CN103685266B - Enterprise data protection method and device - Google Patents

Abstract

The invention provides guard method and the device of a kind of business data.The method includes: set up the workspace for storing business data in the terminal；Wherein, the mode of the data acquisition encryption of workspace preserves；System event is monitored, and judges whether system event meets enterprise or the rule of user's setting；When system event meet that enterprise or user set regular when, perform and the corresponding operation of this event in workspace.By the invention it is possible to avoid the leakage of the business data causing due to the attack of rogue program, even if mobile terminal is lost, owing to workspace is encrypted, other people can not read and obtain business data, it is ensured that the security of business data, and can not be obtained by the malicious programs.

Description

Enterprise data protection method and device

technical field

The invention relates to the field of information security, in particular to a method and device for protecting enterprise data. Background technique

With the maturity and popularization of smart terminals, personal smart terminal devices represented by mobile phones and tablets have gradually entered the enterprise field. In the future, enterprises will support employees to run enterprise office applications on personal mobile terminals. This phenomenon called BYOD (Bring Your Own Device) brings new challenges to enterprise security and management.

In this case, since employees are allowed to work conveniently through mobile terminals, mobile terminals need to save corporate data for work, such as emails, short messages, call records, contact information, etc., and also save users' private data .

However, due to the following situations: first, the mobile terminals of enterprise employees can access the mobile Internet or public/home networks at any time and anywhere, and the enterprise data in the mobile terminals will also be exposed to attacks from the Internet. security flaws. Second, there are both personal applications and enterprise applications and data on the same mobile terminal. Personal applications can access and store enterprise data at will, so there is a risk that enterprise data will be illegally uploaded, shared, and leaked by personal applications. Third, mobile terminals are easy to lose, and sensitive enterprise data stored in mobile terminals is also exposed to the risk of leakage. The loss of devices not only means the leakage and loss of sensitive business information, but the lost devices may also become a springboard for attacking corporate networks . Fourth, as the mobile Internet is becoming more and more popular today, attackers have begun to shift their attention from PCs to mobile terminals. Mobile terminals have become a new breeding ground for security risks, and can easily become a springboard for hackers to infiltrate corporate intranets.

Therefore, under the current circumstances, the chaotic storage of enterprise data and user's private data in the mobile terminal has poor security, which easily leads to leakage risks of enterprise data, and enterprise data is easily obtained by malicious programs.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a protection method and corresponding device suitable for enterprise data that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a method for protecting enterprise data is provided, including:

Establish a workspace for storing enterprise data in the mobile terminal; among them, the data in the workspace is stored in an encrypted manner;

Monitor system events and judge whether system events comply with the rules set by the enterprise or users;

When a system event meets the rules set by the enterprise or the user, the operation corresponding to the event is executed in the work area.

Optionally, the rules set by the enterprise include: the contact person corresponding to the system event is in the enterprise address book set by the enterprise;

The rules set by the user include: the contacts corresponding to the system events are in the address book that the user personally imports into the workspace.

Optionally, monitor system events and judge whether they comply with the rules set by the enterprise or users, including:

Monitor system events and determine whether the contact corresponding to the system event is a work contact;

Wherein, the work contact is a contact in the corporate address book set by the enterprise or in the address book imported by the user into the workspace.

Optionally, system events include any of the following:

Receive text messages, send text messages, make calls, answer calls, and miss calls.

Optionally, when the system event is making a call or receiving a call, monitoring the system event includes:

The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring.

Optionally, the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.

Optionally, when the system event is receiving a text message, when the system event meets the rules set by the enterprise or the user, the operation corresponding to the event is performed in the work area, including:

When the sender of the short message is a work contact, the short message is intercepted and entered into the system inbox, and the short message is stored in the work area.

Optionally, when the system event is sending a short message, when the system event meets the rules set by the enterprise or the user, the operation corresponding to the event is performed in the work area, including:

When the recipient of the short message is a work contact, the sending record of the short message is intercepted and entered into the system outbox, and the sending record of the short message is stored in the work area.

Optionally, when the system event is a phone call, when the system event meets the rules set by the enterprise or the user, the operation corresponding to the event is performed in the work area, including:

When the call is dialed out through the address book stored in the work area, the call record recorded by the operating system is deleted and recorded in the work area.

Optionally, before deleting the dialing record recorded by the operating system, further include:

Determine whether the user has set the call records of work contacts to be displayed in the call records of the operating system;

Delete the call records recorded by the operating system, including:

When the call record of the work contact is not set to be displayed in the call record of the operating system, the call record recorded by the operating system is deleted.

Optionally, when the system event is answering a call, when the system event conforms to the rules set by the enterprise or the user, the operation corresponding to the event is executed in the work area, including:

When the caller number of the phone is the work contact number, the call record generated by answering the call is deleted in the call record of the operating system and copied to the work area.

Optionally, when the caller number for answering the call coincides with the contact number in the address book of the operating system, before deleting the call record generated by answering the call in the call record of the operating system, further include:

Prompt the user whether to delete the call record generated by answering the call in the call record of the operating system;

Delete the call record generated by answering the call in the call record of the operating system, including:

When the user chooses to delete, the call record generated by answering the call is deleted in the call record of the operating system.

Optionally, when the system event is a missed call, when the system event meets the rules set by the enterprise or the user, the operation corresponding to the event is performed in the work area, including:

When the caller number of the missed call is the work contact number, delete the record of the missed call in the call log of the operating system, and copy it to the work area.

