoiding the work-related incoming mail being in the user's system inbox and being maliciously viewed. Thereby ensuring the security of enterprise data.
  • the system event is a short message event.
  • step S202 determines whether the contact corresponding to the short message sending event is a working contact. When it is a work contact, step S205 is performed, and when it is not a work contact, step S206 is performed.
  • Step S205 intercepting the sending record of the short message into the system outbox, and storing the sending record of the short message into the working area.
  • the short message sending record saved in the working area can also be uploaded to the server for management. Management operations of the staff.
  • Step S206 the transmission record of the short message is stored in the system inbox.
  • Step S205 intercepts the sending record of the short message into the system outbox, and stores the sending record of the short message into the working area, thereby realizing the separation of the public and private data, and avoiding the work-related sending in the user's system sending It is maliciously viewed in the box, thus ensuring the security of enterprise data.
  • the system event is a call event.
  • step S202 determines whether the contact corresponding to the call event is a work contact. When it is a work contact, step S207 is performed, and when it is not a work contact, step S208 is performed.
  • step S207 the dial record recorded by the operating system is deleted and recorded in the work area.
  • the telephone call record saved in the work area can also be uploaded to the server, which is convenient for the administrator's management operation.
  • step S208 the dialing record is stored in the dialing record of the operating system.
  • step S207 When the call record of the work contact is displayed in the call log of the operating system, the dial record is displayed in the call record of the operating system and recorded in the work area at the same time.
  • the user can separately set whether the call record of each contact in the work area is displayed in the system call record, or can be uniformly set, that is, set all call records to be displayed in the system call record. Or all call records are not displayed in the system call log.
  • the system event is a call event.
  • step S202 determines whether the contact corresponding to the answering the phone event is a work contact. When it is a work contact, step S209 is performed, and when it is not a work contact, step S210 is performed.
  • step S209 the call record generated by the answering call is deleted in the call record of the operating system and copied into the work area.
  • the maintenance (copy and transfer) of the operating system's call record can be as follows:
  • the PhoneStateReceiver broadcast receiver receives the event of making and receiving calls.
  • the CallLogObserverService service is started to maintain the call record, including the copy and transfer operation of the call record.
  • the event that the PhoneStateReceiver broadcast receiver receives for making and receiving calls can be implemented by the following code:
  • the call log can be copied through the CallLogObserverService service:
  • the listener service ContentObserver uses the change of the call record database of the system (the URI is android.provider.CallLog.Calls.CONTENT_URI).
  • the onChange method of the Handler is called to update the call record database of the work area.
  • the phone answer record saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage operations.
  • step S210 the answer record is stored in the call record of the operating system.
  • the call record may further include Do the following:
  • Step S209 Prompt the user whether the call record generated by the answering call is deleted in the call record of the operating system.
  • the call record generated by the secondary call is deleted in the call record of the operating system through step S209.
  • the answer record is stored in the call record of the operating system and copied into the work area.
  • the above prompts the user operation to save or delete the call record according to the different needs of the user, which ensures the security of the work area data and is also convenient for the user to operate.
  • the system event is a missed call event.
  • step S202 determines whether the contact corresponding to the missed call event is a work contact. When it is a work contact, step S211 is performed, and when it is not a work contact, step S212 is performed.
  • step S211 the record of the missed call is deleted in the call record of the operating system and copied into the work area.
  • the missed call record saved in the working area can also be uploaded to the server, which is convenient for the administrator to manage operations.
  • step S212 the record of the missed call is stored in the call record of the operating system.
  • the method may further include as follows:
  • Prompt the user whether to delete the record of the missed call in the operating system's call log When the user selects to delete, the record of the missed call is deleted in the call record of the operating system by step S211. When the user chooses not to delete, the missed record is stored in the operating system's call record and copied to the workspace.
  • the embodiment of the invention provides a method for protecting enterprise data, which establishes a working area for storing enterprise data in a mobile terminal, and saves it in an encrypted manner, and simultaneously monitors system events, when the rules set by the enterprise or the user are met. The operation corresponding to the event is performed in the work area. It can be seen that the method provided by the embodiment of the present invention can avoid leakage of enterprise data caused by attacks by malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, and the enterprise data is guaranteed. Security and can be obtained without malicious programs.
  • FIG. 3 is a structural block diagram of an apparatus for protecting enterprise data according to an embodiment of the present invention.
  • the apparatus 300 includes:
  • the establishing module 310 is configured to establish, in the mobile terminal, a work area for storing enterprise data, where the data of the work area is stored in an encrypted manner;
  • the monitoring module 320 is configured to monitor system events and determine whether the system events meet the rules set by the enterprise or the user;
  • the execution module 330 is configured to perform an operation corresponding to the event in the work area when the system event meets the rules set by the enterprise or the user.
  • the rules set by the enterprise include: the contact corresponding to the system event is in the enterprise address book set by the enterprise;
  • the rules set by the user include: the contact corresponding to the system event is in the address book that the user personally imports into the work area.
  • the monitoring module 320 is configured to monitor system events, and determine whether the contact corresponding to the system event is a work contact;
