WO2022078222A1

WO2022078222A1 - File security management terminal and system

Info

Publication number: WO2022078222A1
Application number: PCT/CN2021/121874
Authority: WO
Inventors: 肖列; 鲍江锭; 江晨
Original assignee: 杭州来布科技有限公司
Priority date: 2020-10-14
Filing date: 2021-09-29
Publication date: 2022-04-21
Also published as: CN112329050A

Abstract

A file security management terminal and system. A plurality of application programs are installed in the terminal, and a plurality of files are stored in the terminal; the permission for the application programs to access files corresponding to a secure file directory is set, and the secure file directory corresponds to a plurality of files; a file filtering driver installed in the terminal is used for verifying the permissions of the application programs; and the application programs with access permission access the files corresponding to the secure file directory after passing verification by the file filtering driver. The access permissions of application programs are limited by means of defining a secure file directory, and the permission of the application programs is verified by means of a file filtering driver, so as to ensure that only authorized application programs can access protected files, thereby improving the file security.

Description

A file security management terminal and system

technical field

The present invention relates to the field of file management, and more particularly, to a file security management terminal and system.

Background technique

Electronic files widely exist in various smart terminals. While improving work efficiency, electronic files also have security risks. Once electronic files are stolen, it will bring huge losses to users. Especially for places with high confidentiality requirements such as R&D enterprises and government departments, how to ensure the safe and controllable use of files has always been a problem that needs to be solved.

technical problem

The technical problem to be solved by the present invention is to provide a file security management terminal and system aiming at the above-mentioned defects of the prior art.

technical solutions

The technical solution adopted by the present invention to solve the technical problem is as follows: constructing a file security management terminal, the terminal is installed with multiple application programs and stored with multiple files, and the permissions of the application programs to access the files corresponding to the security file directory are set, so that the The security file directory corresponds to multiple files;

The file filter driver installed on the terminal is used to verify the authority of the application program, and the application program with the access authority accesses the file corresponding to the secure file directory after being verified by the file filter driver.

Further, in the file security management terminal of the present invention, the terminal further includes a first identity verification unit for verifying the user account to use the file authority corresponding to the secure file directory, and after the first identity verification unit has passed the verification The user account is allowed to access files corresponding to the secure file directory.

Further, in the file security management terminal of the present invention, the user identity information verified by the first identity verification unit includes user account, user password, user fingerprint, user face information, mobile phone number, e-mail, electronic dog, One or more of USBKey.

Further, in the file security management terminal of the present invention, the authority of each user account to access files in the secure file directory is set.

Further, in the file security management terminal of the present invention, the permission of the application program to access the file corresponding to the secure file directory includes the permission to read the file, the permission to write the file, the permission to create a new file, and the permission to save a file;

The application program prohibits access to files other than the secure file directory stored on the terminal.

Further, in the file security management terminal of the present invention, the security file directory is a security folder, and files corresponding to the security file directory are stored in the security folder.

Further, in the file security management terminal of the present invention, the file is an encrypted file;

In the process of reading the encrypted file, the file filter driver is used to decrypt the encrypted file and transmit the decrypted data to the application program;

In the process of writing the encrypted file, the file filter driver is configured to encrypt the data generated by the application program and save it into the encrypted file.

Further, in the file security management terminal of the present invention, the encrypted file is encrypted using a stream encryption algorithm, and no other information is attached during the encryption process, and the file filtering driver uses the stream encryption algorithm to encrypt and decrypt data. .

Further, in the file security management terminal of the present invention, the terminal further includes a sending unit and a receiving unit;

The sending unit is configured to send the encrypted file, and the receiving unit is configured to receive the encrypted file and store the received encrypted file in the secure file directory.

Further, in the file security management terminal of the present invention, the terminal further includes a first usage recording unit, and the first usage recording unit is used to record all operation records of the file.

