CN114662123A - File tracking method and device - Google Patents

Abstract

The application provides a file tracking method and a device, wherein the method comprises the following steps: monitoring file operation events; under the condition that the file operation event is detected to be triggered, acquiring and recording the circulation information of a target file corresponding to the file operation event; wherein the circulation information is used for tracking the circulation of the target file. The file tracking method and device provided by the application can realize tracking and monitoring of the files inside an enterprise under the condition that the client is not installed, and can avoid the occurrence of a divulgence condition.

Description

File tracking method and device

technical field

The present application relates to the field of document traceability, and in particular, to a document tracing method and device.

Background technique

With the development of Internet technology, information security has become more and more important, especially the confidential documents within the enterprise. In order to ensure the security of the circulation process of confidential documents within the enterprise, it is usually necessary to track and monitor the circulation process of confidential documents.

In the related art, confidential documents can be encrypted, employees can use the client to decrypt them to access, and the client can also record relevant access information, thereby realizing the tracking and monitoring of internal documents of the enterprise. However, in such a file tracking method, a client needs to be installed on the device, and the confidential files can be accessed only after decryption, which is inconvenient to operate.

SUMMARY OF THE INVENTION

The purpose of this application is to provide a file tracking method and device for tracking and monitoring the file transfer process.

This application provides a document tracking method, including:

Monitoring file operation events; in the case of detecting that the file operation event is triggered, acquiring and recording the flow information of the target file corresponding to the file operation event; wherein, the flow information is used to track the flow of the target file. .

Optionally, the flow information includes at least one of the following: node information of the previous node, node information of the current node, file information of the target file, and trigger time of the file operation event.

Optionally, the monitoring of the file operation event includes: associating the file operation event with a Hook function, and constructing a callback function corresponding to the Hook function; wherein the file operation event includes at least one of the following: File creation event, file opening event, file saving event, file closing event; the callback function is used to obtain and record the flow information.

Optionally, in the case of detecting that the file operation event is triggered, acquiring and recording the flow information of the target file corresponding to the file operation event includes: in the case of detecting that the file operation event is triggered Next, the circulation information is acquired through the callback function, and the circulation information is stored in the attribute information of the target file through the COM component, and/or the circulation information is stored in the server.

Optionally, after acquiring and recording the flow information of the target file corresponding to the file operation event when it is detected that the file operation event is triggered, the method further includes: from the attribute of the target file information, and/or, extract the circulation information corresponding to each node of the target file in the circulation process; generate the circulation path according to the circulation information corresponding to each node of the target file in the circulation process, and based on The circulation path traces the source of the target file.

Optionally, in the case of detecting that the file operation event is triggered, acquiring and recording the flow information of the target file corresponding to the file operation event, including: when the triggered file operation event is the file creation event In the case of the target file created by the file creation event, the target script is injected into the target file; wherein, the target script is used to run the target script when accessing the target file, detect the operating environment of the current device, and in the In the case that the running environment of the current device does not meet the preset condition, the access to the target file is prohibited.

The application also provides a file tracking device, including:

a monitoring module for monitoring file operation events; a recording module for acquiring and recording the flow information of the target file corresponding to the file operation event when it is detected that the file operation event is triggered; wherein, the flow The information is used to track the flow of the target file.

Optionally, the flow information includes at least one of the following: node information of the previous node, node information of the current node, file information of the target file, and trigger time of the file operation event.

Optionally, the monitoring module is specifically configured to associate the file operation event with a Hook function, and construct a callback function corresponding to the Hook function; wherein the file operation event includes at least one of the following: Create event, file open event, file save event, file close event; the callback function is used to obtain and record the flow information.

Optionally, the recording module is specifically configured to obtain the circulation information through the callback function when it is detected that the file operation event is triggered, and store the circulation information to the In the attribute information of the target file, and/or, the flow information is stored in the server.

Optionally, the apparatus further includes: an information extraction module and a generation module; the information extraction module is configured to extract the attribute information of the target file from the server, and/or extract the target file from the server during the transfer process The flow information corresponding to each node in the file; the generation module is used to generate a flow path according to the flow information corresponding to each node of the target file in the flow process, and trace the source of the target file based on the flow path. .

Optionally, the apparatus further includes: an injection module; the injection module is configured to inject a target into the target file created by the file creation event when the triggered file operation event is the file creation event Script; wherein, the target script is used to run the target script when accessing the target file, detect the operating environment of the current device, and prohibit the target when the operating environment of the current device does not meet the preset conditions file access.