  • the work contact is a contact in the corporate address book set by the enterprise or in the address book that the user personally imports into the work area.
  • system event includes any of the following:
  • Receive text messages send text messages, make calls, answer calls, and missed calls.
  • the monitoring module 320 is configured to monitor system events as follows:
  • Event reception is performed by a broadcast receiver specified in the operating system, and when an event is received, it is determined that a call event or a call event corresponding to the event currently occurs.
  • the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.
  • the executing module 330 is configured to intercept the short message into the system inbox when the sender of the short message is the working contact, and store the short message in the working area.
  • the executing module 330 is configured to: when the recipient of the short message is a working contact, intercept the sending record of the short message into the system outbox, and store the sending record of the short message to work. In the district.
  • the execution module 330 is configured to delete the dial record recorded by the operating system when the call is dialed out through the address book saved in the work area, and record the record in the work area.
  • the device 300 further includes:
  • the determining module 340 is configured to determine whether the user has set a call record of the working contact in the call record of the operating system
  • the execution module 330 is further configured to delete the call record recorded by the operating system when the call record of the work contact is not displayed in the call record of the operating system.
  • the executing module 330 is configured to: when the incoming call number of the phone is the number of the working contact, delete the call record generated by the answering call in the call record of the operating system, and copy Go to the workspace.
  • the device when the incoming call number of the answering phone coincides with the contact number in the operating system's address book, the device further includes:
  • the first prompting module 350 is configured to prompt the user whether the call record generated by the answering call is deleted in the call record of the operating system;
  • the execution module 330 is further configured to delete the call record generated by the answering call in the call record of the operating system when the user selects the deletion.
  • the executing module 330 is configured to: when the incoming call number of the missed call is the number of the working contact, delete the record of the missed call in the call record of the operating system. And copy it into the workspace.
  • the device when the incoming call number of the missed call coincides with the contact number in the operating system's address book, the device further includes:
  • the second prompting module 360 is configured to prompt the user whether the record of the missed call is deleted in the call record of the operating system
  • the execution module 330 is further configured to delete the record of the missed call in the call record of the operating system when the user selects to delete.
  • the device 300 further includes:
  • the third prompt module 370 is configured to prompt the user to input an unlock code when the user wants to access data in the work area;
  • the verification module 380 is configured to receive and verify whether the unlock code input by the user is correct;
  • the access module 390 is configured to allow the user to access data in the workspace when the verification module 380 verifies that the unlock code entered by the user is correct.
  • a specific application scenario of the protection device provided by the embodiment of the present invention includes:
  • An employee device which is equivalent to the protection device of the enterprise data provided by the embodiment of the present invention.
  • the employee device may be installed with an enterprise private system, and the enterprise private system includes:
  • the above system is stored in a work area in the employee device for storing enterprise data in an encrypted manner, and the user can access the enterprise data in the private system of the enterprise by inputting a password.
  • the employee equipment is connected to the private enterprise cloud service of the enterprise enterprise.
  • the cloud service stores the cloud security service, and the rules of the cloud security service (for example, the rules set by the enterprise) can be pushed to the employee equipment, and the employee equipment needs to be set according to the enterprise.
  • the rules isolate the data between the work area and the personal area to achieve the security of the enterprise data.
  • enterprise administrators can set rules for cloud security services in the private enterprise cloud service.
  • the embodiment of the invention provides a protection device for enterprise data, which establishes a work area for storing enterprise data in a mobile terminal, and saves it in an encrypted manner, and simultaneously monitors system events, when the rules set by the enterprise or the user are met. The operation corresponding to the event is performed in the work area. It can be seen that the apparatus provided by the embodiment of the present invention can avoid leakage of enterprise data caused by attacks by malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, and the enterprise data is guaranteed. Security and can be obtained without malicious programs.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the enterprise data protection device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 5 illustrates a mobile terminal, such as a game console, a laptop computer, a portable media player, a tablet computer, a tablet computer, a PDA, a mobile computer, and a mobile device, which can implement the protection method of enterprise data according to the present invention.
  • the mobile terminal conventionally includes a processor 510 and a computer program product or computer readable medium in the form of a memory 520.
  • the memory 520 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 520 has a memory space 530 for program code 531 for performing any of the method steps described above.
  • storage space 530 for program code may include various program code 531 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such computer program products are typically portable or fixed storage units as described with reference to FIG.
  • the storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 520 in the mobile terminal of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 531', i.e., code readable by a processor, such as 510, that when executed by the mobile terminal causes the mobile terminal to execute Each step in the described method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供了一种企业数据的保护方法和装置。其中企业数据的保护方法包括：在移动终端中建立用于存储企业数据的工作区；其中，工作区的数据采用加密的方式保存；对系统事件进行监测，并判断系统事件是否符合企业或用户设定的规则；当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。通过本发明，可以避免由于恶意程序的攻击造成的企业数据的泄漏，即使移动终端丢失，由于工作区已加密，其他人也不能读取得到企业数据，保证了企业数据的安全性，并且能不被恶意程序所获取。

