CN1194498C - Content security monitoring system and method based on digital tags - Google Patents
Content security monitoring system and method based on digital tags Download PDFInfo
- Publication number
- CN1194498C CN1194498C CNB021451125A CN02145112A CN1194498C CN 1194498 C CN1194498 C CN 1194498C CN B021451125 A CNB021451125 A CN B021451125A CN 02145112 A CN02145112 A CN 02145112A CN 1194498 C CN1194498 C CN 1194498C
- Authority
- CN
- China
- Prior art keywords
- server module
- content
- information
- module
- label
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 45
- 238000012544 monitoring process Methods 0.000 title claims abstract description 13
- 230000008569 process Effects 0.000 claims abstract description 21
- 238000012550 audit Methods 0.000 claims abstract description 19
- 238000012795 verification Methods 0.000 claims abstract description 19
- 230000006870 function Effects 0.000 claims description 18
- 238000001914 filtration Methods 0.000 claims description 4
- 238000013475 authorization Methods 0.000 claims description 2
- 230000000694 effects Effects 0.000 claims description 2
- 230000008859 change Effects 0.000 description 6
- 238000013461 design Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 101000896740 Solanum tuberosum Cysteine protease inhibitor 9 Proteins 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- FFBHFFJDDLITSX-UHFFFAOYSA-N benzyl N-[2-hydroxy-4-(3-oxomorpholin-4-yl)phenyl]carbamate Chemical compound OC1=C(NC(=O)OCC2=CC=CC=C2)C=CC(=C1)N1CCOCC1=O FFBHFFJDDLITSX-UHFFFAOYSA-N 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000007639 printing Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 239000002775 capsule Substances 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000003860 storage Methods 0.000 description 1
- 238000012384 transportation and delivery Methods 0.000 description 1
Images
Landscapes
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
- Computer And Data Communications (AREA)
Abstract
基于数字标签的内容安全监控系统及方法属于网络信息安全领域。系统主要包括：客户端和服务器端，服务器端包括：代理服务器模块、标签局模块、策略服务器模块、验证服务器模块、网络信息服务器模块，标签局模块、策略服务器模块通过网络与代理服务器模块、验证服务器模块相连接，网络信息服务器模块连接在代理服务器模块的后端，代理服务器模块、验证服务器模块通过网络与客户端连接。方法通过对信息内容添加标签，并通过基于标签的安全策略来进行管理，分为内容分发流程和验证审计流程两个部分，这两个流程按顺序执行。本发明适用于企业内部涉密网，不需要证书中心支持，避免资料遭到滥用，实现访问控制及操作审计、全过程及动态的安全策略。
A content security monitoring system and method based on a digital tag belongs to the field of network information security. The system mainly includes: client and server. The server includes: proxy server module, label bureau module, policy server module, verification server module, network information server module, label bureau module, and policy server module. The server modules are connected to each other, the network information server module is connected to the back end of the proxy server module, and the proxy server module and the verification server module are connected to the client through the network. The method adds labels to information content and manages them through security policies based on labels. It is divided into two parts: content distribution process and verification audit process. These two processes are executed in sequence. The invention is suitable for the secret-related network inside the enterprise, does not need the support of the certificate center, avoids the misuse of data, and realizes access control and operation audit, the whole process and dynamic security strategy.
Description
Technical field
What the present invention relates to is a kind of information content safety monitoring system and method, and particularly a kind of content safety supervisory control system and method based on digital label belong to filed of network information security.