Further, in the file security management terminal of the present invention, in the process of accessing the file corresponding to the secure file directory, the application program prohibits one of the cross-application copy operation, the cross-application paste operation, the screen capture operation, and the screen recording operation. species or several.

In addition, the present invention also provides a file security management system, including a file security server and a plurality of terminals, wherein the security server communicates with each of the terminals respectively;

Each of the terminals is installed with multiple applications and stored with multiple files, and the permissions of the applications to access files corresponding to the secure file directory are set, and the secure file directory corresponds to multiple files; the files installed on the terminal are filtered The driver is used to verify the authority of the application program, and the application program with the access authority can access the file corresponding to the safe file directory after being verified by the file filter driver.

Further, in the file security management system of the present invention, at least two of the terminals are located in the same local area network, the files are transmitted between the two terminals in the local area network, and the received files are saved in the secure file directory .

Further, in the file security management system of the present invention, the terminal sets the management information of the file before sending the file, and simultaneously sends the file and the management information.

Further, in the file security management system of the present invention, the file is an encrypted file;

Further, in the file security management system of the present invention, the encrypted file is encrypted using a stream encryption algorithm, and no other information is attached during the encryption process, and the file filter driver uses the stream encryption algorithm to encrypt and decrypt data. .

Further, in the file security management system of the present invention, the encrypted file is transmitted between the two terminals, and the received encrypted file is saved in the secure file directory.

Further, in the file security management system of the present invention, the two terminals are located in the Internet.

Further, in the file security management system of the present invention, the terminal sets the management information of the encrypted file before sending the encrypted file, and simultaneously sends the encrypted file and the management information.

Further, in the file security management system of the present invention, the management information includes one of a whitelist of usage rights, a blacklist of usage rights, the number of times of use of files, the time of file use, the time of automatic file destruction, and the one-key destruction of files. multiple.

Further, in the file security management system of the present invention, the file security server includes a second identity verification unit for verifying the user account using the corresponding file authority of the secure file directory, and the second identity verification unit passes the verification Then, the user account is allowed to access the file corresponding to the secure file directory.

Further, in the file security management system of the present invention, the user identity information verified by the second identity verification unit is uploaded to the file security server by the terminal, and the user identity information includes user account, user password, USBKey, user One or more of fingerprints, user face information, and electronic certificates.

Further, in the file security management system of the present invention, the file security server includes a second usage recording unit, and the second usage recording unit is used to record all operation records of the file, and the operation records are recorded by the terminal Upload the file to the secure server.

Further, in the file security management system of the present invention, in the process of accessing the file corresponding to the security file directory, the application program prohibits one of the cross-application copy operation, the cross-application paste operation, the screen capture operation, and the screen recording operation. species or several.

Further, in the file security management system of the present invention, the file security server further includes:

An approval request processing unit for approving user requests; and/or

A usage monitoring unit for monitoring file usage; and/or

an attribute change unit for changing document attribute information; and/or

Destruction instruction delivery unit for delivering file destruction instructions.

beneficial effect

Implementing a file security management terminal and system of the present invention has the following beneficial effects: the present invention limits the access authority of the application program by defining a safe file directory, and verifies the authority of the application program through the file filter driver to ensure that only authorized only applications can access protected files, improving file security.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings and embodiments, in which:

1 is a schematic structural diagram of a file security management terminal provided by an embodiment;

2 is a schematic structural diagram of a file security management terminal provided by an embodiment;

3 is a schematic structural diagram of a file security management terminal provided by an embodiment;

FIG. 4 is a schematic structural diagram of a file security management system provided by an embodiment.