Description

企业数据的保护方法和装置 技术领域
本发明涉及信息安全领域，特别是涉及一种企业数据的保护方法和装置。
背景技术
随着智能终端的成熟与普及，以手机、平板为代表的个人智能终端设备逐渐进入企业领域。未来企业将会支持员工在个人移动终端上运行企业办公应用程序，这类被称为BYOD(Bring Your Own Device,自带设备办公)的现象为企业安全和管理带来了新的挑战。
在这种情况下，由于允许员工通过移动终端进行便捷的办公，移动终端需保存用于工作的企业数据，例如邮件、短消息、通话记录、联系人信息等，同时也会保存用户的私人数据。
但是，由于存在如下情况：第一，企业员工的移动终端可以在任何时间、任何地点接入移动互联网或公共/家庭网络，移动终端中的企业数据也会暴露在来自互联网的攻击之下，具有安全缺陷。第二，同一移动终端上既有个人应用，又有企业应用和数据，个人应用可以随意访问、存取企业数据，从而存在企业数据被个人应用非法上传、共享和外泄的风险。第三，移动终端容易丢失，移动终端中所保存的企业敏感数据也因此面临泄密风险，设备丢失不但意味着敏感商业信息的泄漏和丢失，所丢失的设备也可能会变成攻击企业网络的跳板。第四，在移动互联网越来越深入人心的今天，攻击者们已经开始将视线由PC转向了移动终端。移动终端成为滋生安全风险的新温床，容易成为黑客入侵渗透企业内网的跳板。
因此，目前情况下，移动终端中对于企业数据和用户的私人数据混乱存放的方式，安全性差，容易造成企业数据外泄带来泄密风险，企业数据易被恶意程序获取。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的适于企业数据的保护方法和相应的企业数据的保护装置。
依据本发明的一个方面，提供一种企业数据的保护方法。该企业数据的保护方法包括：在移动终端中建立用于存储企业数据的工作区；其中，工作区的数据采用加密的方式保存；对系统事件进行监测，并判断系统事件是否符合企业或用户设定的规则；当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。
可选地，企业设定的规则包括：与系统事件对应的联系人处于企业设定的企业 通讯录中；用户设定的规则包括：与系统事件对应的联系人处于用户个人导入到工作区的通讯录中。
可选地，对系统事件进行监测，并判断是否符合企业或用户设定的规则，包括：对系统事件进行监测，判断与系统事件对应的联系人是否为工作联系人；
其中，工作联系人为处于企业设定的企业通讯录中或处于用户个人导入到工作区的通讯录中的联系人。
可选地，系统事件包括以下中的任意一项：接收短信、发送短信、拨打电话、接听电话、发生未接来电。
可选地，当系统事件为拨打电话或接听电话时，对系统事件进行监测包括：通过操作系统中指定的广播接收器进行事件接收，当接收到事件时，判定当前发生与所述事件对应的拨打电话事件或接听电话事件。
可选地，所述指定的广播接收器为PhoneStateReceiver广播接收器。
可选地，当系统事件为接收短信时，当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作，包括：当短信的发件人为工作联系人时，拦截该短信进入系统收件箱，并将该短信存储到工作区中。
可选地，当系统事件为发送短信时，当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作，包括：当短信的收件人为工作联系人时，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到工作区中。
可选地，当系统事件为拨打电话时，当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作，包括：当电话为通过保存在工作区中的通讯录拨出时，将操作系统记录的该拨打记录删除，并记录在工作区中。
可选地，在将操作系统记录的该拨打记录删除之前，还包括：判断用户是否已设置在操作系统的通话记录中显示工作联系人的通话记录；将操作系统记录的该拨打记录删除，包括：当未设置在操作系统的通话记录中显示工作联系人的通话记录时，将操作系统记录的该拨打记录删除。
可选地，当系统事件为接听电话时，当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作，包括：当电话的来电号码为工作联系人的号码时，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，在将该次接听电话产生的通话记录在操作系统的通话记录中删除之前，还包括：提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除；将该次接听电话产生的通话记录在操作系统的通话记录中删除，包括：当用户选择删除时，将该次接听电话产生的通话记录在操作系统的通话记录中删除。
可选地，当系统事件为发生未接来电时，当系统事件符合企业或用户设定的规 则时，在工作区内执行与该事件对应的操作，包括：当未接来电的来电号码为工作联系人的号码时，将该条未接来电的记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，在将该条未接来电的记录在操作系统的通话记录中删除之前，还包括：提示用户是否将该条未接来电的记录在操作系统的通话记录中删除；将该条未接来电的记录在操作系统的通话记录中删除，包括：当用户选择删除时，将该条未接来电的记录在操作系统的通话记录中删除。
可选地，该方法还包括：当用户欲访问工作区中的数据时，提示用户输入解锁码；接收并验证用户输入的解锁码是否正确；当用户输入的解锁码正确时，允许用户访问工作区中的数据。
依据本发明的另一个方面，还提供了一种企业数据的保护装置。该企业数据的保护装置包括：建立模块，配置为在移动终端中建立用于存储企业数据的工作区；其中，工作区的数据采用加密的方式保存；监测模块，配置为对系统事件进行监测，并判断系统事件是否符合企业或用户设定的规则；执行模块，配置为当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。
可选地，企业设定的规则包括：与系统事件对应的联系人处于企业设定的企业通讯录中；用户设定的规则包括：与系统事件对应的联系人处于用户个人导入到工作区的通讯录中。
可选地，监测模块配置为对系统事件进行监测，判断与系统事件对应的联系人是否为工作联系人；其中，工作联系人为处于企业设定的企业通讯录中或处于用户个人导入到工作区的通讯录中的联系人。
可选地，系统事件包括以下中的任意一项：接收短信、发送短信、拨打电话、接听电话、发生未接来电。
可选地，当系统事件为拨打电话或接听电话时，所述监测模块被配置为按照如下方式对系统事件进行监测：通过操作系统中指定的广播接收器进行事件接收，当接收到事件时，判定当前发生与所述事件对应的拨打电话事件或接听电话事件。
可选地，所述指定的广播接收器为PhoneStateReceiver广播接收器。
可选地，当系统事件为接收短信时，执行模块配置为当短信的发件人为工作联系人时，拦截该短信进入系统收件箱，并将该短信存储到工作区中。
可选地，当系统事件为发送短信时，执行模块配置为当短信的收件人为工作联系人时，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到工作区中。
可选地，当系统事件为拨打电话时，执行模块配置为当电话为通过保存在工作区中的通讯录拨出时，将操作系统记录的该拨打记录删除，并记录在工作区中。
可选地，该装置还包括：判断模块，配置为判断用户是否已设置在操作系统的通话记录中显示工作联系人的通话记录；执行模块还配置为当未设置在操作系统的通话记录中显示工作联系人的通话记录时，将操作系统记录的该拨打记录删除。
可选地，当系统事件为接听电话时，执行模块配置为当电话的来电号码为工作联系人的号码时，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，装置还包括：第一提示模块，配置为提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除；执行模块还配置为当用户选择删除时，将该次接听电话产生的通话记录在操作系统的通话记录中删除。