Background technology
Specifically content safety in the information security, is to prevent client terminal download malice or harmful information content, confidential information safe transmission and issue, information content access control and audit.Because relate to the contents supervision, computer need be discerned automatically to the information content.Yet that is that all right is ripe for technology such as natural language understanding, is not enough to finish this task.Even the algorithm that some are comparatively ripe also is at English document.More immature for Chinese document text-processing technology.In this case, we bring into use the mode of digital label to carry out the contents supervision.The application number of submitting to the applicant is in the patent documentation of 01139014.X, we are at the method for digital label, designed a kind of web page server of expansion, the difference of this server and traditional server is, it is in content distributed, can insert webpage to digital label then by inquiring about a server that is referred to as label office.Like this, the webpage of issue has just had digital label, does not provide client or how other application program makes digital label play a role but do not mention.The patent of the applicant's application, number of patent application is: 01139015.8, name is called: based on the network information content grading management method of PKIX, this patent documentation at the content safety monitoring Demand Design on the Internet a kind of information content management method based on PKIX, in this method, proposition utilizes PKIX to sign and issue and the administering digital label, and this method utilizes the mode of multi-zone supervision to come a large amount of certificate centers at different levels are managed.But this mode is applicable to public network, rather than is used for enterprises concerning security matters network, because generally be not equipped with certificate center on Intranet, moreover the certificate center quantity on the Internet is few at present, the technology imperfection.
Summary of the invention
The present invention is directed to the deficiencies in the prior art and defective, a kind of content safety supervisory control system and method based on digital label is provided, make it be applicable to the enterprises classified network, certificate of necessity center is not supported, by network information medium being added the method for label, the transmission of important content on the managerial grid internet avoids data to be abused.The present invention is achieved through the following technical solutions, system of the present invention comprises: the client and server end, server end passes through proxy modules, the authentication server module is connected with client, server end is except common network information server, increased acting server, label office, strategic server, four modules of authentication server, label office module is connected with the authentication server module with proxy modules by network with the strategic server module, the network information server module is connected the rear end of proxy modules, avoids directly being visited by client.
Client has also increased a miscellaneous function module except generic browser, browser and miscellaneous function module are positioned at same computer, is connected with proxy modules, the authentication server module of server end by network.
Proxy modules is actually an enhancing version that common proxy modules has been increased new function.It can carry out the inquiry of searching label and control strategy after receiving user's request, and can whether send this information to client according to label and strategy decision, perhaps before information is sent to client content is encrypted.Proxy modules can be finished access control function, and when the user asked some pages, proxy modules is the label and the access control policy of this page of inquiry earlier, if strategy allows, then finish user's requested operation, otherwise, return show the operation unaccepted html page.
The later security strategy of information content issue is implemented by the authentication server module, in fact asks after a certain page as the user, and proxy modules returns to client is the page after encrypting.Deciphering to the page realizes by browser plug-in.Guaranteed in the time of insert design that the user can't preserve the page of plain code in this locality, but can preserve the page after the encryption.In the time of resource after user capture is downloaded like this, still need be by the checking of authentication server, and obtain decruption key.To guarantee to decipher the back when it is pointed out that insert design here and destroy key, by the authentication server module can guarantee user's download Internet resources still can continue to implement security strategy later on.
With above-mentioned similar, the user also finishes by the authentication server module the audit of resource access operations, because the user is when accesses network resource (resource and the local encrypt asset of preserving that comprise the access server end) all needs to obtain content key through the authentication server module.Therefore, the solicit operation of content key be can be used as the foundation of information content accessing operation audit.
After the user side download message, the strategy on the strategic server module can dynamic-configuration, and comes into force in real time by the authentication server module.Dynamically change policy configurations and realize that by strategic server module and authentication server module because the user is to the visit of Internet resources each time, online or off-line all needs current strategy is inquired about.Therefore, Ce Lve change can come into force.So-called online and off-line is said at information server, even but the local resource of visit, the user still needs to visit the authentication server module, according to system design of the present invention, even after content is downloaded, security strategy in the strategic server module still can dynamically change, and effectively.
Deposited user's information and resource access control tabulation in the strategic server module, it is equivalent to a LIST SERVER on function, and directory service is provided on network.
The resource description label is mainly stored and issued to label office module, and comprising unique content key of corresponding needs with each Internet resources, this content key can play encryption and decryption in workflow.
Browser can send to authentication module together with label with user authentication information, and is decrypted later on obtaining content key, and auto-destruct key after deciphering if browser can not obtain content key, then can't show the encryption webpage.An acting server is arranged between common network information server and user browser, be used for finishing user's variety of protocol request.Acting server can be tabulated from strategic server searching user's information and resource access, and can encrypt information from label office inquiry tag information.