The present application also provides a computer program product, comprising a computer program/instruction, when the computer program/instruction is executed by a processor, implements the steps of any one of the above-mentioned file tracking methods.

The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, when the processor executes the program, the file tracking method according to any one of the above-mentioned methods is implemented. A step of.

The present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of any one of the above-mentioned file tracking methods.

The file tracking method and device provided by the present application, in order to realize the tracking and monitoring of the files accessed on the device, it is necessary to monitor the file operation event on the device, and obtain the file operation event when it is detected that the file operation event is triggered. And record the flow information of the target file corresponding to the file operation event, so as to track and monitor the target file according to the recorded flow information.

Description of drawings

In order to illustrate the technical solutions in the present application or the prior art more clearly, the following briefly introduces the accompanying drawings that are needed in the description of the embodiments or the prior art. Obviously, the drawings in the following description are of the present application. For some embodiments of the present invention, for those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic flowchart of a file tracking method provided by the application;

2 is a schematic structural diagram of a file tracking device provided by the present application;

FIG. 3 is a schematic structural diagram of an electronic device provided by the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the accompanying drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application. , not all examples. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

The terms "first", "second" and the like in the description and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the present application can be practiced in sequences other than those illustrated or described herein, and distinguish between "first", "second", etc. The objects are usually of one type, and the number of objects is not limited. For example, the first object may be one or more than one. In addition, "and/or" in the description and claims indicates at least one of the connected objects, and the character "/" generally indicates that the associated objects are in an "or" relationship.

The technical terms involved in the embodiments of the present application are explained below:

Process injection: In Windows system, each process has its own private memory address space, when using pointers to access memory, one process cannot access the memory address space of another process. Process injection is to let a thread execute in another process. In this embodiment of the present application, the file operation time can be monitored when the specific application is running by performing process injection into the process of the specific application.

Hook (Hook): It is a platform for the Windows system message processing mechanism, which is translated as "hook" or "hook" in Chinese. After hooking a specific system event, once a hooked event occurs, the program that hooks the event will receive a notification from the system, and the program can respond to the event as soon as possible.

Each Hook has a list of pointers associated with it, called the hook list, which is maintained by the system. The pointer of this list points to the specified, application-defined callback function called by the Hook subroutine, that is, each processing subroutine of the hook. When a message associated with the specified Hook subroutine occurs, the system delivers the message to the corresponding Hook subroutine. Some hook subroutines can only monitor the message, or modify the message, or stop the progress of the message, to avoid these messages being passed to the next hook subroutine or destination window. The most recently installed hooks are placed at the beginning of the chain, and the earliest installed hooks are placed at the end, that is, those added later gain control first.

The Windows system does not require that the uninstallation order of hook subroutines must be reversed from the installation order. Whenever a hook is uninstalled, the Windows system releases the memory it occupies and updates the entire Hook list. If the program installs the hook, but ends before the hook is uninstalled, the system will automatically uninstall the hook for it.

A hook is actually a program segment that processes a message and hooks it into the system through a system call. Whenever a specific message is sent, before reaching the destination window, the hook program first captures the message, that is, the hook function gets control first. At this time, the hook function can process the message, or continue to deliver the message without processing, or force the delivery of the message to end.

Globally Unique Identifier (GUID): It is a digital identifier with a binary length of 128 bits generated by an algorithm. GUIDs are mainly used in networks or systems with multiple nodes and multiple computers. In an ideal world, no computer or cluster of computers would generate two identical GUIDs. The total number of GUIDs reaches 2^128 (3.4×10^38), so the possibility of randomly generating two identical GUIDs is very small, but not 0. Therefore, the algorithms used to generate GUIDs usually add non-random parameters (such as time) to ensure that this kind of repetition does not occur.

In order to protect the leakage of secret-related files within the enterprise and at the same time to track and monitor the secret-related files of the enterprise, most of the existing file tracking methods use file encryption technology in the client to encrypt and decrypt secret-related files. This tracking method can save the file as a new encrypted file when it is saved on the disk. The new file can contain specific encrypted information and the information of the file itself, and the encrypted information can be distributed along with the file at the same time, so as to track the document. The purpose of the transfer process.

However, in the existing file tracking method, a client needs to be installed in the device, and confidential files cannot be accessed in the device without the client installed. Moreover, if the file is streamed to an external device after decryption, the file cannot be tracked, resulting in the leakage of confidential files.

The file tracking method provided by the embodiments of the present application will be described in detail below through specific embodiments and application scenarios with reference to the accompanying drawings.