可选地，当系统事件为发生未接来电时，执行模块配置为当未接来电的来电号码为工作联系人的号码时，将该条未接来电的记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，装置还包括：第二提示模块，配置为提示用户是否将该条未接来电的记录在操作系统的通话记录中删除；执行模块还配置为当用户选择删除时，将该条未接来电的记录在操作系统的通话记录中删除。
可选地，该装置还包括：第三提示模块，配置为当用户欲访问工作区中的数据时，提示用户输入解锁码；验证模块，配置为接收并验证用户输入的解锁码是否正确；访问模块，配置为当验证模块验证用户输入的解锁码正确时，允许用户访问工作区中的数据。
根据本发明的再一个方面，提供了一种计算机程序，其包括计算机可读代码，当所述计算机可读代码在移动终端上运行时，导致所述移动终端执行以上介绍的任一项所述的企业数据的保护方法。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存储了上述的计算机程序。
本发明提供了一种企业数据的保护方法和装置，通过在移动终端中建立存储企业数据的工作区，并以加密方式保存，同时对系统事件进行监测，当符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。可见，本发明可以避免由于恶意程序的攻击造成的企业数据的泄漏，即使移动终端丢失，由于工作区已加密，其他人也不能读取得到企业数据，保证了企业数据的安全性，并且能不被恶意程序所获取。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1是根据本发明一个实施例的一种企业数据的保护方法流程图；
图2是根据本发明一个实施例的一种企业数据的具体保护方法流程图；
图3是根据本发明一个实施例的一种企业数据的保护装置结构框图；
图4是根据本发明一个实施例的企业数据的保护装置的一种具体应用场景示意图；
图5示意性地示出了用于执行根据本发明的企业数据的保护方法的移动终端的框图；以及
图6示意性地示出了用于保持或者携带实现根据本发明的企业数据的保护方法的程序代码的存储单元。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应该被这里阐述的实施例所限制。相反，提供这些实施例是为了能够透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
其中，在本发明和以下本实施例中，工作区和个人区可以定义如下：
工作区和个人区的定义，在设备使用过程中，为了方便管理设备中的个人资料和工作资料，可以在设备中划出一部分磁盘存储空间，配置新的权限信息，可以用于存储和管理工作资料。而该设备剩下的磁盘存储空间，可以用于存储、管理个人资料或者其他资料，剩下的磁盘存储空间可以拥有初始的权限信息。相对而言，存储工作资料的磁盘存储空间可以称之为工作区，而存储个人资料的磁盘存储空间可以称之为个人区。
此外，为方便操作，个人区和工作区可以具有不同的UI(User Interface，用户界面)，但是可以共同使用某些系统文件。
用户大部分时间可能会涉及个人区的操作，而比较少的时间涉及工作区的操作。当涉及工作区的操作时，由于休息等原因需要主动对设备进行加密，或者由于设备太久没有操作信息而自动进行加密，在设备加密后再次解密会回到工作区，需要进行个人区的权限信息的解密，再进行工作区的权限信息的解密，才能进入工作区。如果此时用户并不想回到工作区则需要再退出工作区，操作十分繁琐，但是直接省 去工作区权限信息的解密又会有安全隐患。
实施例一
本发明实施例提供了一种企业数据的保护方法。该方法对企业数据的保护装置进行了改进。本实施例中企业数据的保护装置可以安装在用户的多种便携式设备上，例如游戏控制台，膝上型计算机，便携式媒体播放器，板式计算机，平板计算机，PDA(Personal Digital Assistant，掌上电脑)，移动计算机，以及移动电话等等。
其中，用户的输入类型可以是滑动输入，手势输入，触摸输入，以及语音输入。
图1是根据本发明一个实施例的一种企业数据的保护方法流程图，该方法包括步骤S102至S106。
S102，在移动终端中建立用于存储企业数据的工作区；其中，工作区的数据采用加密的方式保存。
S104，对系统事件进行监测，并判断系统事件是否符合企业或用户设定的规则。
S106，当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。
本发明实施例提供了一种企业数据的保护方法，通过在移动终端中建立存储企业数据的工作区，并以加密方式保存，同时对系统事件进行监测，当符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。可见，本发明实施例提供的方法可以避免由于恶意程序的攻击造成的企业数据的泄漏，即使移动终端丢失，由于工作区已加密，其他人也不能读取得到企业数据，保证了企业数据的安全性，并且能不被恶意程序所获取。
实施例二
本实施例为上述实施例一的一种具体应用场景，通过本实施例，能够更加清楚、具体地阐述本发明所提供的方法。
图2是根据本发明一个实施例的一种企业数据的具体保护方法流程图，该方法包括步骤S201至S212。
本发明实施例要对移动终端中的企业数据进行保护，这就需要首先来执行步骤S201，在移动终端中建立一个用于存储企业数据的工作区。
本实施例中，建立该工作区的目的在于存储工作中所产生的数据，实现将工作区中的数据与个人区的数据进行隔离存储，以便对工作区中的数据进行管理。
可选地，为了保证工作区数据的安全，工作区的数据采用加密的方式进行保存，用户可以为工作区的数据设置解锁密码，当用户输入的解锁码正确时，才允许用户访问工作区中的数据。
以在安卓系统中为例，在对工作区的数据设置解锁密码并隔离保存时，可以采 取如下方式：
分别创建并记录用户的个人区和工作区的Launcher，在显示桌面前，提示用户输入密码。若用户进行工作区的登入合法，则启动工作区Launcher，给用户提供工作区的桌面，用户可以通过该桌面进入工作区中的应用；若用户未进行登录，则从选择默认的个人区Launcher启动，用户通过该默认的Launcher进入个人区的应用，以达到工作区和个人区的隔离。
其中，Launcher为安卓系统中的启动器或者桌面，可以从桌面上的图标进入其他应用。
接下来，执行步骤S202，对系统事件进行监听，并判断该系统事件是否符合预先企业或用户设定的规则。若符合，在工作区内执行与该事件对应的操作。若不符合，则在个人区执行与系统事件对应的操作。
可选地，本实施例中所涉及的系统事件可以包括接收短信、发送短信、拨打电话、接听电话、发生未接来电、收发邮件等移动终端所能够支持的事件。
本实施例中，为了能够更好地对工作区的数据进行管理，移动终端中可以预先设置两个不同的通讯录，其中，一个为用于工作的企业通讯录，另一个为用户的私人通讯录，通讯录中可以保存有联系人的电话，邮箱，即时通讯等联系方式。
其中，企业通讯录设置在上述工作区内，企业通讯录中存储有与该用户工作相关的联系人，例如，企业通讯录中包括的联系人可以是该用户所处部门的全部同事。
另外，为了方便对企业通讯录进行管理和更新，该企业通讯录还可以与服务器端同步，即用户的企业通讯录则会定时根据服务器来进行同步更新，例如，企业通讯录管理人员新加入了联系人，则该联系人也会更新至用户的企业通讯录中。
需要说明的是，处于相同部门的用户，其所面对的工作联系人往往是不同的，例如，用户A所属行政部，其与人事部的工作来往较为密切，用户B也所属行政部，而其与国际部的工作来往较为密切，而往往企业通讯录中只会存储有该部门所共同的工作联系人，不能完全涵盖每个同事所面对的工作联系人。