The miscellaneous function module of client at first is used for limiting the performance constraint of client to the important information content, and it can shield printing, the hold function of browser, can also copy the screen function by the SHIELDING CALCULATION machine.In addition, it also needs to finish the function of deciphering.
The present invention is on the basis of this system, propose to realize contents supervision's method, by the information content is added label, and manage by security strategy based on label, method is divided into two parts: content distribution flow and checking audit process, these two flow processs are carried out in order, and concrete steps are as follows:
1) content distribution flow:
1. browser sends request;
2. proxy modules is from network information server module downloading page;
3. proxy modules is from label office module inquiry tag;
4. proxy modules is obtained Access Control List (ACL) from the strategic server module;
5. proxy modules is encrypted the page;
6. the page and label thereof after proxy modules will be encrypted send to browser.
2) checking audit process:
1. browser sends to the authentication server module with user authentication information and resource tag;
2. the authentication server module obtains content key from label office module;
3. the authentication server module obtains Access Control List (ACL) from the strategic server module;
4. authentication server module verification user right;
5. the authentication server module sends to browser to content key;
6. browser is deciphered the page.
Below the inventive method is further described:
● at first need to add digital label for the information content important in the network information server module, the title that contains resource in the digital label of the present invention, the founder, summary, and and unique content key of being associated of content, digital label can adopt many methods to describe, no matter what it adopted is any form, it does not change its essence, wherein method is to adopt the form of resource description framework (RDF) to be described preferably, benefit with resource description framework (RDF) is can integrated many existing description vocabulary, dublin core (Dublin Core) etc. as previously mentioned.
● the step of content distribution flow is 3. and 4., and proxy modules is obtained resource access control tabulation and digital label according to user's request respectively from strategic server module and label office module, and according to security strategy decision subsequent step;
Security strategy of the present invention is to formulate at the rating information that contains in the digital label, the description of strategy comprises following content: unified resource location (URL), blacklist, classified filtering strategy, Access Control List (ACL), audit content, wherein the classified filtering strategy selects the situation of platform (Platform for Internet Content Selection) classification vocabulary to formulate at containing internet content in the label.
● the step of content distribution flow is 5. and 6., if user's information conforms security strategy, the content key that the proxy modules utilization is obtained from digital label is encrypted information, and information and key after the encryption send to client together, if user's information does not meet the requirement of security strategy, proxy modules refusing user's request then, and send the page of Reason For Denial to client;
Described key is a content key, and it is the unique key that is associated with specific information content, and it is to generate when adding label.Proxy modules is all undertaken by this key contents decryption content-encrypt and browser plug-in, because this key and information content direct correlation, so can regard accessing operation to the information content as to the solicit operation of this key.
● the step of checking audit process 1. in, browser obtains encrypting after the page, and user profile and digital label are sent to the authentication server module, the authentication server module is according to user's mandate decision subsequent operation;
● checking audit process step is 5. and 6., if user's information conforms security strategy, then the authentication server module sends content key to browser, the miscellaneous function module is after obtaining key, be decrypted encrypting webpage, if user's information does not meet security strategy, then the authentication server module does not send key to browser, and browser can't show encrypted content.
The present invention has substantive distinguishing features and marked improvement, after having adopted native system and method thereof, can improve the monitoring to important content aspect three:
1. can realize access control and operation audit to important content.The user need be undertaken by proxy modules the request of information, proxy modules can be according to the security strategy control that conducts interviews, and in addition, the user needs the information of enabling decryption of encrypted, also need by the authentication server module, be equivalent to and increased controlled function one.Because the user visits secret content each time all needs to obtain content key, therefore, the authentication server module can be operated audit to the request of content key according to the user.
2. the security strategy of overall process.Common content delivering system, after being downloaded, content just lost control to information, and native system continues to realize security strategy by the authentication server module after content is downloaded, thereby has realized from content release until the security strategy of inefficacy overall process.