As shown in FIG. 1, a file tracking method provided by an embodiment of the present application may include the following steps 101 and 102:

Step 101 , monitor file operation events.

Exemplarily, the above-mentioned file operation event may be a file operation event that can be triggered by the target application corresponding to the file type to be monitored. The above-mentioned monitored file types may include documents, pictures and other types of files. The above-mentioned file operation events include: file creation event, file opening event, file saving event, file closing event and other events triggered when the file is operated.

Exemplarily, a dynamic link library (Dynamic Link Library, DLL) file containing the code for executing the file tracking method provided by the embodiment of the present application may be injected into the process of the above target application by the above process injection method, and the The DLL file is loaded in the process of the target application to monitor file operation events.

Step 102: In the case of detecting that the file operation event is triggered, acquire and record the flow information of the target file corresponding to the file operation event.

The circulation information is used to track the circulation of the target file.

Exemplarily, when it is detected that a file operation event is triggered, it means that the current device is accessing a file of a file type that needs to be monitored, that is, the above-mentioned target file. The target file may be any file that needs to be monitored stored on the current device, for example, office documents in doc, docx, ppt, pptx, xls, and xlsx formats.

Exemplarily, after it is detected that the file operation event is triggered, the target file operated by the file operation event can be determined, and the above-mentioned flow information can be obtained.

Exemplarily, the above-mentioned flow information may include at least one of the following: node information of the previous node, node information of the current node, file information of the target file, and trigger time of the file operation event.

Specifically, the above-mentioned transfer information may include: the GUID of the target file, the GUID of the user of the current device, the GUID of the previous node, the GUID of the current node, the current time, the file path of the target file, and the like.

Exemplarily, after obtaining the circulation information of the target file on the current device, the foregoing circulation information may be stored in the attribute information of the file or in the server, so as to realize the tracking and monitoring of the target file.

In this way, in order to be able to track and monitor the files accessed on the device, it is necessary to monitor the file operation event on the device, and when it is detected that the file operation event is triggered, acquire and record the target corresponding to the file operation event. The flow information of the file is convenient for tracking and monitoring the target file according to the recorded flow information.

Optionally, in this embodiment of the present application, the monitoring of file operation events may be implemented by using the Hook technology.

Exemplarily, the above step 101 may include the following step 101a:

Step 101a: Associate the file operation event with a Hook function, and construct a callback function corresponding to the Hook function.

The file operation event includes at least one of the following: a file creation event, a file opening event, a file saving event, and a file closing event; the callback function is used to acquire and record the flow information.

Exemplarily, by associating the function corresponding to the file operation event of the target application with the hook function, when the function corresponding to the file operation event runs, the operating system can be triggered to execute the callback function of the hook function to execute the code in the callback function.

Exemplarily, the functions corresponding to the above file operation events may include: opening an open() function, closing a close() function, creating a create() function, and the like. Different functions correspond to different file operation events.

It should be noted that the above monitoring file operation event may be executed by a target thread injected into the process of the above target application.

In this way, by associating the Hook function with the function corresponding to the file operation event of the target application, the monitoring of the above-mentioned file operation event can be realized.

Further, in this embodiment of the present application, after detecting that the above-mentioned file operation event is triggered, relevant information of the current device can be obtained through the above-mentioned callback function, and recorded in the attribute information of the target file or the server.

Exemplarily, the above step 102 may include the following step 102a:

Step 102a, when it is detected that the file operation event is triggered, obtain the flow information through the callback function, and store the flow information in the attribute information of the target file through the COM component, and/ Or, the circulation information is stored in the server.

Exemplarily, the above-mentioned COM component is a component provided by the above-mentioned target application. That is, after obtaining the above-mentioned circulation information, the above-mentioned circulation information can be added to the attribute information of the target file through the COM component provided by the target application.

It should be noted that the above-mentioned flow information is added to the attribute information of the target file through the COM component provided by the target application, which has better compatibility and does not require separate development.

Further, after the above step 102, the file tracking method provided by the embodiment of the present application may further include the following steps 103 and 104:

Step 103: Extract the flow information corresponding to each node in the flow of the target file from the attribute information of the target file and/or the server.

Step 104: Generate a flow path according to the flow information corresponding to each node in the flow of the target file, and trace the source of the target file based on the flow path.

It can be understood that, when each device accesses a secret-related file, the flow information obtained by the current device can be added to the attribute information of the secret-related file. In addition, when obtaining the above-mentioned circulation information on the current device, it is also necessary to read the circulation information added by the secret-related file on the previous node. For example, according to the flow information of the previous node, information such as the GUID of the previous node can be obtained.