BEST MODE FOR CARRYING OUT THE INVENTION

In order to have a clearer understanding of the technical features, objects and effects of the present invention, the specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

Example 1

Referring to FIG. 1 , the file security management terminal in this embodiment may be an intelligent terminal such as a desktop computer, a notebook computer, a tablet computer, a smart phone, a smart watch, etc. The intelligent terminal is installed with an operating system, and the operating system can use Windows system, IOS system, Android system system, Linux system, etc., the terminal is installed with multiple application programs (APP) and stored with multiple files, for example, the applications are Office, AutoCAD, UG, SolidWorks, etc. In order to limit the access authority of the file, in this embodiment, a security file directory is set on the terminal, the security file directory corresponds to a plurality of files, and the permission of each application program to access the file corresponding to the security file directory is set, that is, the application program can access the security file directory. files in the files directory. Specifically, the permissions of the application program to access files corresponding to the secure file directory include read file permissions, write file permissions, new file permissions, and save file permissions; and the application program prohibits access to files other than the secure file directory stored on the terminal, so that The access scope of the application is strictly limited, and the application can only use the files in the secure file directory. Alternatively, the secure file directory is a secure folder, and files corresponding to the secure file directory are stored in the secure folder, that is, the files in the secure folder are access-restricted files.

Further, a file filter driver is installed on the terminal in this embodiment, and the file is used to verify the authority of the application program, and the application program with the access authority accesses the file corresponding to the secure file directory after passing the verification of the file filter driver. That is to say, the file filter driver in this embodiment is a "safety gate" set between the application program and the file. When the application program wants to access the files in the secure file directory, the terminal will automatically start the file filter driver to verify the application. The permission of the program, check whether the application has the permission to access the files in the secure file directory; after verification, if the application has permission to access the files in the secure file directory, the application is allowed to read the file; if the application does not If you have permission to access files in the secure file directory, the application is prohibited from loading the file, and a prompt message will pop up. That is to say, the secure directory does not allow access by programs other than dedicated secure directory management applications and registration applications, and the secure directory cannot be operated through system operations, operations including file and directory move, copy, delete, read, Revise.

In this embodiment, the access authority of the application program is limited by defining a secure file directory, and the authority of the application program is verified by the file filter driver, so as to ensure that only the authorized application program can access the protected file, and the file security is improved.

Example 2

On the basis of Embodiment 1, in order to further ensure the security of files in the secure file directory, the file security management terminal of this embodiment further includes a first identity verification unit for verifying the user account using the corresponding file authority of the secure file directory. User identity information needs to be verified when accessing files in the secure file directory, and the first identity verification unit searches whether the user account is a legal account and the authority corresponding to the user account. After verification, if the user account is allowed to access the file corresponding to the secure file directory after the first authentication unit is verified, the user is allowed to use the application to access the files in the secure file directory, but the application still needs to access the files in the secure file directory. The verification authority is driven by the file, and the verification process may refer to the above-mentioned embodiment, which will not be repeated here. Alternatively, the user identity information verified by the first identity verification unit includes but is not limited to user account, user password, user fingerprint, user face information, mobile phone number, e-mail, electronic dog, USBKey, etc., one or more can be selected as required indivual.

Further, the file security management terminal of this embodiment can also set permissions for each user account to access files in the secure file directory, that is, set each user account to access some files in the secure file directory, and the permissions for each user account may be different. Alternatively, in this embodiment, the permission for each user account to use the application program may be set, that is, the application program that each user account can use and which application programs cannot be used is limited.

In this embodiment, each user has a corresponding user account. When a user wants to use a file in the secure file directory, he first needs to log in to his user account, and the first identity verification unit verifies the user's identity and user authority. to determine whether the user can access the secure file directory. In this embodiment, an authentication unit is set to further ensure the safe use of files.

Example 3

On the basis of the above embodiment, in order to further ensure the security of the files in the secure file directory, the files in the file security management terminal of this embodiment are encrypted files, and the files are driven by the files set between the application program and the files for encryption. and decryption. Specifically, in the process of reading the encrypted file, the file filter driver is used to decrypt the encrypted file and transmit the decrypted data to the application program; in the process of writing the encrypted file, the file filter driver is used to encrypt the data generated by the application program. and save it to an encrypted file.