3. dynamic security strategy.Common supervisory control system leaves strategy in client terminal local, and strategy just can not dynamically change like this, and native system is issued strategy with the form of service, can real time altering, and come into force.
Description of drawings
Fig. 1 entire system structural representation of the present invention
Embodiment
As shown in Figure 1, the present invention mainly comprises: client 1 and server end 2, the proxy modules 6 of server end 2, authentication server module 9 is connected with client 1 by network 3, server end 2 comprises that 5 are formed module: proxy modules 6, label office module 7, strategic server module 8, authentication server module 9, network information server module 10, its connected mode is: label office module 7, strategic server module 8 is by network 3 and proxy modules 6, authentication server module 9 is connected, and network information server module 10 is connected the rear end of proxy modules 6.
Client 1 comprises 2 modules: browser 4, miscellaneous function module 5, browser 4 and miscellaneous function module 5 are positioned at same computer, are connected with proxy modules 6, the authentication server module 9 of server end 2 by network 3.
Browser 4 sends to authentication server module 9 with user authentication information together with label, and is decrypted auto-destruct key after deciphering later on obtaining content key.
Deposit user's information and resource access control tabulation in the strategic server module 8,7 storages of label office module and issue resource description label, comprising with the corresponding unique content key of each Internet resources.
Provide following examples in conjunction with content of the present invention:
Dispose the confidential information delivery system of an enterprises classified network in concrete network environment, client also increases a browser plug-in except normally used browser.If use Microsoft's browser (IE), the ActiveX that then uses Microsoft to provide writes browser component, and this browser component is a kind of block that depends on browser, is used for finishing the restriction of deciphering and function.
A complete information issue flow process can be divided into two parts, and they are content release flow process and checking audit process.The concrete steps of these two flow processs are as follows: 1) content distribution flow: 1. browser 4 sends request to acting server 6; 2. acting server 6 is from network information server 10 downloading page; 3. acting server 6 is from label office 7 inquiry tags; 4. acting server 6 obtains Access Control List (ACL) from strategic server 8; 5. acting server 6 is encrypted the page; 6. the page and label thereof after acting server 6 will be encrypted send to browser 4.
2) checking audit process: 1. browser 4 sends to authentication server module 9 modules with user authentication information and resource tag; 2. authentication server module 9 obtains content key from label office module 7; 3. authentication server module 9 obtains Access Control List (ACL) from strategic server module 8; 4. authentication server module 9 is verified user rights; 5. authentication server module 9 sends to browser 4 to content key; 6. browser supplementary module 5 is deciphered the pages.General user's browse operation relates to the process 1 that order is carried out) and process 2), if user capture is kept at local encryption webpage, then only relate to the checking audit process.Need to guarantee secure communication between each module of server end, therefore need to adopt secure communication protocols (SSL).In addition, before work, need earlier authenticating identity mutually between browser and the certificate server.Existing subscriber identity information has resource access control tabulation again in the strategic server, and what it provided is the function of a directory service basically, therefore can adopt LDAP (LDAP) agreement to realize query manipulation, also can adopt other modes.
Adopt such method to carry out the information issue, just can realize management capsule information.Specifically, can obtain following effect: the user that the data of concerning security matters is merely able to be hoped visits, and can stipulate his operating right, such as printing, preserve and the copy screen, can carry out detailed audit to his accessing operation; Still can monitor later in the confidential data granting it, such as, hope changes this user's operating right after providing, and then can dynamically change authorization conditions by strategic server.
