CN113542264B - File transmission control method, device and equipment and readable storage medium - Google Patents

Abstract

The application discloses a file transmission control method, a device, equipment and a readable storage medium, wherein the method comprises the following steps: performing flow packet capturing on all external links of the target network card to obtain a flow packet; screening a target flow packet with a file suffix name from the flow packets; merging the traffic fragments with the same file name in a plurality of target traffic packets to obtain a complete file; if the complete file is a confidential file, acquiring destination information corresponding to the complete file; and if the destination terminal information is not matched with the external connection white list, blocking network transmission corresponding to the complete file. The method and the device can protect the confidential document from being leaked.

Description

A file transmission control method, apparatus, device and readable storage medium

technical field

The present application relates to the technical field of storage security, and in particular, to a file transmission control method, apparatus, device, and readable storage medium.

Background technique

The key documents, internal documents, core documents and other confidential documents within the company or within the organization will gradually increase with the operation of the company and the operation of the organization. After these documents are finalized and sealed, they will basically not be revised. With that comes the question of how to store it and how to prevent it from leaking.

Usually, files are stored on file storage servers such as SVN and FTP, and then access these confidential files by assigning different permissions to different users, or by restricting the login server of certain IPs to reduce the possibility of accessing confidential files. However, this access restriction strategy cannot prevent the existence of privileged users or whitelisted IPs from logging in, resulting in the leakage of confidential files through peripheral devices or network transmission.

To sum up, how to effectively solve the problem of document leakage prevention is a technical problem that those skilled in the art urgently need to solve.

SUMMARY OF THE INVENTION

The purpose of this application is to provide a file transmission control method, device, device and readable storage medium, which can block illegal network transmission by effectively supervising network transmission, thereby protecting confidential files from being leaked.

In order to solve the above-mentioned technical problems, the application provides the following technical solutions:

A method of file protection comprising:

Capture traffic packets for all outreach of the target network card to obtain traffic packets;

Filter out the target traffic packet with the file suffix from the traffic packet;

Merging the traffic fragments of the same file name in the multiple target traffic packets to obtain a complete file;

If the complete file is a confidential file, obtain the destination information corresponding to the complete file;

If the destination terminal information does not match the outreach whitelist, the network transmission corresponding to the complete file is blocked.

Preferably, the obtaining the destination information corresponding to the complete file includes:

The destination information is obtained from the target traffic packet corresponding to the complete file; the destination information includes the destination IP address and/or the destination MAC address.

Preferably, it also includes:

Receive and parse the file copy request, and determine the target file and peripheral storage to be copied;

Determine whether the target file is a confidential file;

If so, verify that the peripheral storage is in the peripheral storage whitelist;

If there is, copy the target file to the peripheral storage; if not, prohibit copying the target file to the peripheral storage.

Preferably, the peripheral storage is not in the peripheral storage whitelist, further comprising:

registering the peripheral storage;

If the registration is successful, copy the target file to the peripheral storage;

If the registration fails, copying the object file to the peripheral storage is prohibited.

Preferably, judging whether the target file is a confidential file includes:

Calculate the target MD5 value of the target file;

If the target MD5 value is in the MD5 value corresponding to the confidential file, it is determined that the target file is a confidential file.

Preferably, judging whether the target file is a confidential file includes:

Read the header file information of the target file;

If the header file information has a confidential identifier, it is determined that the target file is a confidential file.

Preferably, it also includes:

Download the whitelist from the EDR center server;

Label and lock confidential documents.

A file transmission control device, comprising:

The packet capture module is used to capture traffic packets for all outreach of the target network card to obtain traffic packets;

a traffic packet filtering module, used for filtering out the target traffic packet with the file suffix name from the traffic packet;

The file merging module is used for merging the traffic fragments of the same file name in the multiple target traffic packets to obtain a complete file;

an information acquisition module, configured to acquire destination information corresponding to the complete file if the complete file is a confidential file;

A transmission blocking module, configured to block the network transmission corresponding to the complete file if the destination terminal information does not match the outreach whitelist.

An electronic device comprising:

memory for storing computer programs;

The processor is configured to implement the steps of the above-mentioned file transmission control method when executing the computer program.

A readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the above-mentioned file transmission control method.

By applying the method provided by the embodiment of the present application, the traffic packets are captured on all the external links of the target network card to obtain the traffic packets; the target traffic packets with the file suffix name are filtered out from the traffic packets; The traffic shards of the file name are merged to obtain the complete file; if the complete file is a confidential file, the destination information corresponding to the complete file is obtained; if the destination information does not match the outreach whitelist, the corresponding information of the complete file is blocked. network transmission.

First, traffic packets are captured for all outreach that requires the target network card, and then the obtained traffic packets are filtered to leave the target traffic packets with the file suffix. Merge the traffic shards that involve a file name in the target traffic packet, and then obtain the complete file being transmitted/to be transmitted. Check whether the complete file is a confidential file. If it is a confidential file, further obtain the destination terminal information corresponding to the complete file. If the terminal information does not match the external whitelist, directly block the network transmission corresponding to the complete file. In order to protect the complete files belonging to the confidential documents from being illegally transmitted, and to protect the confidential documents from being leaked.

Correspondingly, the embodiments of the present application also provide a file transmission control apparatus, device, and readable storage medium corresponding to the above-mentioned file transmission control method, which have the above-mentioned technical effects, and are not repeated here.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present application or related technologies more clearly, the following briefly introduces the accompanying drawings that are used in the description of the embodiments or related technologies. Obviously, the drawings in the following description are only the For some embodiments of the application, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is the implementation flow chart of a kind of file transmission control method in the embodiment of the application;

2 is a schematic diagram of a specific implementation of a file transmission control method in an embodiment of the present application;

3 is a schematic diagram of a multi-dimensional file protection implementation in an embodiment of the present application;

4 is a schematic structural diagram of a file transmission control device in an embodiment of the present application;

5 is a schematic structural diagram of an electronic device in an embodiment of the application;

FIG. 6 is a schematic diagram of a specific structure of an electronic device in an embodiment of the present application.

Detailed ways

In order to make those skilled in the art better understand the solution of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Please refer to FIG. 1 . FIG. 1 is a flowchart of a file transmission control method in an embodiment of the present application, and the method can be applied to any terminal with file transmission. The following is an example of the file transmission control method applied to the EDR client. Among them, EDR (Endpoint Detection Response, Endpoint Detection and Response) is a proactive security method that monitors endpoints in real time and searches for threats that infiltrate a company's defenses.

The method includes the following steps:

S101. Perform traffic packet capture on all outreaches of the target network card to obtain traffic packets.

The EDR client can capture traffic from the network card in its carrier computer. In order to avoid file leakage, in this embodiment, when the traffic packet capture process is performed on the target network card, traffic packet capture can be performed on all external connections of the target network card, thereby obtaining several traffic packets to be transmitted/transmitting.

S102. Filter out target traffic packets with file suffixes from the traffic packets.

Generally, a traffic packet carrying a file will contain a file suffix, and this embodiment is mainly to prevent leakage of confidential files, so a target traffic packet with a file suffix can be filtered out of several traffic packets first. In this embodiment, the file suffix name may have a file type suffix name corresponding to the confidential file (eg, docx, doc, xlsx, xls, pptx, ppt, txt, etc.).

S103 , merging the traffic fragments with the same file name in the multiple target traffic packets to obtain a complete file.

After filtering the target traffic packets, consider that files generally need to be fragmented to achieve transmission. In order to effectively identify whether a file is a confidential file, it is also necessary to merge the scattered traffic fragments corresponding to the file in the target traffic packet. Specifically, for how to combine the traffic of the same file name respectively to obtain a complete file, you can refer to the specific implementation scheme of file segment transmission and file segment merging, which will not be repeated here.

It should be noted that if a target traffic packet corresponds to a complete file, it is not necessary to perform merging processing. For files that need to be merged, the number of target traffic packets involved is not limited. That is, the specific size of the complete file is not limited.

S104. If the complete file is a confidential file, obtain destination information corresponding to the complete file.

In this embodiment, the confidential files can be labeled in advance, or the unique identifiers (such as MD5 values) corresponding to the confidential files can be uniformly recorded in advance. The unique identifier determines whether the complete file is a confidential file.

Among them, the MD5 value is the output content obtained after calculating the file by using the MD5 algorithm. The input of the MD5 (MessageDigest Algorithm 5, Message Digest Algorithm 5th Edition) algorithm is a character string of any length (the length is greater than or equal to 0, in this embodiment, it is specifically a file), and the output is a 128-bit (bit) (or 16 bytes) string (ie MD5 value).

After it is determined that the complete file is a confidential file, the destination terminal information corresponding to the complete file can be obtained. The destination end information refers to the relevant information of the destination end corresponding to the transmission of the complete file identified by the current packet capture.

Specifically, the destination end information is obtained from the target traffic packet corresponding to the complete file; the destination end information includes the destination IP address and/or the destination MAC address. That is, the destination terminal information may only be the IP address of the destination terminal corresponding to the transmission of the complete file, or may only be the MAC address of the destination terminal corresponding to the transmission of the complete file. Of course, it may also correspond to the IP address and MAC address of the destination terminal. Specifically, the destination IP address and the destination MAC address can be directly obtained by parsing from the quintuple information in the target traffic packet.

S105. If the destination terminal information does not match the outreach whitelist, block the network transmission corresponding to the complete file.

In this embodiment, an outreach whitelist may be preset, and relevant information of an outreach terminal that allows confidential file transmission, such as an IP address or a MAC address, is recorded in the outreach whitelist.

Specifically, the whitelist can be downloaded from the EDR central server; the confidential files can be marked and locked. The whitelist may specifically refer to the outreach whitelist, or may specifically refer to the outreach whitelist and the peripheral storage whitelist. Marking confidential documents refers to marking which documents are confidential in advance. Locking a confidential file means that modification of it is no longer allowed.

After obtaining the destination end information, the destination end information is matched and searched with the outreach whitelist. For example, if the target information is the target IP address, and the target IP address is found in the outreach whitelist, the match is determined to be successful; the destination information is the target MAC address, and the MAC address is found in the outreach whitelist, then the match is determined to be successful. ; The destination address is the combination of the destination IP address and the destination MAC address. If the combination is found in the external whitelist, the match is determined to be successful.

When the content matching the destination information is found from the outreach whitelist, it is determined that it is legal to transmit the complete file to the terminal corresponding to the destination information, and the target traffic packet corresponding to the complete file can be released at this time; otherwise, It is determined that it is illegal for the terminal corresponding to the destination terminal information to transmit the complete file. In this case, the network transmission corresponding to the complete file is blocked, that is, the transmission of the target traffic packet corresponding to the complete file is blocked.

By applying the method provided by the embodiment of the present application, the traffic packets are captured on all the external links of the target network card to obtain the traffic packets; the target traffic packets with the file suffix name are filtered out from the traffic packets; The traffic shards of the file name are merged to obtain the complete file; if the complete file is a confidential file, the destination information corresponding to the complete file is obtained; if the destination information does not match the outreach whitelist, the corresponding information of the complete file is blocked. network transmission.

First, traffic packets are captured for all outreach that requires the target network card, and then the obtained traffic packets are filtered to leave the target traffic packets with the file suffix. Merge the traffic shards that involve a file name in the target traffic packet, and then obtain the complete file being transmitted/to be transmitted. Check whether the complete file is a confidential file. If it is a confidential file, further obtain the destination terminal information corresponding to the complete file. If the terminal information does not match the external whitelist, directly block the network transmission corresponding to the complete file. In order to protect the complete files belonging to the confidential documents from being illegally transmitted, and to protect the confidential documents from being leaked.

It should be noted that, based on the foregoing embodiments, the embodiments of the present application also provide corresponding improvement solutions. In the preferred/improved embodiments, the same steps or corresponding steps in the above-mentioned embodiments can be referred to each other, and corresponding beneficial effects can also be referred to each other, which will not be repeated in the preferred/improved embodiments herein.

In a specific implementation manner of the present application, it is considered that the transmission of files includes not only network transmission, but also copy transmission of peripheral storage (such as a USB flash drive, a hard disk, etc.). Therefore, on the basis of the above-mentioned embodiment, it is also proposed to effectively control the copy transmission corresponding to the external storage, and to perform effective anti-leak protection for confidential files from the dimension of the copy transmission of the external storage.

Please refer to FIG. 2 , which is a schematic diagram of a specific implementation of a file transmission control method in an embodiment of the present application. The specific implementation process includes:

S201. Receive and analyze the file copy request, and determine the target file to be copied and the peripheral storage.

In this embodiment, a file copy request can be received and parsed, so as to determine the target file to be copied and to which peripheral storage the target file is copied. In this embodiment, the peripheral storage may be a common removable storage device external to a computer, such as a USB flash drive and a USB flash drive.

S202. Determine whether the target file is a confidential file.

After the target file to be copied is determined, it is first determined whether the target file is a confidential file.

In this embodiment, the ways of judging whether the complete file is a confidential file include but are not limited to the following two ways:

Method 1: Judging based on MD5 value, the specific implementation process includes:

Step 1. Calculate the target MD5 value of the target file;

Step 2: If the target MD5 value is in the MD5 value corresponding to the confidential file, the target file is determined to be a confidential file.

For the convenience of description, the above two steps are combined for description below.

First, calculate the target MD5 value of the target file. Then, read the MD5 value corresponding to the confidential file, and check whether the target MD5 value is in the MD5 value corresponding to the confidential file.

Method 2: Determine whether the target file is a confidential file based on the header file information. The specific implementation process includes:

Step 1: Read the header file information of the target file;

Step 2: If the header file information has a confidential identifier, it is determined that the target file is a confidential file.

For the convenience of description, the above two steps are combined for description below.

It should be noted that, in Embodiment 2, a secret identifier needs to be pre-defined in the custom field of the header file information. In this way, it can be determined whether the target file is a confidential file by reading the header file information of the target file and judging whether it has a corresponding confidential identifier.

If the target file is a confidential file, proceed to step S203 , and if the target file is not a confidential file, it can be directly copied to the peripheral storage, that is, the operation of step S204 is entered.

S203. Verify whether the peripheral storage is in the peripheral storage whitelist.

For the convenience of management, in this embodiment, a peripheral storage whitelist may be preset, and legally registered peripheral storages, that is, peripheral storages that allow copying of confidential files, are recorded in the peripheral storage whitelist.

After it is determined that the target file is a confidential file, it can be verified whether the peripheral storage is in the peripheral storage whitelist. If it is, it means that the target file copied this time is legal, and the operation of step S204 is performed subsequently, otherwise it is illegal, and the subsequent The operation of step S205 is performed.

S204: Copy the target file to the external storage.

That is, the target file is allowed to be copied to the external storage this time.

S205 , copying the target file to the peripheral storage is prohibited.

That is, the target file is copied to the external storage only this time.

Preferably, considering that in practical applications, with the constant change of actual requirements, it may be necessary to store and copy confidential files to peripheral devices other than the external device storage whitelist. To meet this requirement, in this embodiment, a new peripheral storage device may also be registered in the peripheral storage whitelist. Specifically, if the peripheral storage is not in the peripheral storage whitelist, you can also perform the following steps:

Step 1. Register the external storage;

Step 2. If the registration is successful, copy the target file to the external storage;

Step 3. If the registration fails, it is forbidden to copy the target file to the peripheral storage.

For the convenience of description, the above three steps are combined for description below.

Registering the peripheral storage, i.e., attempting to add the peripheral storage to the peripheral storage whitelist. Or the registered peripheral storage will be automatically added to the peripheral storage whitelist.

Whether the registration is approved or not can be carried out by manual auditing. If the registration is successful, it means that the peripheral storage can legally obtain the target file, so the target file can be copied to the peripheral storage; if the registration fails, it means that the peripheral storage cannot legally obtain the target file, so Copying target files to this peripheral store can be disabled.

In practical applications, the anti-leak maintenance strategy of network transmission dimension and file copy copy to peripheral storage dimension for confidential files can be activated at the same time, so as to achieve all-round protection. In order to facilitate those skilled in the art to better understand how to implement it, the file transmission control method will be described in detail below with reference to a specific application scenario as an example.

Please refer to FIG. 3 , which is a schematic diagram of implementing multi-dimensional file protection in an embodiment of the present application.

Before implementing the file transfer control method, the following preparatory work is required:

1. Deploy the EDR center server software and access the EDR asset management and control center through web services. Download the EDR client installation package.

2. Install the EDR client software on the computer that needs to be monitored, and establish the communication connection between the client and the center.

3. The user logs in to the web interface of the central server, and sets the external whitelist IP or IP segment for the client.

4. On the central server, the user selects the confidential file that needs to be marked by traversing the directory of the client (marking by adding MD5 matching to the file name). The selected confidential file is occupied by the client process in exclusive mode, that is, it cannot be edited. Also, the settings do not allow the same file to land. That is, it is not possible to copy confidential files on the local disk.

5. After the peripheral storage (such as: U disk) is connected to the server, the client first initiates the registration of the peripheral storage to the central server, and the central server receives the registration application and manually approves it. After approval, the peripheral storage is the peripheral storage whitelist.

After the above preparations are completed, the file transmission control method provided by the embodiment of the present application can be implemented.

That is, the user inserts the peripheral storage (eg: U disk), and the specific implementation of copying the confidential file to the peripheral storage: the client process first determines whether the peripheral storage is registered, and if it is not registered, the copy operation is not allowed. Allow copy operations if registered, i.e. allow copying of confidential files to peripheral storage. For peripheral storage that is not registered by the user, you can initiate an application for registration operation on the client interface. After the central server receives the peripheral storage registration information, it undergoes manual approval. If the manual approval is passed, the peripheral storage that has been registered in the whitelist can store confidential files.

Users transfer files on the computer through various network transmissions such as SVN, FTP, SCP, email attachments, and http/https POST uploads. The EDR client monitors all network traffic of the network card in the computer. And perform traffic capture and packet analysis for each TCP outreach. First parse out the traffic of confidential files with attachments, that is, the client process will parse each TCP outbound traffic, process the TCP traffic with file suffix name separately, and analyze the same file name in multiple traffic flows. The traffic fragments are merged, and the merged traffic is extracted into a complete file, and then the MD5 value of the file is judged to determine whether the complete file is a confidential file; if it is a confidential file, then extract the destination IP of the traffic, otherwise The traffic data is discarded. By analysing at least one of the destination IP and MAC address, and then matching the outbound whitelist, whether it exists in the whitelist database, if it exists, it means that the purpose of the online transmission is the whitelist address, and the network transmission can be allowed. If it does not exist, the network transmission is blocked and the transmission is not allowed.

Corresponding to the above method embodiments, the embodiments of the present application further provide a file transmission control apparatus, and the file transmission control apparatus described below and the file transmission control method described above may refer to each other correspondingly.

Referring to Figure 4, the device includes the following modules:

The packet capture module 101 is used to capture traffic packets for all external connections of the target network card to obtain traffic packets;

A traffic packet screening module 102, configured to filter out a target traffic packet with a file suffix from the traffic packet;

The file merging module 103 is used for merging the traffic fragments of the same file name in the multiple target traffic packets to obtain a complete file;

The information acquisition module 104 is configured to acquire destination information corresponding to the complete file if the complete file is a confidential file;

The transmission blocking module 105 is configured to block the network transmission corresponding to the complete file if the destination terminal information does not match the outreach whitelist.

By applying the device provided by the embodiment of the present application, the traffic packets are captured on all the external links of the target network card to obtain the traffic packets; the target traffic packets with the file suffix are filtered out from the traffic packets; The traffic shards of the file name are merged to obtain the complete file; if the complete file is a confidential file, the destination information corresponding to the complete file is obtained; if the destination information does not match the outreach whitelist, the corresponding information of the complete file is blocked. network transmission.

First, traffic packets are captured for all outreach that requires the target network card, and then the obtained traffic packets are filtered to leave the target traffic packets with the file suffix. Merge the traffic shards that involve a file name in the target traffic packet, and then obtain the complete file being transmitted/to be transmitted. Check whether the complete file is a confidential file. If it is a confidential file, further obtain the destination terminal information corresponding to the complete file. If the terminal information does not match the external whitelist, directly block the network transmission corresponding to the complete file. In order to protect the complete files belonging to the confidential documents from being illegally transmitted, and to protect the confidential documents from being leaked.

In a specific implementation of the present application, the information acquisition module 104 is specifically configured to acquire destination information from the target traffic packet corresponding to the complete file; the destination information includes the destination IP address and/or the destination MAC address.

In a specific embodiment of the present application, it also includes:

The copy transmission control module is used to receive and parse the file copy request, determine the target file to be copied and the peripheral storage; determine whether the target file is a confidential file; if so, verify whether the peripheral storage is in the peripheral storage whitelist; If it is, copy the target file to the external storage; if not, then prohibit copying the target file to the external storage.

In a specific embodiment of the present application, the copy transmission control module is also used to register the peripheral storage if the peripheral storage is not in the peripheral storage whitelist; if the registration is successful, copy the target file to the peripheral storage; If it fails, copying the target file to the peripheral storage is prohibited.

In a specific embodiment of the present application, the copy transmission control module is specifically used to calculate the target MD5 value of the target file; if the target MD5 value is in the MD5 value corresponding to the confidential document, the target document is determined to be a confidential document.

In a specific embodiment of the present application, the copy transmission control module is specifically configured to read the header file information of the target file; if the header file information has a confidential identifier, the target file is determined to be a confidential file.

In a specific embodiment of the present application, it also includes:

The preprocessing module is used to download the whitelist from the EDR center server; mark and lock confidential files.

Corresponding to the above method embodiments, the embodiments of the present application further provide an electronic device, and an electronic device described below and a file transmission control method described above can be referred to each other correspondingly.

Referring to Figure 5, the electronic device includes:

memory 332 for storing computer programs;

The processor 322 is configured to implement the steps of the file transmission control method of the above method embodiments when executing the computer program.

Specifically, please refer to FIG. 6. FIG. 6 is a schematic diagram of a specific structure of an electronic device provided in this embodiment. The electronic device may vary greatly due to different configurations or performances, and may include one or more processors ( central processing units (CPU) 322 (eg, one or more processors) and memory 332 that stores one or more computer applications 342 or data 344 . Among them, the memory 332 may be short-lived storage or persistent storage. The programs stored in memory 332 may include one or more modules (not shown), each of which may include a series of instructions to operate on a data processing device. Furthermore, the central processing unit 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301 .

Electronic device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input output interfaces 358 , and/or, one or more operating systems 341 .

The steps in the file transfer control method described above may be implemented by the structure of the electronic device.

Corresponding to the above method embodiments, the embodiments of the present application further provide a readable storage medium, and a readable storage medium described below and a file transmission control method described above may refer to each other correspondingly.

A readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the file transmission control method in the above method embodiment.

The readable storage medium may specifically be a USB flash drive, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, etc. that can store program codes. Readable storage medium.

Those skilled in the art may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the hardware and software In the above description, the components and steps of each example have been generally described according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods for implementing the described functionality for each particular application, but such implementations should not be considered beyond the scope of this application.

Claims (10)

1. A file transfer control method, comprising:

performing flow packet capturing on all external links of the target network card to obtain a flow packet;

screening a target flow packet with a file suffix name from the flow packets;

merging the traffic fragments with the same file name in the target traffic packets to obtain a complete file;

if the complete file is a confidential file, acquiring destination end information corresponding to the complete file;

and if the destination terminal information is not matched with the external connection white list, blocking network transmission corresponding to the complete file.

2. The method according to claim 1, wherein the obtaining destination information corresponding to the complete file includes:

acquiring destination end information from a target flow packet corresponding to the complete file; the destination information includes a destination IP address and/or a destination MAC address.

3. The file transfer control method according to claim 1, further comprising:

receiving and analyzing a file copying request, and determining a target file to be copied and an external storage;

judging whether the target file is a confidential file or not;

if yes, verifying whether the peripheral storage is in a peripheral storage white list;

if so, copying the target file to the peripheral storage; if not, the target file is prohibited from being copied to the peripheral for storage.

4. The file transfer control method of claim 3, wherein the peripheral storage is not storing a white list at the peripheral storage, further comprising:

registering the peripheral storage;

if the registration is successful, copying the target file to the peripheral storage;

and if the registration fails, prohibiting copying the target file to the peripheral for storage.

5. The file transfer control method according to claim 3, wherein determining whether the target file is a confidential file comprises:

calculating a target MD5 value of the target file;

and if the target MD5 value is in the MD5 value corresponding to the machine-encrypted file, determining that the target file is a confidential file.

6. The file transfer control method according to claim 3, wherein determining whether the target file is a confidential file includes:

reading header file information of the target file;

and if the header file information has the confidential identification, determining that the target file is a confidential file.

7. The file transfer control method according to any one of claims 1 to 6, characterized by further comprising:

downloading a white list from an EDR center server;

confidential documents are marked and locked.

8. A file transfer control apparatus, comprising:

the packet capturing module is used for capturing the traffic of all external links of the target network card to obtain a traffic packet;

the flow packet screening module is used for screening a target flow packet with a file suffix name from the flow packets;

the file merging module is used for merging the traffic fragments with the same file name in the target traffic packets to obtain a complete file;

the information acquisition module is used for acquiring destination terminal information corresponding to the complete file if the complete file is a confidential file;

and the transmission blocking module is used for blocking the network transmission corresponding to the complete file if the destination terminal information is not matched with the external connection white list.

9. An electronic device, comprising:

a memory for storing a computer program;

a processor for implementing the steps of the file transfer control method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that the readable storage medium has stored thereon a computer program which, when being executed by a processor, carries out the steps of the file transfer control method according to any one of claims 1 to 7.

Images