所以，本实施例为了满足不同用户的需求，在工作区中，除存储有上述企业通讯录之外，还可以存储用户个人导入的联系人，这些联系人可以为与该用户工作关系密切而又非本部门的联系人。
例如，用户A所属行政部，而其与人事部的工作来往较为密切，这时，用户A可以将人事部的所有联系人导入到工作区，此时，企业通讯录中的联系人与用户A个人导入到工作区中的联系人共同构成了用户A的工作联系人。还例如，用户B也所属行政部，而其与国际部的工作来往较为密切，这时，用户B则可以将国际部的所有联系人导入到工作区，此时，企业通讯录中的联系人与用户B个人导入到工作区中的联系人共同构成了用户B的工作联系人。
可见，个人导入联系人的设置能够使得不同的用户根据其自身的需求来设定工 作区的联系人，方便用户操作，同时也保证了企业数据的安全。
与上述描述的工作区通讯录不同的是，私人通讯录设置在非工作区，可以包括与用户个人相关的联系人，例如，亲人、朋友等。但是，工作区的联系人可以与用户私人通讯录中的联系人可以重合，例如，联系人A即为该用户的同事，也是该用户的朋友，则联系人A可以同时被保存在企业通讯录和私人通讯录中，以保证企业数据的安全。
综上，步骤S202在判断该系统事件是否符合预先企业或用户设定的规则时，具体可以通过如下步骤进行判断：
对系统事件进行监测，判断与系统事件对应的联系人是否为工作联系人。当为工作联系人时，确认符合预设规则，此时，根据系统事件的类别在工作区执行相应的操作。当不为工作联系人时，确认不符合预设规则符合，此时，根据系统事件的类别在非工作区内执行相应的操作。
其中，工作联系人为处于上述企业设定的企业通讯录中或处于上述用户个人导入到工作区的通讯录中的联系人。
本实施例为了更加清楚详细地介绍本方法，现以系统事件为接收短信、发送短信、拨打电话、接听电话、发生未接来电为例来进行具体介绍。下面分别介绍上述五种系统事件发生时，本方法的具体执行过程。
第一种情况，系统事件为接收短信事件。
当系统事件为接收短信事件时，步骤S202判断与接收短信事件对应的联系人是否为工作联系人。当是工作联系人时，执行步骤S203，当不是工作联系人，则执行步骤S204。
步骤S203，拦截该短信进入系统收件箱，并将该短信存储到工作区中。
本实施例中，工作区中保存的短信记录还可以上传到服务器中，便于管理员的管理操作。
步骤S204，将该短信存入系统收件箱。
步骤S203拦截该短信进入系统收件箱，并将该短信存储到工作区中的操作，实现了公私数据的分离，避免了与工作相关的来信处于用户的系统收件箱中而被恶意查看，从而保证了企业数据的安全。
第二种情况，系统事件为发送短信事件。
当系统事件为发送短信事件时，步骤S202判断与发送短信事件对应的联系人是否为工作联系人。当是工作联系人时，执行步骤S205，当不是工作联系人时，则执行步骤S206。
步骤S205，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到工作区中。
本实施例中，工作区中保存的短信发送记录还可以上传到服务器中，便于管理 员的管理操作。
步骤S206，将该短信的发送记录存储到系统收件箱。
步骤S205拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到工作区中的操作，实现了公私数据的分离，避免了与工作相关的发信处于用户的系统发件箱中而被恶意查看，从而保证了企业数据的安全。
第三种情况，系统事件为拨打电话事件。
当系统事件为拨打电话事件时，步骤S202判断与拨打电话事件对应的联系人是否为工作联系人。当是工作联系人时，执行步骤S207，当不是工作联系人，则执行步骤S208。
步骤S207，将操作系统记录的该拨打记录删除，并记录在工作区中。
本实施例中，工作区中保存的电话拨打记录还可以上传到服务器中，便于管理员的管理操作。
步骤S208，在该拨打记录存储到操作系统的拨打记录中。
需要说明的是，为了使得用户方便查看拨打记录，在步骤S207将操作系统记录的该拨打记录删除之前，还可以包括如下操作：
判断用户是否已设置在操作系统的通话记录中显示工作联系人的通话记录。当未设置在操作系统的通话记录中显示工作联系人的通话记录时，通过步骤S207将操作系统记录的该拨打记录删除。当设置在操作系统的通话记录中显示工作联系人的通话记录时，则将该拨打记录显示在操作系统的通话记录中，并同时记录在工作区中。
本实施例中，根据不同的需求，用户可以分别设置工作区中每个联系人的通话记录是否显示在系统通话记录中，也可以进行统一设置，即设置成全部通话记录显示在系统通话记录中或者全部通话记录不显示在系统通话记录中。
第四种情况，系统事件为接听电话事件。
当系统事件为接听电话事件时，步骤S202判断与接听电话事件对应的联系人是否为工作联系人。当是工作联系人时，执行步骤S209，当不是工作联系人，则执行步骤S210。
步骤S209，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到所述工作区中。
以安卓系统为例，对于当系统事件为拨打电话或接听电话时，对操作系统的通话记录的维护(拷贝和转移)，可采用如下方式：
通过PhoneStateReceiver广播接收器接收拨打电话和接听电话的事件，当发生拨打电话或接听电话事件时，启动CallLogObserverService服务对通话记录进行维护，包括通话记录的拷贝和转移操作。
在启动CallLogObserverService服务时，可通过操作系统提供的startService服 务实现。
其中，PhoneStateReceiver广播接收器接收对于拨打电话和接听电话的事件可通过如下代码实现：
Figure PCTCN2014093391-appb-000001
具体地，在启动CallLogObserverService服务之前，还需要获取对于操作系统通讯录的读写权限，可采用如下方式：
在androidmanifest.xml中声明用到的权限：
<uses-permission android:name＝"android.permission.READ_PHONE_STATE"/>
其中，在进行通话记录的拷贝时可通过CallLogObserverService服务实现：
在CallLogObserverService服务启动的过程中注册了一个监听服务ContentObserver，以及处理变化的Handler；
监听服务ContentObserver用语监听系统的通话记录数据库的变化(其URI为android.provider.CallLog.Calls.CONTENT_URI)，当有通话记录的变动时，调用该Handler的onChange方法，更新工作区的通话记录数据库。
本实施例中，工作区中保存的电话接听记录还可以上传到服务器中，便于管理员的管理操作
步骤S210，将该接听记录存储在操作系统的通话记录中。
需要说明的是，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，在步骤S209将该次接听电话产生的通话记录在操作系统的通话记录中删除之前，还可以包括如下操作：
提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除。当用户选择删除时，通过步骤S209将该次接听电话产生的通话记录在操作系统的通话记录中删除。当用户选择不删除时，则将该次接听记录存储在操作系统的通话记录中，并复制到工作区中。
上述提示用户操作能够根据用户的不同需求来实现保存或者删除通话记录，保证了工作区数据安全性的同时也便于用户操作。
第五种情况，系统事件为未接来电事件。
当系统事件为未接来电事件时，步骤S202判断与未接来电事件对应的联系人是否为工作联系人。当是工作联系人时，执行步骤S211，当不是工作联系人，则执行步骤S212。
步骤S211，将该条未接来电的记录在操作系统的通话记录中删除，并复制到所述工作区中。
本实施例中，工作区中保存的未接来电记录还可以上传到服务器中，便于管理员的管理操作。
步骤S212，将该条未接来电的记录存储在操作系统的通话记录中。
需要说明的是，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，在步骤S211将该条未接来电的记录在操作系统的通话记录中删除之前，还可以包括如下：
提示用户是否将该条未接来电的记录在操作系统的通话记录中删除。当用户选择删除时，通过步骤S211将该条未接来电的记录在操作系统的通话记录中删除。当用户选择不删除时，则将该次未接记录存储在操作系统的通话记录中，并复制到工作区中。
需要说明的是，本实施上述所描述的五种系统事件只是示例性的，并不限制本发明实施例所保护的范围，其他移动终端能够支持的系统事件也在本发明实施例所保护的范围之内。
本发明实施例提供了一种企业数据的保护方法，通过在移动终端中建立存储企业数据的工作区，并以加密方式保存，同时对系统事件进行监测，当符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。可见，本发明实施例所提供的方法可以避免由于恶意程序的攻击造成的企业数据的泄漏，即使移动终端丢失，由于工作区已加密，其他人也不能读取得到企业数据，保证了企业数据的安全性，并且能不被恶意程序所获取。
实施例三
图3是本发明一个实施例提供的一种企业数据的保护装置结构框图，该装置300包括：
建立模块310，配置为在移动终端中建立用于存储企业数据的工作区；其中，工作区的数据采用加密的方式保存；
监测模块320，配置为对系统事件进行监测，并判断系统事件是否符合企业或用户设定的规则；
执行模块330，配置为当系统事件符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。
可选地，企业设定的规则包括：与系统事件对应的联系人处于企业设定的企业通讯录中；
用户设定的规则包括：与系统事件对应的联系人处于用户个人导入到工作区的通讯录中。
可选地，监测模块320配置为对系统事件进行监测，判断与系统事件对应的联系人是否为工作联系人；
其中，工作联系人为处于企业设定的企业通讯录中或处于用户个人导入到工作区的通讯录中的联系人。
可选地，系统事件包括以下中的任意一项：
接收短信、发送短信、拨打电话、接听电话、发生未接来电。
可选地，当系统事件为拨打电话或接听电话时，监测模块320被配置为按照如下方式对系统事件进行监测：
通过操作系统中指定的广播接收器进行事件接收，当接收到事件时，判定当前发生与事件对应的拨打电话事件或接听电话事件。
可选地，指定的广播接收器为PhoneStateReceiver广播接收器。
可选地，当系统事件为接收短信时，执行模块330配置为当短信的发件人为工作联系人时，拦截该短信进入系统收件箱，并将该短信存储到工作区中。
可选地，当系统事件为发送短信时，执行模块330配置为当短信的收件人为工作联系人时，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到工作区中。
可选地，当系统事件为拨打电话时，执行模块330配置为当电话为通过保存在工作区中的通讯录拨出时，将操作系统记录的该拨打记录删除，并记录在工作区中。
可选地，该装置300还包括：
判断模块340，配置为判断用户是否已设置在操作系统的通话记录中显示工作联系人的通话记录；
执行模块330还配置为当未设置在操作系统的通话记录中显示工作联系人的通话记录时，将操作系统记录的该拨打记录删除。
可选地，当系统事件为接听电话时，执行模块330配置为当电话的来电号码为工作联系人的号码时，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，装置还包括：
第一提示模块350，配置为提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除；
执行模块330还配置为当用户选择删除时，将该次接听电话产生的通话记录在操作系统的通话记录中删除。
可选地，当系统事件为发生未接来电时，执行模块330配置为当未接来电的来电号码为工作联系人的号码时，将该条未接来电的记录在操作系统的通话记录中删除，并复制到工作区中。
可选地，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，装置还包括：
第二提示模块360，配置为提示用户是否将该条未接来电的记录在操作系统的通话记录中删除；
执行模块330还配置为当用户选择删除时，将该条未接来电的记录在操作系统的通话记录中删除。
可选地，该装置300还包括：
第三提示模块370，配置为当用户欲访问工作区中的数据时，提示用户输入解锁码；
验证模块380，配置为接收并验证用户输入的解锁码是否正确；
访问模块390，配置为当验证模块380验证用户输入的解锁码正确时，允许用户访问工作区中的数据。
如图4所示，为本发明实施例所提供的保护装置的一种具体应用场景，包括：
员工设备，该员工设备相当于本发明实施例所提供的企业数据的保护装置，在员工设备中可安装有企业私有系统，该企业私有系统包括：
邮件系统、业务系统和OA(Office Automation，办公自动化)系统。
上述系统保存在员工设备中的工作区，用于以加密的方式保存企业数据，用户可通过输入密码对企业私有系统中的企业数据进行访问。
同时，员工设备与天机企业私有云服务相连，该云服务中保存有云安全服务，可将云安全服务的规则(例如企业设定的规则)推送到员工设备，员工设备需根据企业设定的规则进行工作区和个人区数据的隔离，以达到企业数据的安全。
并且，企业管理员可以在天机企业私有云服务中设定云安全服务的规则。
本发明实施例提供了一种企业数据的保护装置，通过在移动终端中建立存储企业数据的工作区，并以加密方式保存，同时对系统事件进行监测，当符合企业或用户设定的规则时，在工作区内执行与该事件对应的操作。可见，本发明实施例所提供的装置可以避免由于恶意程序的攻击造成的企业数据的泄漏，即使移动终端丢失，由于工作区已加密，其他人也不能读取得到企业数据，保证了企业数据的安全性，并且能不被恶意程序所获取。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入 该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的企业数据的保护装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图5示出了可以实现根据本发明的企业数据的保护方法的移动终端，例如游戏控制台，膝上型计算机，便携式媒体播放器，板式计算机，平板计算机，PDA，移动计算机，以及移动电话等等。该移动终端传统上包括处理器510和以存储器520形式的计算机程序产品或者计算机可读介质。存储器520可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器520具有用于执行上述方法中的任何方法步骤的程序代码531的存储空间530。例如，用于程序代码的存储空间530可以包括分别用于实现上面的方法中的各种步骤的各个程序代码531。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图6所述的便携式或者固定存储单元。该存储单元可以具有与图5的移动终端中的存储器520类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码531’，即可以由例如诸如510之类的处理器读取的代码，这些代码当由移动终端运行时，导致该移动终端执行上面 所描述的方法中的各个步骤。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
至此，本领域技术人员应认识到，虽然本文已详尽示出和描述了本发明的多个示例性实施例，但是，在不脱离本发明精神和范围的情况下，仍可根据本发明公开的内容直接确定或推导出符合本发明原理的许多其他变型或修改。因此，本发明的范围应被理解和认定为覆盖了所有这些其他变型或修改。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (32)