Claims (8)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB021451125A CN1194498C (en) | 2002-11-07 | 2002-11-07 | Content security monitoring system and method based on digital tags |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB021451125A CN1194498C (en) | 2002-11-07 | 2002-11-07 | Content security monitoring system and method based on digital tags |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1411199A CN1411199A (en) | 2003-04-16 |
| CN1194498C true CN1194498C (en) | 2005-03-23 |
Family
ID=4750774
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB021451125A Expired - Fee Related CN1194498C (en) | 2002-11-07 | 2002-11-07 | Content security monitoring system and method based on digital tags |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1194498C (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101778108B (en) * | 2010-01-22 | 2012-10-24 | 蓝盾信息安全技术股份有限公司 | Method and device for preventing falsification of homepage of server |
| CN107111605A (en) * | 2014-10-07 | 2017-08-29 | 塞尼股份公司 | method and system for managing file access |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100450009C (en) * | 2003-06-17 | 2009-01-07 | 华为技术有限公司 | Method for distributing universal label of network node |
| CN1315268C (en) | 2003-11-07 | 2007-05-09 | 华为技术有限公司 | Method for authenticating users |
| JP4265479B2 (en) * | 2004-05-26 | 2009-05-20 | ソニー株式会社 | Communications system |
| CN1633065B (en) * | 2004-12-28 | 2010-05-12 | 华中师范大学 | System and method for secure distribution of network digital books with content monitoring |
| CN101193035B (en) * | 2006-11-24 | 2011-04-20 | 中国电信股份有限公司 | A system and method for deploying virtual private network service based on IP secure protocol |
| CN102509057B (en) * | 2011-10-18 | 2015-05-13 | 国网电力科学研究院 | Mark-based method for safely filtering unstructured data |
| US9275221B2 (en) * | 2013-05-01 | 2016-03-01 | Globalfoundries Inc. | Context-aware permission control of hybrid mobile applications |
| CN105162793A (en) * | 2015-09-23 | 2015-12-16 | 上海云盾信息技术有限公司 | Method and apparatus for defending against network attacks |
| CN107528827B (en) * | 2017-07-27 | 2020-08-18 | 曲立东 | A digital label-based traceable data connection method and platform |
| CN108183915B (en) * | 2018-01-15 | 2020-02-11 | 中国科学院信息工程研究所 | Security label implementation system for high security level service and application requirements |
-
2002
- 2002-11-07 CN CNB021451125A patent/CN1194498C/en not_active Expired - Fee Related
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101778108B (en) * | 2010-01-22 | 2012-10-24 | 蓝盾信息安全技术股份有限公司 | Method and device for preventing falsification of homepage of server |
| CN107111605A (en) * | 2014-10-07 | 2017-08-29 | 塞尼股份公司 | method and system for managing file access |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1411199A (en) | 2003-04-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7707642B1 (en) | Document access auditing | |
| CN101207485B (en) | System and method of unification identification safety authentication for users | |
| US8627077B2 (en) | Transparent authentication process integration | |
| US7930757B2 (en) | Offline access in a document control system | |
| US8627489B2 (en) | Distributed document version control | |
| US8719582B2 (en) | Access control using identifiers in links | |
| US8832047B2 (en) | Distributed document version control | |
| EP1460511B1 (en) | Reviewing cached user-group information in connection with issuing a digital rights management (DRM) license for content | |
| US20130212707A1 (en) | Document control system | |
| US20020046350A1 (en) | Method and system for establishing an audit trail to protect objects distributed over a network | |
| CN1787513A (en) | System and method for safety remote access | |
| US20030051172A1 (en) | Method and system for protecting digital objects distributed over a network | |
| CN101064717A (en) | Safety protection system of information system or equipment and its working method | |
| CN1547343A (en) | A Single Sign On method based on digital certificate | |
| CN1713106A (en) | System and method for providing security to an application | |
| CN1194498C (en) | Content security monitoring system and method based on digital tags | |
| CN1855814A (en) | Safety uniform certificate verification design | |
| US20120089495A1 (en) | Secure and mediated access for e-services | |
| CN107948235A (en) | Cloud data safety management and audit device based on JAR | |
| CN1889081A (en) | Data base safety access method and system | |
| CN1943166A (en) | Method for transmitting secured contents via internet | |
| CN1930850A (en) | An apparatus, computer-readable memory and method for authenticating and authorizing a service request sent from a service client to a service provider | |
| CN2891503Y (en) | Security protection system for information system or equipment | |
| CN118368063A (en) | A cluster implementation method and device for massive key management | |
| CN115550047A (en) | Configuration-free interface authority verification method, device and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C19 | Lapse of patent right due to non-payment of the annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |