CN115794758A - An extended management and control method and system for data file sharing - Google Patents

Abstract

The present invention discloses an extended management and control method and system for data file sharing. The method includes: receiving component information of a data file receiving device, and determining an access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the The component information of the data file receiving device is sent by the data receiver; the data file access requirements are obtained, and access constraints are generated based on the data file access requirements; the data files to be shared are obtained, and the access identifier of the data receiving device, the The access constraint is associated with the data file to be shared, a data file package is generated, and the data file package is sent to the data receiver. The method realizes effective management and control of shared files, realizes extended access management and control of data files shared between different units and different subjects, and prevents security risks such as disorderly copying, sharing, and leakage of data files.

Description

An extended management and control method and system for data file sharing

technical field

The invention relates to the technical field of data security, in particular to an extended management and control method and system for data file sharing.

Background technique

The construction of a new power system and the digital transformation of electric power are advancing, business entities are more service-oriented, and business applications are more open. Data, as a key production factor, has been integrated into production and operation fields such as electric power, energy, and government affairs, and data security risks have become increasingly prominent. With the increase of business entities, power data is shared more and more frequently across industries and enterprises. After the power data is shared with government affairs, finance or other third-party units, it will be separated from the company's production environment, and the right to use the data will also be transferred, making it difficult to control data security. At the same time, data will exist indefinitely in the sharing unit, and can be continuously copied and shared at will, greatly increasing the risk of data leakage.

In order to strengthen the security protection of data after offline sharing and reduce the security risks caused by data sharing, the industry currently mainly adopts digital watermarking, by adding explicit or invisible watermarks to the distribution data files and distributing them to the data receivers. Once the data leaks , the leak source can be traced based on the watermark, and then the data security responsibility can be located. Digital watermarking provides an important method for data sharing protection, but this method is an after-the-fact measure, lacking control over the operation process of distributing data files, it is difficult to avoid problems such as data copying, sharing, and indefinite existence, and it is difficult to achieve extended control of data files .

Therefore, in order to deal with the security risk after data offline sharing, how to effectively control the operation of the data receiver and provide an effective extended protection measure after data file sharing has become an urgent problem to be solved by those skilled in the art.

Contents of the invention

Therefore, the technical problem to be solved by the present invention is to overcome the lack of management and control of the operation process of distributing data files in the prior art, and the difficulty of extending management and control of data files, thereby providing an extended management and control method and system for data file sharing.

In the first aspect of the present application, the embodiment of the present invention provides an extended management and control method for data file sharing, which is applied to the data provider, including:

receiving the component information of the data file receiving device, and determining the access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the component information of the data file receiving device is sent by the data receiver;

Acquire data file access requirements, and generate access constraints based on the data file access requirements;

Acquiring the data file to be shared, associating the access identifier of the data receiving device, the access constraints and the data file to be shared, generating a data file package, and sending the data file package to the data receiver.

An extended management and control method for data file sharing provided by the present invention determines the access identifier of the data receiving device through the component information of the data file receiving device sent by the data receiving party, determines the access constraints based on the access requirements, and sets the access The identification, access constraints and data files to be shared are associated to realize effective management and control of shared files, realize extended access control and control of data files shared among different units and different subjects, and prevent disorderly copying, sharing and leakage of data files and other security risks.

Optionally, the determining the access identifier of the data receiving device based on the component information of the data file receiving device includes:

determining a plurality of initial hash values based on component information of the data file receiving device;

Based on the plurality of initial hash values, using a digest algorithm to determine the access identifier of the data receiving device;

The access identifier of the data receiving device is stored using a binary hash tree.

Optionally, the access constraints include:

Access times constraints, access duration constraints, data file modification constraints and data file printing constraints.

Optionally, associating the access identifier of the data receiving device, the access constraints and the data file to be shared, generating a data file package, and sending the data file package to the data receiver includes :

Encapsulating the data file to be shared, and associating the encapsulated data file to be shared with the access times constraint, the access duration constraint, the data file modification constraint, and the data file printing constraint, to generate the data A file package, sending the data file package to a data receiver.

In the second aspect of this application, an extended control method for data file sharing is also proposed, which is applied to the data receiver, including:

Collecting component information of the data file receiving device, and sending the component information of the data file receiving device to the data provider;

Receiving the data file package, determining the data file access authority based on the component information of the data file receiving device and the data file package; wherein, the data file package is determined by the data provider based on the component information of the data file receiving device ;

Obtaining data file access behavior, determining an access constraint condition based on the data file package, and comparing the data file access behavior with the access constraint condition;

When the data file access behavior does not meet the access constraint condition, close the data file access permission to stop sharing the data file package.

The extended management and control method for data file sharing provided by the present invention effectively controls the data file access behavior of the data receiver through the access constraint conditions, effectively prevents the security risk after the data is shared offline, and realizes the data file in the Extended access control shared between different units and subjects.

Optionally, the determining the data file access authority based on the component information of the data file receiving device and the data file package includes:

determining a first access identifier based on component information of the data file receiving device;

Determining an access identifier of the data receiving device based on the data file package, using the access identifier of the data receiving device as a second access identifier;

Comparing the first access identifier with the second access identifier, and determining the data file access authority based on the comparison result.

Optionally, the determining the access constraint condition based on the data file package, and comparing the data file access behavior with the access constraint condition include:

Determine access times constraints, access duration constraints, data file modification constraints, and data file printing constraints based on the data file package;

Determine the total number of visits, access time, file modification action and file printing process based on the data file access behavior;

Respectively combine the access times constraint, the access duration constraint, the data file modification constraint, and the data file printing constraint with the total number of access times, the access time, the file modification action, and the file printing process Compare.

Optionally, the determining the data file access authority based on the component information of the data file receiving device and the data file package further includes:

Acquiring the access record time when the data file package is opened, and determining the access cut-off time based on the access record time and the access duration constraint;

Obtaining the current access time regularly, when the current access time is between the access record time and the access deadline, update the access record time, and continue to access the data file package; wherein, the current access The time is Internet time or local time;

Alternatively, when the current access time is after the access deadline, the data file package is deleted to generate an invalid file coverage sector.

In the third aspect of this application, an extended management and control system for data file sharing is also proposed, which is applied to data providers, including:

A determining module, configured to receive component information of the data file receiving device, and determine an access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the component information of the data file receiving device is sent by the data receiver;

A generating module, configured to acquire data file access requirements, and generate access constraints based on the data file access requirements;

An associating module, configured to obtain a data file to be shared, associate the access identifier of the data receiving device, the access constraints and the data file to be shared, generate a data file package, and send the data file package to data recipient.

In the fourth aspect of this application, an extended management and control system for data file sharing is also proposed, which is applied to the data receiver, including:

The collection module is used to collect the component information of the data file receiving device, and send the component information of the data file receiving device to the data provider;

The receiving module is used to receive the data file package, and determine the data file access authority based on the component information of the data file receiving device and the data file package; wherein, the data file package is based on the data file receiving device of the data provider determined by the component information;

A comparison module, configured to acquire data file access behavior, determine an access constraint condition based on the data file package, and compare the data file access behavior with the access constraint condition;

A closing module, configured to close the data file access authority to stop sharing the data file package when the data file access behavior does not meet the access constraint conditions.

In the fifth aspect of the present application, a computer device is also proposed, including a processor and a memory, wherein the memory is used to store a computer program, the computer program includes a program, and the processor is configured to call The computer program executes the method of the first aspect or the second aspect above.

In the sixth aspect of the present application, an embodiment of the present invention provides a computer-readable storage medium, the computer storage medium stores a computer program, and the computer program is executed by a processor to implement the above-mentioned first aspect or second aspect. aspects of the method.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

FIG. 1 is a flowchart of an extended control method for data file sharing applied to a data provider in Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of a shared data file between a data provider and a data receiver in Embodiment 1 of the present invention;

FIG. 3 is a flowchart of step S101 in Embodiment 1 of the present invention;

FIG. 4 is a flowchart of an extended control method for data file sharing applied to a data receiver in Embodiment 2 of the present invention;

FIG. 5 is a flowchart of step S202 in Embodiment 2 of the present invention;

FIG. 6 is a flowchart of step S203 in Embodiment 2 of the present invention;

7 is a functional block diagram of an extended management and control system for data file sharing applied to a data provider in Embodiment 3 of the present invention;

FIG. 8 is a functional block diagram of an extended management and control system for data file sharing in Embodiment 4 of the present invention applied to a data receiver.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Apparently, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, or in a specific orientation. construction and operation, therefore, should not be construed as limiting the invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and should not be construed as indicating or implying relative importance.

In addition, the technical features involved in the different embodiments of the present invention described below may be combined with each other as long as there is no conflict with each other.

Example 1

This embodiment provides an extended control method for data file sharing, which is applied to the data provider, as shown in Figure 1-2, including:

S101. Receive component information of the data file receiving device, and determine an access identifier of the data receiving device based on the component information of the data file receiving device; wherein the component information of the data file receiving device is sent by the data receiver.

Specifically, the data provider asks the data receiver for the component information required by the data file receiving device, including but not limited to processor information, network card information, hard disk information, memory information, and optical drive information; the data provider obtains the data receiver’s data The file receives device component information and processes it.

S102. Obtain data file access requirements, and generate access constraints based on the above data file access requirements.

Specifically, the above-mentioned access constraints include: access times constraints, access duration constraints, data file modification constraints, and data file printing constraints.

Further, the data provider obtains the access requirements of the data receiver's data files, including but not limited to access duration, access times, data file modification, data file printing, and data file copying.

Furthermore, the data provider generates access constraints based on the above-mentioned data file access requirements, and provides access anomaly detection measures; among them, for the number of data file accesses, a method of counting the number of data file accesses is established, and double-clicking or right-clicking to open is one time Access behavior, record the number of data accesses; for restricting the length of data access, the data file is limited to a specific date, and the access right is lost after expiration for timing; for restricting data file modification, the data file is enabled to prohibit modification mode to avoid file modification; for Restrict data file printing, by disabling the printing process of this data file, avoid data file printing; for restricted data file screen capture, when accessing this file, prevent the file from being copied by screen capture by prohibiting the ability to call the relevant screen capture tool.

S103. Obtain the data file to be shared, associate the access identifier of the data receiving device, the access constraint conditions with the data file to be shared, generate a data file package, and send the data file package to the data receiver.

Specifically, the above-mentioned data file to be shared is packaged, and the packaged data file to be shared is associated with the above-mentioned access times constraint, the above-mentioned access duration constraint, the above-mentioned data file modification constraint, and the data file printing constraint, to generate the above-mentioned data file package , to send the above data file package to the data receiver.

Further, the data file to be shared is encapsulated into a shared data package, and the shared data package is an executable program that can call corresponding reading software according to the format of the encapsulated data file; for example, the shared data package monitors that the encapsulated data file is .doc (a file extension) or .docx (a file extension) file type, it will automatically search for the office software of the receiving device (office software is a suite of office software developed by Microsoft Corporation) to access this data file It will automatically call the office word program (document program); when the data file package detects that the encapsulated data file is a .pdf (portable file format) file type, it will automatically search for the commonly used pdf reading software of the receiving device. When accessing this data file It will automatically call the relevant program according to the set priority; if the data file package detects the type of the encapsulated data file, if there is no reading program on the receiving device, it will prompt that the file cannot be opened.

Further, the access identifier of the data receiving device is associated with the shared data packet, and the access identifier is placed in the shared data packet, and the shared data packet is embedded with the ability to read the component information of the receiving device; for example, the data provider sends the receiving device of the data receiver Enter the component information into the shared data package, calculate the binary Merkle tree of the component information of the receiving device, and store it in the shared data package as the access identifier for data file access, and check the device information indicating that the receiving device is inconsistent with the provided information when the access is abnormal; At the same time, the shared data packet automatically detects the component information of the receiving device, and uses the algorithm consistent with the calculation of the access identifier to calculate the Hash value of the corresponding component information of the receiving device.

Further, limit the number of visits in the shared data package, and associate the number of visits with the data files in the shared data package, and the data file package has the ability to open the data file to open the number of times; for example, the data provider will the data receiver The number of required visits provided is entered into the shared data package, and the initial number of visits is recorded as 0. The shared data package associates the required visits with the data file, and the shared data package controls the number of times the data file is opened.

Further, limit the access duration in the shared data package, and associate the access duration with the data file, and the shared data package is embedded with the ability to read and record date and time; for example, the data provider can access Time, calculate the cut-off time of data file access, share the data package to record the current Internet record as the first record time, associate the data file access cut-off time with the data file, and share the data package to control the data file access time.

Furthermore, the shared data package embeds restricted data file modification and printing capabilities; for example, the data provider configures the limited modification and printing capabilities into the shared data package according to the modification and printing requirements provided by the data receiver, and shares them with the data file Associate and share data packages to control operations such as data file modification and printing.

Further, the shared data package is associated with the access constraint conditions to generate a data file package, and the data file package is sent to a data file receiver, and the data file receiver accesses the data file through a designated receiving device.

The above extended management and control method for data file sharing, determines the access identifier of the data receiving device through the component information of the data file receiving device sent by the data receiver, determines the access constraints based on the access requirements, and sets the access identifier, access The constraints are associated with the data files to be shared, which realizes the effective management and control of shared files, realizes the extended access control of data files shared between different units and different subjects, and prevents security risks such as disorderly copying, sharing, and leakage of data files .

As an optional implementation of the present invention, as shown in FIG. 3, in step S101, the access identification of the data receiving device is determined based on the component information of the above data file receiving device, including:

S1011. Determine multiple initial hash values based on the component information of the data file receiving device.

Specifically, the data provider uses the digest algorithm to calculate the initial Hash (hash) value of the component information of the data file receiving device provided by the data receiver; for example, the processor information, network card information, hard disk information, memory information, and CD-ROM drive information; among them, the SM3 algorithm is a cryptographic hash algorithm, which is suitable for digital signature and verification in commercial cryptography applications, generation and verification of message authentication codes, and random number generation, which can satisfy multiple security requirements for cryptographic applications.

S1012. Based on the multiple initial hash values, determine the access identifier of the data receiving device by using a digest algorithm.

Specifically, the initial Hash value of each component information of the receiving device is linked, and the digest algorithm is used to repeatedly perform two-two Hash operations until the final Hash value is generated, and this Hash value is used as the access identifier of the data receiving device.

For example, link the Hash value of the processor information with the Hash value of the network card information, link the Hash value of the hard disk information with the Hash value of the memory information, and use the national secret SM3 digest algorithm to calculate two sets of Hash values; further combine the two sets of Hash values After connecting, the final Hash value is calculated by using the national secret SM3 digest algorithm, which is the access identifier of the data receiving device.

S1013. Use the binary hash tree to store the access identifier of the data receiving device.

Specifically, the entire Hash calculation process is stored based on a binary Merkle tree (that is, a binary hash tree), so that when a device accesses a data file, component information inconsistent with the access identifier can be quickly located.

In the above embodiment, by processing the component information of the data file receiving device of the data receiver, an access identifier is generated based on processor information, network card information, hard disk information, memory information, etc., and access authority control can be performed on shared data files.

Example 2

This embodiment provides an extended management and control method for data file sharing, which is applied to the data receiver, as shown in Figure 4, including:

S201. Collect component information of a data file receiving device, and send the above component information of the data file receiving device to a data provider.

Specifically, the data receiver collects the component information of the data file receiving device according to the component information of the data file receiving device required by the data provider, and provides the component information to the data provider.

Further, as shown in Figure 2, after receiving the data file provided by the data provider, the data receiver accesses the data file package through the receiving device containing all component information provided to the data provider, and the data receiver accesses the data through the data file package document content.

Further, the above-mentioned data file receiving device may adopt a mobile terminal, or a PC terminal (computer terminal), or a tablet computer.

S202. Receive the data file package, and determine the data file access authority based on the component information of the data file receiving device and the data file package; wherein, the data file package is determined by the data provider based on the component information of the data file receiving device.

Specifically, before accessing the data file, the data file package reads the component information of the receiving device, calculates the access identifier, and determines the access right of the receiving device.

S203. Acquire the data file access behavior, determine the access constraint condition based on the data file package, and compare the data file access behavior with the access constraint condition.

S204. When the above-mentioned data file access behavior does not comply with the above-mentioned access constraint conditions, close the above-mentioned data file access permission, so as to stop sharing the above-mentioned data file package.

Specifically, when the total number of access times does not meet the number of access constraints in the access constraints, or the access time does not meet the access duration constraints in the access constraints, the data file package is deleted to generate an invalid file coverage sector.

Further, based on the above comparison results, the data file package continuously monitors the usage time and opening times of the data files, and performs corresponding processing for those that do not meet the conditions for continued access.

The above-mentioned extended control method for data file sharing effectively controls the data file access behavior of the data receiver through the above-mentioned access constraints, effectively prevents the security risk after the data is shared offline, and realizes the control of data files in different units and different locations. Extended access controls shared between principals.

As an optional implementation of the present invention, as shown in FIG. 5, in step S202, the determination of the data file access authority based on the component information of the above-mentioned data file receiving device and the above-mentioned data file package in step S202 includes:

S2021. Determine a first access identifier based on the component information of the data file receiving device.

Specifically, the data file package reads the receiving device component information collected by the data receiver, including but not limited to processor information, network card information, hard disk information, and memory information, and performs item-by-item and linking in the same order that the data provider generates the access identifier. After the Hash operation, the final Hash value, that is, the first access identifier, is obtained.

S2022. Determine the access identifier of the data receiving device based on the data file package, and use the access identifier of the data receiving device as a second access identifier.

S2023. Compare the first access identifier with the second access identifier, and determine the data file access authority based on the comparison result.

Specifically, compare the first access identifier with the above-mentioned second access identifier, if it is consistent with the access identifier, the data receiver can access the data file through the data file package; if it is inconsistent with the access identifier, the data receiver does not have the ability to open the data file. File permissions. At this time, the data file package quickly locates the device component information that is inconsistent with the receiving device and the provided component information through the binary Merkle tree, and reports it to the data receiver, and the data receiver locates and troubleshoots the problem.

In the above embodiment, the access identifier of the data receiver is generated based on the binary Merkle tree, and the device information that does not meet the access conditions can be quickly located.

As an optional implementation of the present invention, as shown in FIG. 6, in step S203, the access constraint condition is determined based on the above-mentioned data file package, and the above-mentioned data file access behavior is compared with the above-mentioned access constraint condition, including:

S2031. Determine access times constraints, access duration constraints, data file modification constraints, and data file printing constraints based on the above data file package.

S2032. Determine the total number of access times, access time, file modification action, and file printing process based on the above data file access behavior.

S2033. Comparing the access times constraints, access duration constraints, data file modification constraints, and data file printing constraints with the total access times, access time, file modification actions, and file printing processes respectively.

Specifically, when the data file package opens the data file within the access duration, it will record the current access time, replace the first record time or the last access time, and compare it when accessing the data file next time, avoiding device setting time or other means Unusual access.

Specifically, the receiving device accesses the data file, the data file package is counted, and it is determined that the restriction on the number of access times of the receiving device takes effect; wherein, based on the data file access times, the data receiver has the data file access authority and after opening the data file, the data file package will be The number of data file accesses is increased by 1, and the total number of current data file accesses is obtained and recorded, and the total number of accesses is compared with the limited number of accesses in the number of accesses. If it is within the limited number of accesses, the data file can continue to be accessed, otherwise to process.

Further, the processing for limiting the number of access times of the data file: if the number of access times exceeds the limited number of access times, the data file is deleted, and an invalid file coverage sector is generated.

Specifically, the data file package initiates file protection measures to restrict the receiving device from modifying or printing the data file; among them, based on the embedded data file package, the ability to modify and print the data file is restricted. When the data receiver opens the data file, when the data file is modified, , the data file package executes file redirection to encrypt the data file for read-only storage, and prohibits the application process from editing and modifying the file; when the data file is printed, the data file package captures the printing process. When the data file is prohibited from printing, the data file package The linked processing of the printing process is prohibited.

In the above embodiment, for the effective detection method of access duration after data file sharing, through access time recording and comparison, the access control of data files can be based on the access duration of data files, and combined with limiting access duration, limiting access times, and limiting modification The access extension restriction method of printing and other conditions can carry out refined control over the access process of shared data files and after use.

As an optional implementation manner of the present invention, in step S203, the access constraint condition is determined based on the above-mentioned data file package, and the above-mentioned data file access behavior is compared with the above-mentioned access constraint condition, which also includes:

Obtain the access record time when the above data file package is opened, and determine the access deadline based on the above access record time and the above access duration constraint.

Obtain the current access time regularly, and when the above current access time is between the above current time and the above access deadline, update the above access record time, and continue to access the above data file package; wherein, the current access time is Internet time or local time time.

Specifically, the receiving device of the data receiver accesses the data file in the data file package, and the data file package reads and records the access time, and determines that the access time constraint of the receiving device takes effect; wherein, based on the access deadline determined by the data file access time constraint, After the data receiver has access to the data file and opens the data file, the data file package checks and records the current time; if the receiving device is connected to the Internet, the data file package reads the Internet time and compares it with the first recorded time and the data file access deadline , if it is after the first record time and before the data file access deadline, the data file can continue to be accessed, otherwise it will be processed; secondly, if the receiving device is not connected to the Internet, the data file package will read the local time and compare it with the first record time, Data file access cut-off time comparison, if it is after the first record time and before the data file access cut-off time, then the data file can continue to be accessed, otherwise it will be processed.

Or, when the above-mentioned current access time is after the above-mentioned access cut-off time, the above-mentioned data file package is deleted, and an invalid file coverage sector is generated.

Specifically, restrict access time for data files: For those whose access time is before the last access time, it is required to connect to the Internet for time verification, and if the access time has exceeded the limited access time (ie, the access deadline), the data file will be deleted , and generate an invalid file to cover the sector; if the access time does not exceed the limited access time, the user will be prompted to update the local time before accessing.

Example 3

This embodiment provides an extended management and control system for data file sharing, which is applied to the data provider, as shown in Figure 7, including:

The determining module 71 is configured to receive component information of the data file receiving device, and determine an access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the component information of the data file receiving device is sent by the data receiver.

Specifically, the data provider asks the data receiver for the component information required by the data file receiving device, including but not limited to processor information, network card information, hard disk information, memory information, and optical drive information; the data provider obtains the data receiver’s data The file receives device component information and processes it.

The generation module 72 is configured to obtain data file access requirements, and generate access constraints based on the above data file access requirements.

Specifically, the above-mentioned access constraints include: access times constraints, access duration constraints, data file modification constraints, and data file printing constraints.

Further, the data provider obtains the access requirements of the data receiver's data files, including but not limited to access duration, access times, data file modification, data file printing, and data file copying.

Furthermore, the data provider generates access constraints based on the above-mentioned data file access requirements, and provides access anomaly detection measures; among them, for the number of data file accesses, a method of counting the number of data file accesses is established, and double-clicking or right-clicking to open is one time Access behavior, record the number of data accesses; for restricting the length of data access, the data file is limited to a specific date, and the access right is lost after expiration for timing; for restricting data file modification, the data file is enabled to prohibit modification mode to avoid file modification; for Restrict data file printing, by disabling the printing process of this data file, avoid data file printing; for restricted data file screen capture, when accessing this file, prevent the file from being copied by screen capture by prohibiting the ability to call the relevant screen capture tool.

The associating module 73 is configured to obtain the data file to be shared, associate the access identifier of the data receiving device, the access constraint condition and the data file to be shared, generate a data file package, and send the data file package to the data receiver .

Specifically, the above-mentioned data file to be shared is packaged, and the packaged data file to be shared is associated with the above-mentioned access times constraint, the above-mentioned access duration constraint, the above-mentioned data file modification constraint, and the data file printing constraint, to generate the above-mentioned data file package , to send the above data file package to the data receiver.

Further, the data file to be shared is encapsulated into a shared data package, and the shared data package is an executable program that can call corresponding reading software according to the format of the encapsulated data file; for example, the shared data package monitors that the encapsulated data file is .doc (a file extension) or .docx (a file extension) file type, it will automatically search for the office software of the receiving device (office software is a suite of office software developed by Microsoft Corporation) to access this data file It will automatically call the office word program (document program); when the data file package detects that the encapsulated data file is a .pdf (portable file format) file type, it will automatically search for the commonly used pdf reading software of the receiving device. When accessing this data file It will automatically call the relevant program according to the set priority; if the data file package detects the type of the encapsulated data file, if there is no reading program on the receiving device, it will prompt that the file cannot be opened.

Further, the access identifier of the data receiving device is associated with the shared data packet, and the access identifier is placed in the shared data packet, and the shared data packet is embedded with the ability to read the component information of the receiving device; for example, the data provider sends the receiving device of the data receiver Enter the component information into the shared data package, calculate the binary Merkle tree of the component information of the receiving device, and store it in the shared data package as the access identifier for data file access, and check the device information indicating that the receiving device is inconsistent with the provided information when the access is abnormal; At the same time, the shared data packet automatically detects the component information of the receiving device, and uses the algorithm consistent with the calculation of the access identifier to calculate the Hash value of the corresponding component information of the receiving device.

Further, limit the number of visits in the shared data package, and associate the number of visits with the data files in the shared data package, and the data file package has the ability to open the data file to open the number of times; for example, the data provider will the data receiver The required access times provided are entered into the shared data package, and the initial access times are recorded as 0. The shared data package associates the required access times with the data files, and the shared data package controls the number of times the data files are opened.

Further, limit the access duration in the shared data package, and associate the access duration with the data file, and the shared data package is embedded with the ability to read and record date and time; for example, the data provider can access Time, calculate the cut-off time of data file access, share the data package to record the current Internet record as the first record time, associate the data file access cut-off time with the data file, and share the data package to control the data file access time.

Furthermore, the shared data package embeds restricted data file modification and printing capabilities; for example, the data provider configures the limited modification and printing capabilities into the shared data package according to the modification and printing requirements provided by the data receiver, and shares them with the data file Associate and share data packages to control operations such as data file modification and printing.

Further, the shared data package is associated with the access constraint conditions to generate a data file package, and the data file package is sent to a data file receiver, and the data file receiver accesses the data file through a designated receiving device.

The above-mentioned extended management and control system for data file sharing determines the access identifier of the data receiving device through the component information of the data file receiving device sent by the data receiver, determines the access constraints based on the access requirements, and sets the access identifier, access The constraints are associated with the data files to be shared, which realizes the effective management and control of shared files, realizes the extended access control of data files shared between different units and different subjects, and prevents security risks such as disorderly copying, sharing, and leakage of data files .

As an optional implementation manner of the present invention, the above-mentioned determining module 71 includes:

The first determining submodule is configured to determine multiple initial hash values based on the component information of the data file receiving device.

Specifically, the data provider uses the digest algorithm to calculate the initial Hash (hash) value of the component information of the data file receiving device provided by the data receiver; for example, the processor information, network card information, hard disk information, memory information, and CD-ROM drive information; among them, the SM3 algorithm is a cryptographic hash algorithm, which is suitable for digital signature and verification in commercial cryptography applications, generation and verification of message authentication codes, and random number generation, which can satisfy multiple security requirements for cryptographic applications.

The second determination submodule is configured to determine the access identifier of the data receiving device by using a digest algorithm based on the plurality of initial hash values.

Specifically, the initial Hash value of each component information of the receiving device is linked, and the digest algorithm is used to repeatedly perform two-two Hash operations until the final Hash value is generated, and this Hash value is used as the access identifier of the data receiving device.

For example, link the Hash value of the processor information with the Hash value of the network card information, link the Hash value of the hard disk information with the Hash value of the memory information, and use the national secret SM3 digest algorithm to calculate two sets of Hash values; further combine the two sets of Hash values After connecting, the final Hash value is calculated by using the national secret SM3 digest algorithm, which is the access identifier of the data receiving device.

The storage sub-module is used to store the access identification of the above-mentioned data receiving device by using a binary hash tree.

Specifically, the entire Hash calculation process is stored based on a binary Merkle tree (that is, a binary hash tree), so that when a device accesses a data file, component information inconsistent with the access identifier can be quickly located.

Example 4

This embodiment provides an extended management and control system for data file sharing, which is applied to the data receiver, as shown in Figure 8, including:

The collection module 81 is configured to collect component information of the data file receiving device, and send the above component information of the data file receiving device to the data provider.

Specifically, the data receiver collects the component information of the data file receiving device according to the component information of the data file receiving device required by the data provider, and provides the component information to the data provider.

Further, as shown in Figure 2, after receiving the data file provided by the data provider, the data receiver accesses the data file package through the receiving device containing all component information provided to the data provider, and the data receiver accesses the data through the data file package document content.

Further, the above-mentioned data file receiving device may adopt a mobile terminal, or a PC terminal (computer terminal), or a tablet computer.

The receiving module 82 is used to receive the data file package, and determine the data file access authority based on the component information of the above-mentioned data file receiving device and the above-mentioned data file package; wherein, the above-mentioned data file package is based on the component information of the above-mentioned data file receiving device by the data provider definite.

Specifically, before accessing the data file, the data file package reads the component information of the receiving device, calculates the access identifier, and determines the access right of the receiving device.

The comparison module 83 is configured to acquire data file access behavior, determine access constraint conditions based on the data file package, and compare the data file access behavior with the access constraint conditions.

The closing module 84 is configured to close the above-mentioned data file access permission when the above-mentioned data file access behavior does not meet the above-mentioned access constraint conditions, so as to stop sharing the above-mentioned data file package.

Specifically, when the total number of access times does not meet the number of access constraints in the access constraints, or the access time does not meet the access duration constraints in the access constraints, the data file package is deleted to generate an invalid file coverage sector.

Further, based on the above comparison results, the data file package continuously monitors the usage time and opening times of the data files, and performs corresponding processing for those that do not meet the conditions for continued access.

The above-mentioned extended control system for data file sharing effectively controls the data file access behavior of the data receiver through the above-mentioned access constraints, effectively prevents the security risk after the data is shared offline, and realizes the control of data files in different units and different locations. Extended access controls shared between principals.

As an optional implementation manner of the present invention, the above-mentioned receiving module 82 includes:

The third determining submodule is configured to determine the first access identifier based on the component information of the data file receiving device.

Specifically, the data file package reads the receiving device component information collected by the data receiver, including but not limited to processor information, network card information, hard disk information, and memory information, and performs item-by-item and linking in the same order that the data provider generates the access identifier. After the Hash operation, the final Hash value, that is, the first access identifier, is obtained.

The fourth determining submodule is configured to determine the access identifier of the data receiving device based on the data file package, and use the access identifier of the data receiving device as the second access identifier.

The first comparing submodule is configured to compare the first access identifier with the second access identifier, and determine the data file access authority based on the comparison result.

Specifically, compare the first access identifier with the above-mentioned second access identifier, if it is consistent with the access identifier, the data receiver can access the data file through the data file package; if it is inconsistent with the access identifier, the data receiver does not have the ability to open the data file. File permissions. At this time, the data file package quickly locates the device component information that is inconsistent with the receiving device and the provided component information through the binary Merkle tree, and reports it to the data receiver, and the data receiver locates and troubleshoots the problem.

As an optional implementation manner of the present invention, the above comparison module 83 includes:

The fifth determination sub-module is configured to determine access times constraints, access duration constraints, data file modification constraints, and data file printing constraints based on the above data file package.

The sixth determination sub-module is configured to determine the total number of access times, access time, file modification action and file printing process based on the above-mentioned data file access behavior.

The second comparison sub-module is used to respectively compare the above-mentioned access times constraint, the above-mentioned access duration constraint, the above-mentioned data file modification constraint, and the above-mentioned data file printing constraint with the above-mentioned total number of access times, the above-mentioned access time, the above-mentioned file modification action, and the above-mentioned file printing process Compare.

Specifically, when the data file package opens the data file within the access duration, it will record the current access time, replace the first record time or the last access time, and compare it when accessing the data file next time, avoiding device setting time or other means Unusual access.

Further, the processing for limiting the number of access times of the data file: if the number of access times exceeds the limited number of access times, the data file is deleted, and an invalid file coverage sector is generated.

Specifically, the receiving device accesses the data file, the data file package is counted, and it is determined that the restriction on the number of access times of the receiving device takes effect; wherein, based on the data file access times, the data receiver has the data file access authority and after opening the data file, the data file package will be The number of data file accesses is increased by 1, and the total number of current data file accesses is obtained and recorded, and the total number of accesses is compared with the limited number of accesses in the number of accesses. If it is within the limited number of accesses, the data file can continue to be accessed, otherwise to process.

Specifically, the data file package initiates file protection measures to restrict the receiving device from modifying or printing the data file; among them, based on the embedded data file package, the ability to modify and print the data file is restricted. When the data receiver opens the data file, when the data file is modified, , the data file package executes file redirection to encrypt the data file for read-only storage, and prohibits the application process from editing and modifying the file; when the data file is printed, the data file package captures the printing process. When the data file is prohibited from printing, the data file package The linked processing of the printing process is prohibited.

As an optional implementation manner of the present invention, the above comparison module 83 also includes:

The obtaining sub-module is used to obtain the access record time when the above-mentioned data file package is opened, and determine the access deadline based on the above-mentioned access record time and the above-mentioned access duration constraint.

The update submodule is used to regularly obtain the current access time. When the above-mentioned current access time is between the above-mentioned current time and the above-mentioned access deadline, the above-mentioned access record time is updated, and the above-mentioned data file package is continued to be accessed; wherein, the above-mentioned current time is Internet time or local time.

Specifically, the receiving device of the data receiver accesses the data file in the data file package, and the data file package reads and records the access time, and determines that the access time constraint of the receiving device takes effect; wherein, based on the access deadline determined by the data file access time constraint, After the data receiver has access to the data file and opens the data file, the data file package checks and records the current time; if the receiving device is connected to the Internet, the data file package reads the Internet time and compares it with the first recorded time and the data file access deadline , if it is after the first record time and before the data file access deadline, the data file can continue to be accessed, otherwise it will be processed; secondly, if the receiving device is not connected to the Internet, the data file package will read the local time and compare it with the first record time, Comparing the cut-off time of data file access, if it is after the first record time and before the cut-off time of data file access, the data file can be accessed continuously, otherwise, it will be processed.

The deletion sub-module is used to delete the above-mentioned data file package when the above-mentioned current access time is after the above-mentioned access cut-off time, and generate invalid file coverage sectors.

Specifically, restrict access time for data files: For those whose access time is before the last access time, it is required to connect to the Internet for time verification, and if the access time has exceeded the limited access time (ie, the access deadline), the data file will be deleted , and generate an invalid file to cover the sector; if the access time does not exceed the limited access time, the user will be prompted to update the local time before accessing.

Example 5

This embodiment provides a computer device, including a memory and a processor, and the processor is configured to read instructions stored in the memory to execute an extended management and control method for data file sharing in any of the above method embodiments.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and combinations of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a Means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart flow or flows and/or block diagram block or blocks.

Example 6

This embodiment provides a computer-readable storage medium, where the computer-executable instruction is stored in the computer-executable instruction, and the computer-executable instruction can execute an extended management and control method for data file sharing in any of the above method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviation: HDD) or a solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memories.

Apparently, the above-mentioned embodiments are only examples for clear description, rather than limiting the implementation. For those of ordinary skill in the art, other changes or changes in different forms can be made on the basis of the above description. It is not necessary and impossible to exhaustively list all the implementation manners here. And the obvious changes or changes derived therefrom are still within the scope of protection of the present invention.

Claims (10)

1. An extended control method for data file sharing, applied to a data provider, characterized in that it includes: receiving the component information of the data file receiving device, and determining the access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the component information of the data file receiving device is sent by the data receiver; Acquire data file access requirements, and generate access constraints based on the data file access requirements; Acquiring the data file to be shared, associating the access identifier of the data receiving device, the access constraints and the data file to be shared, generating a data file package, and sending the data file package to the data receiver. 2. The extended management and control method for data file sharing according to claim 1, wherein determining the access identifier of the data receiving device based on the component information of the data file receiving device comprises: determining a plurality of initial hash values based on component information of the data file receiving device; Based on the plurality of initial hash values, using a digest algorithm to determine the access identifier of the data receiving device; The access identifier of the data receiving device is stored using a binary hash tree. 3. The extended management and control method for data file sharing according to claim 1, wherein the access constraints include: Access times constraints, access duration constraints, data file modification constraints and data file printing constraints. 4. The extended management and control method for data file sharing according to claim 3, characterized in that, associating the access identifier of the data receiving device, the access constraint condition and the data file to be shared, Generate a data file package, and send the data file package to the data receiver, including: Encapsulating the data file to be shared, and associating the encapsulated data file to be shared with the access times constraint, the access duration constraint, the data file modification constraint, and the data file printing constraint, to generate the data A file package, sending the data file package to a data receiver. 5. An extended control method for data file sharing, applied to a data receiver, characterized in that it includes: Collecting component information of the data file receiving device, and sending the component information of the data file receiving device to the data provider; Receiving the data file package, determining the data file access authority based on the component information of the data file receiving device and the data file package; wherein, the data file package is determined by the data provider based on the component information of the data file receiving device ; Obtaining data file access behavior, determining an access constraint condition based on the data file package, and comparing the data file access behavior with the access constraint condition; When the data file access behavior does not meet the access constraint condition, close the data file access permission to stop sharing the data file package. 6. The extended management and control method for data file sharing according to claim 5, wherein said determining the data file access authority based on the component information of said data file receiving device and said data file package comprises: determining a first access identifier based on component information of the data file receiving device; Determining an access identifier of the data receiving device based on the data file package, using the access identifier of the data receiving device as a second access identifier; Comparing the first access identifier with the second access identifier, and determining the data file access authority based on the comparison result. 7. The extended management and control method for data file sharing according to claim 5, characterized in that, the access constraints are determined based on the data file package, and the data file access behavior is compared with the access constraints comparison, including: Determine access times constraints, access duration constraints, data file modification constraints, and data file printing constraints based on the data file package; Determine the total number of visits, access time, file modification action and file printing process based on the data file access behavior; Respectively combine the access times constraint, the access duration constraint, the data file modification constraint, and the data file printing constraint with the total number of access times, the access time, the file modification action, and the file printing process Compare. 8. The extended management and control method for data file sharing according to claim 7, wherein said determining the data file access authority based on the component information of the data file receiving device and the data file package further comprises: Acquiring the access record time when the data file package is opened, and determining the access cut-off time based on the access record time and the access duration constraint; Obtaining the current access time regularly, when the current access time is between the access record time and the access deadline, update the access record time, and continue to access the data file package; wherein, the current access The time is Internet time or local time; Alternatively, when the current access time is after the access deadline, the data file package is deleted to generate an invalid file coverage sector. 9. An extended management and control system for data file sharing, applied to data providers, characterized in that it includes: A determining module, configured to receive component information of the data file receiving device, and determine an access identifier of the data receiving device based on the component information of the data file receiving device; wherein, the component information of the data file receiving device is sent by the data receiver; A generating module, configured to acquire data file access requirements, and generate access constraints based on the data file access requirements; An associating module, configured to obtain a data file to be shared, associate the access identifier of the data receiving device, the access constraints and the data file to be shared, generate a data file package, and send the data file package to data recipient. 10. An extended management and control system for data file sharing, applied to a data receiver, characterized in that it includes: The collection module is used to collect the component information of the data file receiving device, and send the component information of the data file receiving device to the data provider; The receiving module is used to receive the data file package, and determine the data file access authority based on the component information of the data file receiving device and the data file package; wherein, the data file package is based on the data file receiving device of the data provider determined by the component information; A comparison module, configured to acquire data file access behavior, determine an access constraint condition based on the data file package, and compare the data file access behavior with the access constraint condition; A closing module, configured to close the data file access authority to stop sharing the data file package when the data file access behavior does not meet the access constraint conditions.

Images