Alternatively, the encrypted file in this embodiment is encrypted using a stream encryption algorithm, which does not add any other information during the encryption process, and the file filtering driver uses the stream encryption algorithm to encrypt and decrypt data. It can be understood that ordinary encryption algorithms need to add additional information such as file headers, IDs, and control information, while the stream encryption algorithm of the present application does not add any other information during the encryption process, that is, it is not necessary to add additional information such as file headers, IDs, and control information. , which makes the encrypted file exactly the same size as the original file. Using the file filter driver at the filter driver layer achieves the simplest technology implementation, and achieves the highest encryption and decryption efficiency, so that encrypted files are always in the secure file directory, and there are no unencrypted original files, even if the terminal is violently disassembled , it is still unable to decrypt encrypted files without a file filter driver, thus effectively preventing the problem of file leakage due to violent disassembly of the storage device.

In this embodiment, the files in the secure file directory are all encrypted files, and the stream encryption algorithm without additional information is used, and the file filter driver is used for encryption and decryption, which further ensures file security and can effectively prevent leakage due to violent disassembly of the storage device. file problem.

Example 4

Referring to FIG. 2, on the basis of the above-mentioned embodiment, the file security management terminal of this embodiment further includes a sending unit and a receiving unit, the sending unit is used for sending files under the security file directory, and the receiving unit is used for receiving the security of other terminals. If the file is not stored in the secure file directory, the file cannot be used.

Alternatively, if the sent file is an ordinary file, that is, an unencrypted file, the sending unit is used to send the file in the secure file directory, and the receiving unit is used to receive the file in the secure file directory of other terminals, and the received file is stored in the Under the file security directory of the terminal, if the file is not stored in the security file directory, the file cannot be used.

Alternatively, if the file is an encrypted file, the sending unit is configured to send the encrypted file, and the receiving unit is configured to receive the encrypted file and store the received encrypted file in the secure file directory. Similarly, if the encrypted file is not stored in the secure file directory, the encrypted file cannot be used. As an option, files sent between terminals can be sent over a network, or a removable storage device can be used to copy files.

Referring to Fig. 3, in order to further ensure the safety of the file under the safe file directory, the terminal of the present embodiment sets the management information of the encrypted file before sending the encrypted file, and simultaneously sends the encrypted file and the management information, wherein the management information and the encrypted file are an integral file. . Optionally, the management information includes, but is not limited to, a whitelist of usage rights, a blacklist of usage rights, the number of times the file is used, the usage time of the file, the time of automatic file destruction, and the one-click destruction of the file, where the whitelist of usage rights refers to the right to use the file The use rights blacklist refers to the user accounts that are prohibited from using the file; the number of file usages refers to the maximum number of times the file can be used, after which the file cannot be used; the file usage time refers to once the file is used The time of opening and use, when the accumulated time of the file being opened and used reaches the time of use of the file, it will only continue to use the file; the automatic file destruction time means that the file is automatically destroyed at the set destruction time; the one-click file destruction means that the file can be destroyed at the set time. Destroyed when a preset key signal is received. It can be understood that the management information of the encrypted file cannot be listed exhaustively, and the information that can manage the file can be used as the management information of the encrypted file.

In this embodiment, when transferring files between terminals, the received file needs to be stored in the secure file directory. If the receiving terminal does not have a secure file directory, the received file cannot be used, so as to ensure that the file is still in a controlled state after the transfer, ensuring that File security.

Example 5

On the basis of the above embodiment, the file security management terminal of this embodiment further includes a first usage recording unit, which is used to record all operation records of the file, including but not limited to user account login time, Application operation records, file modification time, file modification content, file moving time, file moving location, file deletion time, file copying time, etc. Administrators have permission to view operation records, while other users do not have permission to view operation records.

In this embodiment, the file operation record is recorded at any time, so as to facilitate the later checking of the file usage.

Example 6

On the basis of the above embodiment, in order to further ensure the security of files in the secure file directory, in the file security management terminal of this embodiment, in the process of accessing the file corresponding to the secure file directory, the application program prohibits cross-application copy operation and cross-application paste operation Operations, screenshot operations, and screen recording operations are file content transfer operations. The cross-application copy operation refers to copying content between different applications, and the cross-application paste operation refers to pasting content between different applications.

This embodiment prohibits the cross-application copy operation, the cross-application paste operation, the screen capture operation, and the screen recording operation file content transfer operation, which can effectively prevent the file content from being moved during the use of the file, and effectively protect the file security.

Example 7

1 to 4 , the file security management system of this embodiment includes a file security server and multiple terminals, and the security server communicates with each terminal respectively. The structure and function of the terminals refer to the above-mentioned embodiments and will not be repeated here. Each terminal is installed with multiple applications and stored with multiple files. Set the permission of the application to access the file corresponding to the secure file directory, and the security file directory corresponds to multiple files; the file filter driver installed on the terminal is used to verify the permissions of the application , the application program with access permission can access the file corresponding to the secure file directory after passing the verification of the file filter driver.

Example 8

On the basis of the above embodiment, in the file security management system of this embodiment, at least two terminals are located in the same local area network or the Internet, and the two terminals transmit files and save the received files in the secure file directory. The file security management terminal in this embodiment further includes a sending unit and a receiving unit, the sending unit is used for sending files in the secure file directory, and the receiving unit is used for receiving files in the secure file directories of other terminals, and sends the received files It is stored in the file security directory of the terminal. If the file is not stored in the security file directory, the file cannot be used.

Alternatively, if the file is an encrypted file, the sending unit is configured to send the encrypted file, and the receiving unit is configured to receive the encrypted file and store the received encrypted file in the secure file directory. Similarly, if the encrypted file is not stored in the secure file directory, the encrypted file cannot be used. In the process of using the encrypted file, the terminal is driven by the file set between the application and the file to encrypt and decrypt. Specifically, in the process of reading the encrypted file, the file filter driver is used to decrypt the encrypted file and transmit the decrypted data to the application program; in the process of writing the encrypted file, the file filter driver is used to encrypt the data generated by the application program. and save it to an encrypted file. Alternatively, the encrypted file in this embodiment is encrypted using a stream encryption algorithm, which does not add any other information during the encryption process, and the file filtering driver uses the stream encryption algorithm to encrypt and decrypt data. It can be understood that ordinary encryption algorithms need to add additional information such as file headers, IDs, and control information, while the stream encryption algorithm of the present application does not add any other information during the encryption process, that is, it is not necessary to add additional information such as file headers, IDs, and control information. , which makes the encrypted file exactly the same size as the original file. Using the file filter driver at the filter driver layer achieves the simplest technology implementation, and achieves the highest encryption and decryption efficiency, so that encrypted files are always in the secure file directory, and there are no unencrypted original files, even if the terminal is violently disassembled , it is still unable to decrypt encrypted files without a file filter driver, thus effectively preventing the problem of file leakage due to violent disassembly of the storage device.

Example 9

On the basis of the above-mentioned embodiment, the file security server in the file security management system of this embodiment includes a second identity verification unit for verifying the file authority corresponding to the user account using the secure file directory, and the second identity verification unit allows the user to pass the verification. The account accesses the file corresponding to the secure file directory. The terminal uploads the received user identity information to the file security server, and the second identity verification unit searches whether the user account is a legal account and the authority corresponding to the user account. After verification, if the user account is allowed to access the file corresponding to the secure file directory after the second authentication unit is verified, the user is allowed to use the application to access the file in the secure file directory, but the application still needs to access the file in the secure file directory. The verification authority is driven by the file, and the verification process may refer to the above-mentioned embodiment, which will not be repeated here. Alternatively, the user identity information verified by the second identity verification unit includes but is not limited to user account, user password, user fingerprint, user face information, mobile phone number, e-mail, electronic dog, USBKey, etc., one or more can be selected as required indivual.

Further, the file security server of this embodiment may further set the authority of each user account to access files in the secure file directory, that is, set each user account to access some files in the secure file directory, and the authority of each user account may be different. Alternatively, in this embodiment, the permission for each user account to use the application program may be set, that is, the application program that each user account can use and which application programs cannot be used is limited.

In this embodiment, each user has a corresponding user account. When the user wants to use the file in the secure file directory, he needs to log in to the file security server, and the second identity verification unit verifies the user's identity and user authority to determine Whether the user can access the secure file directory. In this embodiment, an authentication unit is set to further ensure the safe use of files.

Example 10

On the basis of the above embodiment, the file security management terminal of this embodiment further includes a second usage recording unit, and the second usage recording unit is used to record all operation records of the file. The operation records include but are not limited to the user account login time, Application operation records, file modification time, file modification content, file moving time, file moving location, file deletion time, file copying time, etc. The operation records are uploaded by the terminal to the file security server. Administrators have the right to view the operation records, and can log in to the file security server to view the usage records of each user. Other users do not have the right to view the operation records.

Example 11

On the basis of the above embodiments, the file security server in some file security management systems further includes: an approval request processing unit for approving user requests, the user uploads the request information through the terminal, and the administrator can view and review the request by logging in to the file security server information.

On the basis of the above embodiments, the file security server in some file security management systems further includes: a usage monitoring unit for monitoring file usage, and sends monitoring report information to the management terminal when the monitored file is used.

On the basis of the above-mentioned embodiments, the file security server in some file security management systems further includes: an attribute changing unit for changing file attribute information. The attribute change unit on the server sends the change information to the target terminal, and the target terminal executes the change information to change the file attribute.

On the basis of the above embodiments, the file security server in some file security management systems further includes: a destruction instruction delivery unit for delivering a file destruction instruction. When a certain file needs to be destroyed, the management terminal transmits the destruction instruction through the file security server. The unit sends a destruction instruction to the target terminal, and the target terminal destroys the target file after receiving the destruction execution.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method.

Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, the above description has generally described the components and steps of each example in terms of function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. Software modules can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

The above embodiments are only intended to illustrate the technical concept and characteristics of the present invention, and the purpose is to enable those skilled in the art to understand the content of the present invention and implement accordingly, and cannot limit the protection scope of the present invention. All equivalent changes and modifications made with the scope of the claims of the present invention shall fall within the scope of the claims of the present invention.

Claims

A file security management terminal, wherein the terminal is installed with a plurality of application programs and stored with a plurality of files, characterized in that a permission of the application program to access a file corresponding to a security file directory is set, and the security file directory corresponds to a plurality of files;

The file filter driver installed on the terminal is used to verify the authority of the application program, and the application program with the access authority accesses the file corresponding to the secure file directory after being verified by the file filter driver.
The file security management terminal according to claim 1, wherein the terminal further comprises a first identity verification unit for verifying a user account using the file authority corresponding to the secure file directory, and the first identity verification unit verifies After passing, the user account is allowed to access the file corresponding to the secure file directory.
The file security management terminal according to claim 2, wherein the user identity information verified by the first identity verification unit includes user account, user password, user fingerprint, user face information, mobile phone number, e-mail, electronic One or more of dog and USBKey.
The file security management terminal according to claim 2, characterized in that a permission of each of the user accounts to access files in the secure file directory is set.
The file security management terminal according to claim 1, wherein the permission of the application program to access the file corresponding to the secure file directory includes a permission to read a file, a permission to write a file, a permission to create a new file, and a permission to save a file;

The application program prohibits access to files other than the secure file directory stored on the terminal.
The file security management terminal according to claim 1, wherein the security file directory is a security folder, and the files corresponding to the security file directory are stored in the security folder.
The file security management terminal according to claim 1, wherein the file is an encrypted file;

In the process of reading the encrypted file, the file filter driver is used to decrypt the encrypted file and transmit the decrypted data to the application program;

In the process of writing the encrypted file, the file filter driver is configured to encrypt the data generated by the application program and save it into the encrypted file.
The file security management terminal according to claim 7, wherein the encrypted file is encrypted using a stream encryption algorithm, and no other information is attached during the encryption process, and the file filtering driver uses the stream encryption algorithm to encrypt data and decryption.
The file security management terminal according to claim 7, wherein the terminal further comprises a sending unit and a receiving unit;

The sending unit is configured to send the encrypted file, and the receiving unit is configured to receive the encrypted file and store the received encrypted file in the secure file directory.
The file security management terminal according to claim 6, wherein the terminal further comprises a first usage recording unit, and the first usage recording unit is used to record all operation records of the file.
The file security management terminal according to claim 1, wherein the application program prohibits cross-application copy operation, cross-application paste operation, screen capture operation, and screen recording operation during the process of accessing the file corresponding to the secure file directory one or more of them.
A file security management system, characterized in that it includes a file security server and a plurality of terminals, wherein the security server communicates with each of the terminals respectively;

Each of the terminals is installed with multiple applications and stored with multiple files, and the permissions of the applications to access files corresponding to the secure file directory are set, and the secure file directory corresponds to multiple files; the files installed on the terminal are filtered The driver is used to verify the authority of the application program, and the application program with the access authority can access the file corresponding to the safe file directory after being verified by the file filter driver.
The file security management system according to claim 12, wherein at least two of the terminals are located in the same local area network, the files are transmitted between the two terminals in the local area network, and the received files are saved in the security File Directory.
The file security management system according to claim 13, wherein the terminal sets the management information of the file before sending the file, and simultaneously sends the file and the management information.
The file security management system according to claim 12, wherein the file is an encrypted file;

In the process of reading the encrypted file, the file filter driver is used to decrypt the encrypted file and transmit the decrypted data to the application program;

In the process of writing the encrypted file, the file filter driver is configured to encrypt the data generated by the application program and save it into the encrypted file.
The file security management system according to claim 15, wherein the encrypted file is encrypted using a stream encryption algorithm, and no other information is attached during the encryption process, and the file filtering driver uses the stream encryption algorithm to encrypt data and decryption.
The file security management system according to claim 15, wherein the encrypted file is transmitted between the two terminals, and the received encrypted file is saved in the secure file directory.
The file security management system according to claim 17, wherein the two terminals are located in the Internet.
The file security management system according to claim 17, wherein the terminal sets the management information of the encrypted file before sending the encrypted file, and simultaneously sends the encrypted file and the management information.
The file security management system according to claim 14 or 19, wherein the management information includes a whitelist of usage rights, a blacklist of usage rights, the number of times of use of files, the time of file use, the time of automatic file destruction, and the one-key destruction of files one or more of.
The file security management system according to claim 12, wherein the file security server comprises a second identity verification unit for verifying a user account using the file authority corresponding to the secure file directory, the second identity verification unit After the verification is passed, the user account is allowed to access the file corresponding to the secure file directory.
The file security management system according to claim 21, wherein the user identity information verified by the second identity verification unit is uploaded to the file security server by the terminal, and the user identity information includes a user account, a user password, a USBKey , one or more of user fingerprint, user face information, and electronic certificate.
The file security management system according to claim 12, wherein the file security server comprises a second usage recording unit, and the second usage recording unit is configured to record all operation records of the file, and the operation records The file security server is uploaded by the terminal.
The file security management system according to claim 12, wherein, in the process of accessing the file corresponding to the secure file directory, the application program prohibits cross-application copy operation, cross-application paste operation, screen capture operation, and screen recording operation one or more of them.
The file security management system according to claim 12, wherein the file security server further comprises:

An approval request processing unit for approving user requests; and/or

A usage monitoring unit for monitoring file usage; and/or

an attribute change unit for changing document attribute information; and/or

Destruction instruction delivery unit for delivering file destruction instructions.