Optionally, when the caller number of the missed call coincides with the contact number in the address book of the operating system, before deleting the record of the missed call in the call log of the operating system, it also includes:

Prompt the user whether to delete the record of the missed call in the call log of the operating system;

Delete the record of the missed call in the call log of the operating system, including:

When the user chooses to delete, the record of the missed call is deleted in the call record of the operating system.

Optionally, the method also includes:

When the user wants to access the data in the workspace, prompt the user to enter the unlock code;

Receive and verify whether the unlock code entered by the user is correct;

When the unlock code entered by the user is correct, the user is allowed to access the data in the workspace.

According to an aspect of the present invention, a protection device for enterprise data is also provided, including:

Establishing a module configured to establish a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner;

The monitoring module is configured to monitor system events and determine whether the system events comply with the rules set by the enterprise or the user;

The execution module is configured to execute an operation corresponding to the event in the work area when the system event meets the rules set by the enterprise or the user.

Optionally, the rules set by the enterprise include: the contact person corresponding to the system event is in the enterprise address book set by the enterprise;

The rules set by the user include: the contacts corresponding to the system events are in the address book that the user personally imports into the workspace.

Optionally, the monitoring module is configured to monitor system events, and determine whether the contact corresponding to the system event is a work contact;

Wherein, the work contact is a contact in the corporate address book set by the enterprise or in the address book imported by the user into the workspace.

Optionally, system events include any of the following:

Receive text messages, send text messages, make calls, answer calls, and miss calls.

Optionally, when the system event is making a call or receiving a call, the monitoring module is configured to monitor the system event in the following manner:

The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring.

Optionally, the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.

Optionally, when the system event is receiving a short message, the execution module is configured to intercept the short message from entering the system inbox when the sender of the short message is a work contact, and store the short message in the work area.

Optionally, when the system event is sending a short message, the execution module is configured to intercept the sending record of the short message and enter the system outbox when the recipient of the short message is a work contact, and store the sending record of the short message in the work area middle.

Optionally, when the system event is a call, the execution module is configured to delete the call record recorded by the operating system and record it in the work area when the call is made through the address book saved in the work area.

Optionally, the device also includes:

The judging module is configured to judge whether the user has set the call log of the work contact to be displayed in the call log of the operating system;

The execution module is further configured to delete the call record recorded by the operating system when the call record of the work contact is not set to be displayed in the call record of the operating system.

Optionally, when the system event is answering a call, the execution module is configured to delete the call record generated by answering the call in the call record of the operating system and copy it to the work area when the caller number of the call is a work contact number middle.

Optionally, when the caller number for answering the call coincides with the contact number in the address book of the operating system, the device further includes:

The first prompting module is configured to prompt the user whether to delete the call record generated by answering the call in the call record of the operating system;

The execution module is further configured to delete the call record generated by answering the call in the call record of the operating system when the user chooses to delete.

Optionally, when the system event is a missed call, the execution module is configured to delete the record of the missed call in the call log of the operating system when the incoming number of the missed call is a work contact number, and copy into the workspace.

Optionally, when the caller number of the missed call coincides with the contact number in the address book of the operating system, the device further includes:

The second prompt module is configured to prompt the user whether to delete the record of the missed call in the call record of the operating system;

The execution module is further configured to delete the record of the missed call in the call record of the operating system when the user chooses to delete.

Optionally, the device also includes:

The third prompt module is configured to prompt the user to input the unlock code when the user wants to access the data in the work area;

A verification module configured to receive and verify whether the unlock code input by the user is correct;

An access module configured to allow the user to access data in the workspace when the verification module verifies that the unlock code entered by the user is correct.

The present invention provides a method and device for protecting enterprise data. By establishing a work area for storing enterprise data in a mobile terminal and storing it in an encrypted manner, and monitoring system events at the same time, when the rules set by the enterprise or users are met, , to perform the action corresponding to the event in the workspace. It can be seen that the present invention can avoid the leakage of enterprise data caused by the attack of malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read and obtain the enterprise data, which ensures the security of the enterprise data, and can not obtained by malicious programs.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same parts. In the attached picture:

Fig. 1 is a flow chart of a method for protecting enterprise data according to an embodiment of the present invention;

Fig. 2 is a flow chart of a specific method for protecting enterprise data according to an embodiment of the present invention;

Fig. 3 is a structural block diagram of a protection device for enterprise data according to an embodiment of the present invention;

Fig. 4 is a schematic diagram of a specific application scenario of an enterprise data protection device according to an embodiment of the present invention.

detailed description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure can be thoroughly understood, and will fully convey the scope of this disclosure to those skilled in the art.

Among them, in the present invention and the following embodiment, the work area and the personal area can be defined as follows:

The definition of work area and personal area. During the use of the device, in order to facilitate the management of personal data and work data in the device, a part of disk storage space can be set aside in the device, and new permission information can be configured, which can be used to store and manage work material. The remaining disk storage space of the device can be used to store and manage personal data or other data, and the remaining disk storage space can have initial permission information. Relatively speaking, the disk storage space for storing work data can be called a work area, and the disk storage space for storing personal data can be called a personal area.

In addition, for the convenience of operation, the personal area and the work area may have different UIs (User Interface, user interface), but may share some system files.

Most of the time the user may be involved in the operation of the personal area, but less time is involved in the operation of the work area. When it comes to the operation of the work area, the device needs to be actively encrypted due to reasons such as rest, or the device is automatically encrypted because the device has not operated information for too long. After the device is encrypted and decrypted again, it will return to the work area, and the authority of the personal area is required. Decrypt the information, and then decrypt the permission information of the work area to enter the work area. If the user does not want to return to the workspace at this time, he needs to exit the workspace again. The operation is very cumbersome, but directly saving the decryption of the workspace permission information will have potential safety hazards.

Embodiment one

An embodiment of the present invention provides a method for protecting enterprise data. The method improves the protection device of enterprise data. The enterprise data protection device in this embodiment can be installed on various portable devices of users, such as game consoles, laptop computers, portable media players, tablet computers, tablet computers, PDAs, mobile computers, and mobile phones, etc. Wait.

Wherein, the user's input type may be sliding input, gesture input, touch input, and voice input.

Fig. 1 is a flowchart of a method for protecting enterprise data according to an embodiment of the present invention, the method includes steps S102 to S106.

S102. Establish a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner.

S104, monitor the system event, and determine whether the system event complies with the rules set by the enterprise or the user.

S106, when the system event conforms to the rules set by the enterprise or the user, perform an operation corresponding to the event in the work area.

The embodiment of the present invention provides a method for protecting enterprise data. By establishing a work area for storing enterprise data in a mobile terminal and storing it in an encrypted manner, and monitoring system events at the same time, when the rules set by the enterprise or users are met, , to perform the action corresponding to the event in the workspace. It can be seen that the method provided by the embodiment of the present invention can avoid the leakage of enterprise data caused by the attack of malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, which ensures the security of the enterprise data , and can not be obtained by malicious programs.

Embodiment two

This embodiment is a specific application scenario of the first embodiment above. Through this embodiment, the method provided by the present invention can be described more clearly and specifically.

Fig. 2 is a flow chart of a specific method for protecting enterprise data according to an embodiment of the present invention, the method includes steps S201 to S212.

In order to protect the enterprise data in the mobile terminal in the embodiment of the present invention, it is necessary to firstly perform step S201 to establish a workspace for storing enterprise data in the mobile terminal.

In this embodiment, the purpose of establishing the workspace is to store data generated during work, so as to separate and store the data in the workspace and the data in the personal area, so as to manage the data in the workspace.

Optionally, in order to ensure data security in the workspace, the data in the workspace is stored in an encrypted manner. Users can set an unlock password for the data in the workspace. Only when the unlock code entered by the user is correct, the user is allowed to access the The data.

Taking the Android system as an example, when setting an unlock password for the data in the workspace and storing it in isolation, the following methods can be adopted:

Create and record the launchers of the user's personal area and work area respectively, and prompt the user to enter the password before displaying the desktop. If the user's login to the workspace is legal, start the workspace Launcher to provide the user with a desktop in the workspace through which the user can enter the application in the workspace; if the user does not log in, start from the selected default personal space Launcher , the user enters the application in the personal area through the default Launcher to achieve isolation between the work area and the personal area.

Wherein, the Launcher is a launcher or a desktop in the Zhuo system, and other applications can be accessed from icons on the desktop.

Next, step S202 is executed to monitor the system event and determine whether the system event complies with the pre-set rules of the enterprise or the user. If so, execute the operation corresponding to the event in the workspace. If not, perform operations corresponding to system events in the personal area.

Optionally, the system events involved in this embodiment may include events supported by the mobile terminal, such as receiving short messages, sending short messages, making calls, answering calls, occurrence of missed calls, and sending and receiving emails.

In this embodiment, in order to better manage the data in the work area, two different address books can be preset in the mobile terminal, wherein one is the corporate address book for work, and the other is the user's private communication In the address book, contact information such as telephone numbers, email addresses, and instant messaging of contacts can be saved.

Wherein, the enterprise address book is set in the above-mentioned work area, and contacts related to the user's work are stored in the enterprise address book. For example, the contacts included in the enterprise address book may be all colleagues in the department of the user.

In addition, in order to facilitate the management and update of the corporate address book, the corporate address book can also be synchronized with the server, that is, the user's corporate address book will be updated synchronously with the server at regular intervals. Contact, the contact will also be updated to the user's corporate address book.

It should be noted that users in the same department often have different work contacts. For example, user A belongs to the administration department and has close work contacts with the personnel department, and user B also belongs to the administration department. It has close work contacts with the International Department, and often only the common work contacts of the department are stored in the corporate directory, which cannot fully cover the work contacts faced by each colleague.

Therefore, in order to meet the needs of different users in this embodiment, in addition to storing the above-mentioned corporate address book, contacts imported by the user can also be stored in the work area. Non-departmental contacts.

For example, user A belongs to the administrative department, and has close work contacts with the human resources department. At this time, user A can import all contacts of the human resources department to the work area. At this time, the contacts in the enterprise address book and user A The personal contacts imported into the workspace together constitute user A's work contacts. For another example, user B also belongs to the administration department, and has close work contacts with the international department. At this time, user B can import all contacts of the international department to the work area. At this time, the contacts in the corporate directory The contacts imported into the workspace together with user B's personal contacts constitute user B's work contacts.

It can be seen that the setting of personal imported contacts can enable different users to set the contacts in the work area according to their own needs, which is convenient for users to operate and also ensures the security of enterprise data.

Different from the address book in the work area described above, the private address book is set in the non-work area and can include contacts related to the user, such as relatives and friends. However, the contacts in the work area can overlap with the contacts in the user's private address book. For example, contact A is both the user's colleague and the user's friend, then contact A can be saved in the corporate address book at the same time and private address book to ensure the safety of corporate data.

To sum up, in step S202, when judging whether the system event conforms to the rules set by the enterprise or the user in advance, the judgment can be made through the following steps:

Monitor system events and determine whether the contact corresponding to the system event is a work contact. When it is a work contact, confirm that it meets the preset rules. At this time, perform corresponding operations in the work area according to the category of the system event. When it is not a work contact, confirm that it does not meet the preset rules. At this time, perform corresponding operations in the non-work area according to the category of the system event.

Wherein, the work contact is a contact in the enterprise address book set by the above-mentioned enterprise or in the address book imported into the work area by the above-mentioned user.

In order to introduce this method more clearly and in detail in this embodiment, the specific introduction will now be given by taking system events such as receiving a short message, sending a short message, making a call, answering a call, and occurrence of a missed call as examples. The following describes the specific execution process of the method when the above five system events occur.

In the first case, the system event is the event of receiving a short message.

When the system event is an event of receiving a short message, step S202 determines whether the contact corresponding to the event of receiving a short message is a work contact. When it is a work contact, execute step S203, and when it is not a work contact, execute step S204.

Step S203, intercepting the short message to enter the system inbox, and storing the short message in the work area.

In this embodiment, the short message records saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage.

Step S204, saving the short message into the system inbox.

Step S203 intercepts the short message entering the system inbox, and stores the short message in the work area, which realizes the separation of public and private data, and prevents work-related incoming letters from being maliciously viewed in the user's system inbox. Thereby ensuring the security of enterprise data.

In the second case, the system event is an event of sending a short message.

When the system event is an event of sending a short message, step S202 determines whether the contact corresponding to the event of sending a short message is a work contact. When it is a work contact, execute step S205, and when it is not a work contact, execute step S206.

Step S205, intercepting the sending record of the short message into the system outbox, and storing the sending record of the short message in the work area.

In this embodiment, the short message sending record saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage.

Step S206, storing the sending record of the short message in the system inbox.

Step S205 intercepts the sending record of the short message into the system outbox, and stores the sending record of the short message in the work area, which realizes the separation of public and private data and avoids work-related sending in the user's system sending It is maliciously viewed in the box, thus ensuring the security of enterprise data.

In the third case, the system event is a phone call event.

When the system event is a call event, step S202 determines whether the contact corresponding to the call event is a work contact. When it is a work contact, execute step S207, and when it is not a work contact, execute step S208.

Step S207, delete the call record recorded by the operating system, and record it in the work area.

In this embodiment, the phone call record saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage.

Step S208, the call record is stored in the call record of the operating system.

It should be noted that, in order to make it convenient for the user to view the dialing record, before step S207, the operation of deleting the dialing record recorded by the operating system may also include the following operations:

Determine whether the user has set to display the call records of work contacts in the call records of the operating system. When the call record of the work contact is not set to be displayed in the call record of the operating system, the call record recorded by the operating system is deleted through step S207. When it is set to display the call record of the work contact in the call record of the operating system, the call record is displayed in the call record of the operating system and recorded in the work area at the same time.

In this embodiment, according to different needs, the user can separately set whether the call records of each contact in the work area are displayed in the system call records, or can perform a unified setting, that is, set all call records to be displayed in the system call records Or all call records are not displayed in the system call records.

In the fourth case, the system event is an event of answering a phone call.

When the system event is a call answering event, step S202 determines whether the contact corresponding to the call answering event is a work contact. When it is a work contact, execute step S209, and when it is not a work contact, execute step S210.

Step S209, delete the call record generated by answering the call in the call record of the operating system, and copy it to the work area.

Taking the Android system as an example, when the system event is making a call or answering a call, the maintenance (copy and transfer) of the call records of the operating system can be done in the following ways:

The events of making and receiving calls are received through the PhoneStateReceiver broadcast receiver. When a call is made or received, the CallLogObserverService service is started to maintain the call records, including the copy and transfer operations of the call records.

When starting the CallLogObserverService service, it can be realized through the startService service provided by the operating system.

Among them, the PhoneStateReceiver broadcast receiver can receive events for making and answering calls through the following code:

Specifically, before starting the CallLogObserverService service, it is also necessary to obtain the read and write permissions for the operating system address book, and the following methods can be used:

Declare the permissions used in androidmanifest.xml:

<uses-permission android:name="android.permission.READ_PHONE_STATE"/>

Among them, when copying call records, it can be realized through the CallLogObserverService service:

In the process of starting the CallLogObserverService service, a listening service ContentObserver is registered, and a Handler that handles changes;

The monitoring service ContentObserver monitors the changes of the call record database of the system (its URI is android.provider.CallLog.Calls.CONTENT_URI). When there is a change in the call record, the onChange method of the Handler is called to update the call record database in the workspace.

In this embodiment, the telephone answering record saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage and operate

Step S210, storing the answering record in the call record of the operating system.

It should be noted that, when the caller number for answering the call coincides with the contact number in the address book of the operating system, before step S209 deletes the call record generated by answering the call in the call record of the operating system, it may also include Do as follows:

Prompt the user whether to delete the call record generated by this answering call in the call record of the operating system. When the user chooses to delete, the call record generated by answering the call is deleted in the call record of the operating system through step S209. When the user chooses not to delete, the answering record is stored in the call record of the operating system and copied to the work area.

The above operation of prompting the user can save or delete the call record according to the different needs of the user, which ensures the security of the data in the work area and is also convenient for the user to operate.

In the fifth case, the system event is a missed call event.

When the system event is a missed call event, step S202 determines whether the contact corresponding to the missed call event is a work contact. When it is a work contact, execute step S211, and when it is not a work contact, execute step S212.

Step S211, delete the record of the missed call in the call record of the operating system, and copy it to the work area.

In this embodiment, the missed call record saved in the work area can also be uploaded to the server, which is convenient for the administrator to manage.

Step S212, storing the record of the missed call in the call record of the operating system.

It should be noted that, when the caller number of the missed call coincides with the contact number in the address book of the operating system, before the record of the missed call is deleted in the call log of the operating system in step S211, it may also include as follows:

Prompt the user whether to delete the missed call record in the call history of the operating system. When the user chooses to delete, the record of the missed call is deleted in the call record of the operating system through step S211. When the user chooses not to delete, the missed call record is stored in the call record of the operating system and copied to the work area.

It should be noted that the five system events described above in this implementation are only exemplary and do not limit the scope of protection of the embodiments of the present invention. System events that other mobile terminals can support are also within the scope of protection of the embodiments of the present invention. within.

The embodiment of the present invention provides a method for protecting enterprise data. By establishing a work area for storing enterprise data in a mobile terminal and storing it in an encrypted manner, and monitoring system events at the same time, when the rules set by the enterprise or users are met, , to perform the action corresponding to the event in the workspace. It can be seen that the method provided by the embodiment of the present invention can avoid the leakage of enterprise data due to the attack of malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, ensuring the security of the enterprise data. Security, and can not be obtained by malicious programs.

Embodiment three

FIG. 3 is a structural block diagram of an enterprise data protection device provided by an embodiment of the present invention. The device 300 includes:

The establishment module 310 is configured to establish a work area for storing enterprise data in the mobile terminal; wherein, the data in the work area is stored in an encrypted manner;

The monitoring module 320 is configured to monitor system events and determine whether the system events comply with the rules set by the enterprise or the user;

The execution module 330 is configured to execute an operation corresponding to the event in the workspace when the system event meets the rules set by the enterprise or the user.

Optionally, the rules set by the enterprise include: the contact person corresponding to the system event is in the enterprise address book set by the enterprise;

The rules set by the user include: the contacts corresponding to the system events are in the address book that the user personally imports into the workspace.

Optionally, the monitoring module 320 is configured to monitor system events, and determine whether the contact corresponding to the system event is a work contact;

Wherein, the work contact is a contact in the corporate address book set by the enterprise or in the address book imported by the user into the workspace.

Optionally, system events include any of the following:

Receive text messages, send text messages, make calls, answer calls, and miss calls.

Optionally, when the system event is making a call or receiving a call, the monitoring module 320 is configured to monitor the system event in the following manner:

The event is received through the broadcast receiver specified in the operating system, and when the event is received, it is determined that the event of making a call or receiving a call corresponding to the event is currently occurring.

Optionally, the specified broadcast receiver is PhoneStateReceiver broadcast receiver.

Optionally, when the system event is receiving a short message, the execution module 330 is configured to intercept the short message from entering the system inbox when the sender of the short message is a work contact, and store the short message in the work area.

Optionally, when the system event is sending a short message, the execution module 330 is configured to intercept the sending record of the short message and enter the system outbox when the recipient of the short message is a work contact, and store the sending record of the short message in the work in the district.

Optionally, when the system event is a call, the execution module 330 is configured to delete the call record recorded by the operating system and record it in the work area when the call is made through the address book saved in the work area.

Optionally, the device 300 also includes:

The judging module 340 is configured to judge whether the user has set the call record of the work contact to be displayed in the call record of the operating system;

The execution module 330 is further configured to delete the call record recorded by the operating system when the call record of the work contact is not set to be displayed in the call record of the operating system.

Optionally, when the system event is answering a call, the execution module 330 is configured to delete the call record generated by answering the call in the call record of the operating system and copy it to the work contact number when the caller number of the call is a work contact number. in the district.

Optionally, when the caller number for answering the call coincides with the contact number in the address book of the operating system, the device further includes:

The first prompt module 350 is configured to prompt the user whether to delete the call record generated by answering the call in the call record of the operating system;

The execution module 330 is further configured to delete the call record generated by answering the call in the call record of the operating system when the user chooses to delete.

Optionally, when the system event is a missed call, the execution module 330 is configured to delete the record of the missed call in the call log of the operating system when the incoming call number of the missed call is a work contact number, and copied into the workspace.

Optionally, when the caller number of the missed call coincides with the contact number in the address book of the operating system, the device further includes:

The second prompt module 360 is configured to prompt the user whether to delete the record of the missed call in the call record of the operating system;

The execution module 330 is further configured to delete the record of the missed call in the call record of the operating system when the user chooses to delete.

Optionally, the device 300 also includes:

The third prompt module 370 is configured to prompt the user to input the unlock code when the user wants to access the data in the work area;

The verification module 380 is configured to receive and verify whether the unlock code input by the user is correct;

The access module 390 is configured to allow the user to access the data in the work area when the verification module 380 verifies that the unlock code input by the user is correct.

As shown in Figure 4, a specific application scenario of the protection device provided by the embodiment of the present invention includes:

Employee equipment, the employee equipment is equivalent to the enterprise data protection device provided by the embodiment of the present invention, the enterprise private system can be installed in the employee equipment, and the enterprise private system includes:

Mail system, business system and OA (Office Automation, office automation) system.

The above-mentioned system is stored in the work area of the employee's device, and is used to store the enterprise data in an encrypted manner, and the user can access the enterprise data in the enterprise's private system by entering a password.

At the same time, employee devices are connected to Tianji Enterprise's private cloud service, which stores cloud security services, and can push the rules of cloud security services (such as rules set by the enterprise) to employee devices. The rules isolate the data in the work area and the personal area to achieve the security of enterprise data.

In addition, enterprise administrators can set the rules of cloud security services in Tianji Enterprise Private Cloud Service.

The embodiment of the present invention provides a protection device for enterprise data. By establishing a work area for storing enterprise data in a mobile terminal and storing it in an encrypted manner, and monitoring system events at the same time, when the rules set by the enterprise or users are met, , to perform the action corresponding to the event in the workspace. It can be seen that the device provided by the embodiment of the present invention can avoid the leakage of enterprise data caused by the attack of malicious programs. Even if the mobile terminal is lost, because the work area is encrypted, other people cannot read the enterprise data, ensuring the security of enterprise data. Security, and can not be obtained by malicious programs.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings), as well as any method or method so disclosed, may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the enterprise data protection device according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

So far, those skilled in the art should appreciate that, although a number of exemplary embodiments of the present invention have been shown and described in detail herein, without departing from the spirit and scope of the present invention, the disclosed embodiments of the present invention can still be used. Many other variations or modifications consistent with the principles of the invention are directly identified or derived from the content. Accordingly, the scope of the present invention should be understood and deemed to cover all such other variations or modifications.

This embodiment also provides A1. A method for protecting enterprise data, including:

Establishing a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner;

Monitor system events and judge whether the system events comply with the rules set by the enterprise or users;

When the system event conforms to the rule set by the enterprise or the user, the operation corresponding to the event is executed in the work area.

A2. The method described in A1, wherein the rules set by the enterprise include: the contact person corresponding to the system event is in the enterprise address book set by the enterprise;

The rule set by the user includes: the contact person corresponding to the system event is in the address book imported by the user into the workspace.

A3. The method according to A2, wherein the monitoring of the system event and judging whether it complies with the rules set by the enterprise or the user include:

Monitoring the system event, and judging whether the contact corresponding to the system event is a work contact;

Wherein, the work contacts are contacts in the corporate address book set by the company or in the address book imported into the work area by the user.

A4. The method according to A3, wherein the system event includes any one of the following:

Receive text messages, send text messages, make calls, answer calls, and miss calls.

A5. The method according to A4, wherein, when the system event is making a call or receiving a call, the monitoring of the system event includes:

The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring.

A6. The method according to A5, wherein the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.

A7. The method according to A4, wherein, when the system event is receiving a short message, when the system event meets the rules set by the enterprise or the user, execute the corresponding event in the work area operations, including:

When the sender of the short message is a work contact, the short message is intercepted and entered into the system inbox, and the short message is stored in the work area.

A8. The method according to A4, wherein, when the system event is sending a short message, when the system event conforms to the rules set by the enterprise or the user, execute the corresponding event in the work area operations, including:

When the recipient of the short message is a work contact, the sending record of the short message is intercepted and entered into the system outbox, and the sending record of the short message is stored in the work area.

A9. The method according to A4, wherein, when the system event is a phone call, when the system event conforms to the rules set by the enterprise or the user, execute the corresponding event in the work area operations, including:

When the call is dialed out through the address book stored in the work area, the dialing record recorded by the operating system is deleted and recorded in the work area.

A10. The method according to A9, wherein, before deleting the dialing record recorded by the operating system, it also includes:

Determine whether the user has set the call records of work contacts to be displayed in the call records of the operating system;

Said deleting the dialing record recorded by the operating system includes:

When the call record of the work contact is not set to be displayed in the call record of the operating system, the call record recorded by the operating system is deleted.

A11. The method according to A4, wherein, when the system event is answering a phone call, when the system event conforms to the rules set by the enterprise or the user, execute the corresponding event in the work area operations, including:

When the caller number of the phone is a work contact number, the call record generated by answering the call is deleted in the call record of the operating system and copied to the work area.

A12. The method according to A11, wherein, when the caller number of the answering call coincides with the contact number in the address book of the operating system, the call generated by answering the call is recorded in the call record of the operating system Before removing, also include:

Prompt the user whether to delete the call record generated by answering the call in the call record of the operating system;

The call record generated by answering the call is deleted in the call record of the operating system, including:

When the user chooses to delete, the call record generated by answering the call is deleted in the call record of the operating system.

A13. The method according to A4, wherein, when the system event is a missed call, when the system event conforms to the rules set by the enterprise or the user, the event related to the event is executed in the work area Corresponding operations include:

When the incoming call number of the missed call is a work contact number, delete the missed call record in the call log of the operating system, and copy it to the work area.

A14. The method according to A13, wherein, when the incoming number of the missed call coincides with the contact number in the address book of the operating system, the record of the missed call is recorded in the call log of the operating system Before removing, also include:

Prompt the user whether to delete the record of the missed call in the call log of the operating system;

The record of the missed call is deleted in the call record of the operating system, including:

When the user chooses to delete, the record of the missed call is deleted in the call record of the operating system.

A15. The method according to any one of A1 to A14, further comprising:

prompting the user to input an unlock code when the user wants to access data in the workspace;

receiving and verifying whether the unlock code input by the user is correct;

When the unlock code input by the user is correct, the user is allowed to access the data in the work area.

The present embodiment also provides B16. A protection device for enterprise data, comprising:

An establishment module configured to establish a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner;

A monitoring module configured to monitor system events and determine whether the system events comply with rules set by the enterprise or users;

The execution module is configured to execute an operation corresponding to the event in the work area when the system event conforms to the rules set by the enterprise or the user.

B17. The device according to B16, wherein the rules set by the enterprise include: the contact person corresponding to the system event is in the enterprise address book set by the enterprise;

The rule set by the user includes: the contact person corresponding to the system event is in the address book imported by the user into the workspace.

B18. The device according to B17, wherein the monitoring module is configured to monitor system events and determine whether the contact corresponding to the system event is a work contact;

Wherein, the work contacts are contacts in the corporate address book set by the company or in the address book imported into the work area by the user.

B19. The device according to B18, wherein the system event includes any one of the following:

Receive text messages, send text messages, make calls, answer calls, and miss calls.

B20. The device according to B19, wherein, when the system event is making a call or receiving a call, the monitoring module is configured to monitor the system event in the following manner:

The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring.

B21. The device according to B20, wherein the designated broadcast receiver is a PhoneStateReceiver broadcast receiver.

B22. The device according to B19, wherein, when the system event is receiving a short message, the execution module is configured to intercept the short message and enter the system inbox when the sender of the short message is a work contact, and Store the text message in said workspace.

B23. The device according to B19, wherein, when the system event is sending a short message, the execution module is configured to intercept the sending record of the short message and enter the system to send it when the recipient of the short message is a work contact box, and store the sending record of the short message in the work area.

B24. The device according to B19, wherein, when the system event is a call, the execution module is configured to, when the call is dialed out through the address book stored in the work area, the operating system The recorded call record is deleted and recorded in the work area.

B25. The device according to B24, wherein the device further comprises:

The judging module is configured to judge whether the user has set the call log of the work contact to be displayed in the call log of the operating system;

The execution module is further configured to delete the call record recorded by the operating system when the call record of the work contact is not set to be displayed in the call record of the operating system.

B26. The device according to B19, wherein, when the system event is answering a call, the execution module is configured to record the call generated by answering the call in the Deleted from the call history of the operating system and copied to the workspace.

B27. The device according to B26, wherein, when the caller number for answering the call coincides with the contact number in the address book of the operating system, the device also includes:

The first prompting module is configured to prompt the user whether to delete the call record generated by answering the call in the call record of the operating system;

The execution module is further configured to delete the call record generated by answering the call in the call record of the operating system when the user chooses to delete.

B28. The device according to B19, wherein, when the system event is a missed call, the execution module is configured to, when the incoming number of the missed call is a work contact number, send the missed call The record is deleted in the call log of the operating system and copied to the said workspace.

B29. The device according to B28, wherein, when the caller number of the missed call coincides with the contact number in the address book of the operating system, the device also includes:

The second prompt module is configured to prompt the user whether to delete the record of the missed call in the call record of the operating system;

The execution module is further configured to delete the record of the missed call in the call record of the operating system when the user chooses to delete.

B30. The device according to any one of B16 to B29, wherein the device further comprises:

The third prompt module is configured to prompt the user to input the unlock code when the user wants to access the data in the work area;

A verification module configured to receive and verify whether the unlock code input by the user is correct;

The access module is configured to allow the user to access the data in the work area when the verification module verifies that the unlock code input by the user is correct.

Claims (26)

1. A method for protecting enterprise data, comprising: Establishing a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner; Monitor system events and judge whether the system events comply with the rules set by the enterprise or the user; wherein, the rules set by the enterprise include that the contact person corresponding to the system event is in the enterprise address book set by the enterprise ; The rules set by the user include that the contact corresponding to the system event is in the address book that the user personally imports into the workspace; When the system event conforms to the rules set by the enterprise or the user, perform an operation corresponding to the event in the work area; Wherein, the monitoring of system events and judging whether they conform to the rules set by the enterprise or users include: monitoring the system events and judging whether the contact person corresponding to the system event is a work contact; A person is a contact in the enterprise address book set by the enterprise or in the address book imported into the workspace by the user. 2. The method according to claim 1, wherein the system event comprises any one of the following: Receive text messages, send text messages, make calls, answer calls, and miss calls. 3. The method according to claim 2, wherein, when the system event is making a call or receiving a call, said monitoring the system event comprises: The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring. 4. The method according to claim 3, wherein the designated broadcast receiver is a PhoneStateReceiver broadcast receiver. 5. The method according to claim 2, wherein, when the system event is receiving a short message, when the system event meets the rules set by the enterprise or the user, the event related to the event is executed in the work area. Corresponding operations include: When the sender of the short message is a work contact, the short message is intercepted and entered into the system inbox, and the short message is stored in the work area. 6. The method according to claim 2, wherein, when the system event is sending a short message, when the system event meets the rules set by the enterprise or the user, the event related to the event is executed in the work area. Corresponding operations include: When the recipient of the short message is a work contact, the sending record of the short message is intercepted and entered into the system outbox, and the sending record of the short message is stored in the work area. 7. The method according to claim 2, wherein, when the system event is a phone call, when the system event conforms to the rules set by the enterprise or the user, the event related to the event is executed in the work area Corresponding operations include: When the call is dialed out through the address book stored in the work area, the dialing record recorded by the operating system is deleted and recorded in the work area. 8. The method according to claim 7, wherein, before deleting the dialing record recorded by the operating system, further comprising: Determine whether the user has set the call records of work contacts to be displayed in the call records of the operating system; Said deleting the dialing record recorded by the operating system includes: When the call record of the work contact is not set to be displayed in the call record of the operating system, the call record recorded by the operating system is deleted. 9. The method according to claim 2, wherein, when the system event is answering a phone call, when the system event meets the rules set by the enterprise or the user, the event related to the event is executed in the work area Corresponding operations include: When the caller number of the phone is a work contact number, the call record generated by answering the call is deleted in the call record of the operating system and copied to the work area. 10. The method according to claim 9, wherein, when the caller number of the answering call coincides with the contact number in the address book of the operating system, the call generated by the answering call is recorded in the call of the operating system Before the records are deleted, also include: Prompt the user whether to delete the call record generated by answering the call in the call record of the operating system; The call record generated by answering the call is deleted in the call record of the operating system, including: When the user chooses to delete, the call record generated by answering the call is deleted in the call record of the operating system. 11. The method according to claim 2, wherein, when the system event is a missed call, when the system event meets the rules set by the enterprise or the user, an The actions corresponding to the event include: When the incoming call number of the missed call is a work contact number, delete the missed call record in the call log of the operating system, and copy it to the work area. 12. The method according to claim 11, wherein, when the caller number of the missed call coincides with the contact number in the address book of the operating system, the record of the missed call is recorded in the call of the operating system. Before the records are deleted, also include: Prompt the user whether to delete the record of the missed call in the call log of the operating system; The record of the missed call is deleted in the call record of the operating system, including: When the user chooses to delete, the record of the missed call is deleted in the call record of the operating system. 13. The method according to any one of claims 1 to 12, further comprising: prompting the user to input an unlock code when the user wants to access data in the workspace; receiving and verifying whether the unlock code input by the user is correct; When the unlock code input by the user is correct, the user is allowed to access the data in the work area. 14. A protection device for enterprise data, comprising: An establishment module configured to establish a workspace for storing enterprise data in the mobile terminal; wherein, the data in the workspace is stored in an encrypted manner; The monitoring module is configured to monitor system events and determine whether the system events comply with the rules set by the enterprise or the user; wherein, the rules set by the enterprise include that the contact person corresponding to the system event is in the In the corporate address book of the user; the rules set by the user include that the contact corresponding to the system event is in the address book imported by the user into the workspace; An execution module configured to execute an operation corresponding to the event in the workspace when the system event conforms to the rules set by the enterprise or the user; Wherein, the monitoring module is further configured to monitor system events, and determine whether the contact corresponding to the system event is a work contact; Contacts in the address book that the individual imports into the workspace. 15. The apparatus according to claim 14, wherein the system event comprises any one of the following: Receive text messages, send text messages, make calls, answer calls, and miss calls. 16. The device according to claim 15, wherein, when the system event is making a call or receiving a call, the monitoring module is configured to monitor the system event in the following manner: The event is received through the designated broadcast receiver in the operating system, and when the event is received, it is determined that a call-making event or a call-receiving event corresponding to the event is currently occurring. 17. The apparatus of claim 16, wherein the designated broadcast receiver is a PhoneStateReceiver broadcast receiver. 18. The device according to claim 15, wherein, when the system event is receiving a short message, the execution module is configured to intercept the short message and enter the system inbox when the sender of the short message is a work contact , and store the text message in the workspace. 19. The device according to claim 15, wherein, when the system event is sending a short message, the execution module is configured to intercept the sending record of the short message and enter the system when the recipient of the short message is a work contact Outbox, and store the sending record of the short message in the work area. 20. The device according to claim 15, wherein when the system event is a phone call, the executing module is configured to, when the phone call is made through an address book stored in the workspace, set The call record recorded by the operating system is deleted and recorded in the work area. 21. The apparatus of claim 20, wherein the apparatus further comprises: The judging module is configured to judge whether the user has set the call log of the work contact to be displayed in the call log of the operating system; The execution module is further configured to delete the call record recorded by the operating system when the call record of the work contact is not set to be displayed in the call record of the operating system. 22. The device according to claim 15, wherein, when the system event is answering a call, the executing module is configured to, when the incoming number of the phone is a work contact number, call The recording is deleted in the call log of the operating system and copied to the said workspace. 23. The device according to claim 22, wherein when the incoming call number for answering the call coincides with the contact number in the address book of the operating system, the device further comprises: The first prompting module is configured to prompt the user whether to delete the call record generated by answering the call in the call record of the operating system; The execution module is further configured to delete the call record generated by answering the call in the call record of the operating system when the user chooses to delete. 24. The device according to claim 15, wherein, when the system event is a missed call, the execution module is configured to: when the incoming number of the missed call is a work contact number, the missed call The records of incoming calls are deleted in the call records of the operating system and copied to the work area. 25. The device according to claim 24, wherein, when the caller number of the missed call coincides with the contact number in the address book of the operating system, the device further comprises: The second prompt module is configured to prompt the user whether to delete the record of the missed call in the call record of the operating system; The execution module is further configured to delete the record of the missed call in the call record of the operating system when the user chooses to delete. 26. The device according to any one of claims 14 to 25, wherein the device further comprises: The third prompt module is configured to prompt the user to input the unlock code when the user wants to access the data in the work area; A verification module configured to receive and verify whether the unlock code input by the user is correct; The access module is configured to allow the user to access the data in the work area when the verification module verifies that the unlock code input by the user is correct.