  1. 一种企业数据的保护方法，包括：
    在移动终端中建立用于存储企业数据的工作区；其中，所述工作区的数据采用加密的方式保存；
    对系统事件进行监测，并判断所述系统事件是否符合企业或用户设定的规则；
    当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作。
  2. 根据权利要求1所述的方法，其中，所述企业设定的规则包括：与所述系统事件对应的联系人处于所述企业设定的企业通讯录中；
    所述用户设定的规则包括：与所述系统事件对应的联系人处于用户个人导入到工作区的通讯录中。
  3. 根据权利要求2所述的方法，其中，所述对系统事件进行监测，并判断是否符合企业或用户设定的规则，包括：
    对系统事件进行监测，判断与所述系统事件对应的联系人是否为工作联系人；
    其中，所述工作联系人为处于所述企业设定的企业通讯录中或处于用户个人导入到工作区的通讯录中的联系人。
  4. 根据权利要求3所述的方法，其中，所述系统事件包括以下中的任意一项：
    接收短信、发送短信、拨打电话、接听电话、发生未接来电。
  5. 根据权利要求4所述的方法，其中，当系统事件为拨打电话或接听电话时，所述对系统事件进行监测包括：
    通过操作系统中指定的广播接收器进行事件接收，当接收到事件时，判定当前发生与所述事件对应的拨打电话事件或接听电话事件。
  6. 根据权利要求5所述的方法，其中，所述指定的广播接收器为PhoneStateReceiver广播接收器。
  7. 根据权利要求4所述的方法，其中，当所述系统事件为接收短信时，当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作，包括：
    当所述短信的发件人为所述工作联系人时，拦截该短信进入系统收件箱，并将该短信存储到所述工作区中。
  8. 根据权利要求4所述的方法，其中，当所述系统事件为发送短信时，当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作，包括：
    当所述短信的收件人为所述工作联系人时，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到所述工作区中。
  9. 根据权利要求4所述的方法，其中，当所述系统事件为拨打电话时，当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作，包括：
    当所述电话为通过保存在所述工作区中的通讯录拨出时，将操作系统记录的该拨打记录删除，并记录在所述工作区中。
  10. 根据权利要求9所述的方法，其中，在所述将操作系统记录的该拨打记录删除之前，还包括：
    判断是否已设置在操作系统的通话记录中显示工作联系人的通话记录；
    所述将操作系统记录的该拨打记录删除，包括：
    当未设置在所述操作系统的通话记录中显示工作联系人的通话记录时，将操作系统记录的该拨打记录删除。
  11. 根据权利要求4所述的方法，其中，当所述系统事件为接听电话时，当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作，包括：
    当所述电话的来电号码为所述工作联系人的号码时，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到所述工作区中。
  12. 根据权利要求11所述的方法，其中，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，在所述将该次接听电话产生的通话记录在操作系统的通话记录中删除之前，还包括：
    提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除；
    所述将该次接听电话产生的通话记录在操作系统的通话记录中删除，包括：
    当用户选择删除时，将该次接听电话产生的通话记录在操作系统的通话记录中删除。
  13. 根据权利要求4所述的方法，其中，当所述系统事件为发生未接来电时，当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作，包括：
    当所述未接来电的来电号码为所述工作联系人的号码时，将该条未接来电的记录在操作系统的通话记录中删除，并复制到所述工作区中。
  14. 根据权利要求13所述的方法，其中，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，在所述将该条未接来电的记录在操作系统的通话记录中删除之前，还包括：
    提示用户是否将该条未接来电的记录在操作系统的通话记录中删除；
    所述将该条未接来电的记录在操作系统的通话记录中删除，包括：
    当用户选择删除时，将该条未接来电的记录在操作系统的通话记录中删除。
  15. 根据权利要求1至14任一项所述的方法，还包括：
    当用户欲访问所述工作区中的数据时，提示用户输入解锁码；
    接收并验证所述用户输入的解锁码是否正确；
    当用户输入的解锁码正确时，允许所述用户访问所述工作区中的数据。
  16. 一种企业数据的保护装置，包括：
    建立模块，配置为在移动终端中建立用于存储企业数据的工作区；其中，所述工作区的数据采用加密的方式保存；
    监测模块，配置为对系统事件进行监测，并判断所述系统事件是否符合企业或用户设定的规则；
    执行模块，配置为当所述系统事件符合所述企业或用户设定的规则时，在所述工作区内执行与该事件对应的操作。
  17. 根据权利要求16所述的装置，其中，所述企业设定的规则包括：与所述系统事件对应的联系人处于所述企业设定的企业通讯录中；
    所述用户设定的规则包括：与所述系统事件对应的联系人处于用户个人导入到工作区的通讯录中。
  18. 根据权利要求17所述的装置，其中，所述监测模块配置为对系统事件进行监测，判断与所述系统事件对应的联系人是否为工作联系人；
    其中，所述工作联系人为处于所述企业设定的企业通讯录中或处于用户个人导入到工作区的通讯录中的联系人。
  19. 根据权利要求18所述的装置，其中，所述系统事件包括以下中的任意一项：
    接收短信、发送短信、拨打电话、接听电话、发生未接来电。
  20. 根据权利要求19所述的装置，其中，当系统事件为拨打电话或接听电话时，所述监测模块被配置为按照如下方式对系统事件进行监测：
    通过操作系统中指定的广播接收器进行事件接收，当接收到事件时，判定当前发生与所述事件对应的拨打电话事件或接听电话事件。
  21. 根据权利要求20所述的装置，其中，所述指定的广播接收器为PhoneStateReceiver广播接收器。
  22. 根据权利要求19所述的装置，其中，当所述系统事件为接收短信时，所述执行模块配置为当所述短信的发件人为所述工作联系人时，拦截该短信进入系统收件箱，并将该短信存储到所述工作区中。
  23. 根据权利要求19所述的装置，其中，当所述系统事件为发送短信时，所述执行模块配置为当所述短信的收件人为所述工作联系人时，拦截该短信的发送记录进入系统发件箱，并将该短信的发送记录存储到所述工作区中。
  24. 根据权利要求19所述的装置，其中，当所述系统事件为拨打电话时，所述执行模块配置为当所述电话为通过保存在所述工作区中的通讯录拨出时，将操作系统记录的该拨打记录删除，并记录在所述工作区中。
  25. 根据权利要求24所述的装置，其中，所述装置还包括：
    判断模块，配置为判断用户是否已设置在操作系统的通话记录中显示工作联系人的通话记录；
    所述执行模块还配置为当未设置在所述操作系统的通话记录中显示工作联系人的通话记录时，将操作系统记录的该拨打记录删除。
  26. 根据权利要求19所述的装置，其中，当所述系统事件为接听电话时，所述执行模块配置为当所述电话的来电号码为所述工作联系人的号码时，将该次接听电话产生的通话记录在操作系统的通话记录中删除，并复制到所述工作区中。
  27. 根据权利要求26所述的装置，其中，当接听电话的来电号码与操作系统的通讯录中的联系人号码重合时，所述装置还包括：
    第一提示模块，配置为提示用户是否将该次接听电话产生的通话记录在操作系统的通话记录中删除；
    所述执行模块还配置为当用户选择删除时，将该次接听电话产生的通话记录在操作系统的通话记录中删除。
  28. 根据权利要求19所述的装置，其中，当所述系统事件为发生未接来电时，所述执行模块配置为当所述未接来电的来电号码为所述工作联系人的号码时，将该条未接来电的记录在操作系统的通话记录中删除，并复制到所述工作区中。
  29. 根据权利要求28所述的装置，其中，当未接来电的来电号码与操作系统的通讯录中的联系人号码重合时，所述装置还包括：
    第二提示模块，配置为提示用户是否将该条未接来电的记录在操作系统的通话记录中删除；
    所述执行模块还配置为当用户选择删除时，将该条未接来电的记录在操作系统的通话记录中删除。
  30. 根据权利要求16至29任一项所述的装置，其中，所述装置还包括：
    第三提示模块，配置为当用户欲访问所述工作区中的数据时，提示用户输入解锁码；
    验证模块，配置为接收并验证所述用户输入的解锁码是否正确；
    访问模块，配置为当所述验证模块验证用户输入的解锁码正确时，允许用户访问所述工作区中的数据。
  31. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在移动终端上运行时，导致所述移动终端执行根据权利要求1至15中的任一项所述的企业数据的保护方法。
  32. 一种计算机可读介质，其中存储了如权利要求31所述的计算机程序。
PCT/CN2014/093391 2013-12-10 2014-12-09 企业数据的保护方法和装置 WO2015085906A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310666504.2 2013-12-10
CN201310666504.2A CN103685266B (zh) 2013-12-10 2013-12-10 企业数据的保护方法和装置

Publications (1)

Publication Number Publication Date
WO2015085906A1 true WO2015085906A1 (zh) 2015-06-18

Family

ID=50321581

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/093391 WO2015085906A1 (zh) 2013-12-10 2014-12-09 企业数据的保护方法和装置

Country Status (2)

Country Link
CN (1) CN103685266B (zh)
WO (1) WO2015085906A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110427302A (zh) * 2019-07-29 2019-11-08 努比亚技术有限公司 触发内容观察者的方法、移动终端及计算机可读存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015085819A1 (zh) * 2013-12-10 2015-06-18 北京奇虎科技有限公司 一种公私隔离的方法及装置
CN103685266B (zh) * 2013-12-10 2016-11-09 北京奇虎科技有限公司 企业数据的保护方法和装置
CN104462997B (zh) * 2014-12-04 2017-05-24 北京奇虎测腾科技有限公司 一种保护移动终端上工作数据的方法、装置和系统
CN104954591B (zh) * 2015-06-05 2018-07-31 小米科技有限责任公司 电话通信方法及装置
CN105610671A (zh) * 2016-01-11 2016-05-25 北京奇虎科技有限公司 一种终端数据保护的方法及装置
CN111339543B (zh) * 2020-02-27 2023-07-14 深信服科技股份有限公司 一种文件处理方法及装置、设备、存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101026822A (zh) * 2006-02-24 2007-08-29 江苏高通科技实业有限公司 一种保护手机隐私资料的方法
CN102982289A (zh) * 2012-11-14 2013-03-20 广东欧珀移动通信有限公司 一种数据保护的方法及移动智能终端
US20130117742A1 (en) * 2011-08-05 2013-05-09 Vmware, Inc. Sharing work environment information sources with personal environment applications
CN103685266A (zh) * 2013-12-10 2014-03-26 北京奇虎科技有限公司 企业数据的保护方法和装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9665576B2 (en) * 2012-05-14 2017-05-30 International Business Machines Corporation Controlling enterprise data on mobile device via the use of a tag index
CN103390026B (zh) * 2013-06-20 2017-08-25 中国软件与技术服务股份有限公司 一种移动智能终端安全浏览器及其工作方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101026822A (zh) * 2006-02-24 2007-08-29 江苏高通科技实业有限公司 一种保护手机隐私资料的方法
US20130117742A1 (en) * 2011-08-05 2013-05-09 Vmware, Inc. Sharing work environment information sources with personal environment applications
CN102982289A (zh) * 2012-11-14 2013-03-20 广东欧珀移动通信有限公司 一种数据保护的方法及移动智能终端
CN103685266A (zh) * 2013-12-10 2014-03-26 北京奇虎科技有限公司 企业数据的保护方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110427302A (zh) * 2019-07-29 2019-11-08 努比亚技术有限公司 触发内容观察者的方法、移动终端及计算机可读存储介质

Also Published As

Publication number Publication date
CN103685266B (zh) 2016-11-09
CN103685266A (zh) 2014-03-26

Similar Documents

Publication Publication Date Title
WO2015085906A1 (zh) 企业数据的保护方法和装置
US11882221B2 (en) Mobile terminal privacy protection method and protection apparatus, and mobile terminal
US20190109835A1 (en) User authentication using unique hidden identifiers
US9532212B2 (en) Method and apparatus for processing data and message
KR20190109768A (ko) 임시 컨텐츠 메시지를 처리하기 위한 방법들 및 시스템들
CN103647784B (zh) 一种公私隔离的方法和装置
US20150350148A1 (en) Healthcare secure messaging and reminder system
WO2016130466A1 (en) Systems and methods for managing access to message content
KR102491360B1 (ko) 사용자가 컴퓨팅 디바이스를 동작시킬 수 있는 사용자 계정을 제공하기 위한 시스템 및 방법
CN104462997A (zh) 一种保护移动终端上工作数据的方法、装置和系统
Rottermanner et al. Privacy and data protection in smartphone messengers
WO2012151975A1 (zh) 终端信息保密方法及装置
WO2015085819A1 (zh) 一种公私隔离的方法及装置
US11671531B1 (en) Techniques for managing communications between devices
WO2012151658A1 (en) Methods and device for providing dynamic communication options
US20160294787A1 (en) Secure and confidential messaging systems
CN106714147A (zh) 一种隐私短信的保护方法
US8849247B2 (en) Remote mobile device information retrieval
US11445057B2 (en) Private contact sharing
Judge Mobile forensics: Analysis of the messaging application signal
US11122014B2 (en) User device and method of providing notification in messaging application on user device
Silla WeChat forensic artifacts: Android phone extraction and analysis
CN111263356A (zh) 终端设备的短消息处理方法、系统、电子设备及存储介质
EP3834398A1 (en) Encrypted messaging system
JP2019139334A (ja) 内部通報管理システム及び内部通報管理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14869054

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14869054

Country of ref document: EP

Kind code of ref document: A1