Exemplarily, in order to realize the remote monitoring of all secret-related files in the enterprise, the above-mentioned circulation information can also be stored in the server. After the server performs statistics and summarization, it can display the circulation path of each secret-related file and the corresponding information of each node. flow information.

For example, the administrator can monitor the information such as each node where the target file is circulated, the users accessing it, and the access time through the circulation information uploaded to the server.

Optionally, in this embodiment of the present application, in order to avoid the flow of secret-related files to an external device, resulting in the leakage of secret-related files, the file tracking method provided by the embodiments of the present application If the operating environment does not meet the preset conditions, the external device is prohibited from accessing the confidential file.

Exemplarily, the above step 102 may include the following step 102b:

Step 102b: In the case that the triggered file operation event is the file creation event, inject a target script into the target file created by the file creation event.

Wherein, the target script is used to detect the running environment of the current device when accessing the target file, and prohibit the access of the target file when the running environment of the current device does not meet a preset condition.

Exemplarily, in order to prevent an external device from accessing a secret-related file (ie, the above-mentioned target file), a target script may be injected into the file when the file is created. The target script runs automatically when the device accesses the file, and is used to detect the running environment of the current device. If the running environment of the current device is different from the running environment of the device inside the enterprise, it means that the current device is an external device. The target script can prevent the device from accessing the classified file.

It can be understood that the method for the target script to prohibit the device from accessing the secret-related file may include: closing the secret-related file, deleting the secret-related file, and encrypting the secret-related file.

The file tracking method provided by the embodiment of the present application monitors file operation events by means of process injection, and when the file operation event is triggered, obtains the flow information of the target file corresponding to the file operation event, and stores the flow information in the target file. attribute information, and/or in the server, to facilitate tracking and monitoring of the target file. Meanwhile, when the target file is created, the target script can also be injected into the target file, so that the external device cannot access the target file. In this way, the tracking and monitoring of confidential files can be realized without installing a client on the device, and the confidential files cannot be accessed after they are transferred to the external environment, thereby avoiding the occurrence of leakage.

It should be noted that, in the file tracking method provided by the embodiments of the present application, the execution body may be a file tracking device, or a control module in the file tracking device for executing the file tracking method. In the embodiment of the present application, the file tracking device provided by the embodiment of the present application is described by taking the file tracking method performed by the file tracking device as an example.

It should be noted that, in the embodiments of the present application, the above methods are shown in the accompanying drawings. The file tracking methods are all exemplarily described with reference to a figure in the embodiments of the present application. During specific implementation, the file tracking method shown in the drawings of the above methods can also be implemented in combination with any other drawings shown in the above embodiments that can be combined, and details are not described herein again.

The file tracking device provided by the present application is described below, and the file tracking method described below and the file tracking method described above can be referred to each other correspondingly.

FIG. 2 is a schematic structural diagram of a file tracking device provided by an embodiment of the application, as shown in FIG. 2 , which specifically includes:

The monitoring module 201 is used to monitor the file operation event; the recording module 202 is used to acquire and record the flow information of the target file corresponding to the file operation event when it is detected that the file operation event is triggered; The circulation information is used to track the circulation of the target file.

Optionally, the flow information includes at least one of the following: node information of the previous node, node information of the current node, file information of the target file, and trigger time of the file operation event.

Optionally, the monitoring module 201 is specifically configured to associate the file operation event with a Hook function, and construct a callback function corresponding to the Hook function; wherein, the file operation event includes at least one of the following: File creation event, file opening event, file saving event, file closing event; the callback function is used to obtain and record the flow information.

Optionally, the recording module 202 is specifically configured to obtain the flow information through the callback function when it is detected that the file operation event is triggered, and store the flow information to the file through the COM component. in the attribute information of the target file, and/or, store the transfer information in the server.

Optionally, the apparatus further includes: an information extraction module and a generation module; the information extraction module is configured to extract the attribute information of the target file from the server, and/or extract the target file from the server during the transfer process The flow information corresponding to each node in the file; the generation module is used to generate a flow path according to the flow information corresponding to each node of the target file in the flow process, and trace the source of the target file based on the flow path. .

Optionally, the apparatus further includes: an injection module; the injection module is configured to inject a target into the target file created by the file creation event when the triggered file operation event is the file creation event Script; wherein, the target script is used to run the target script when accessing the target file, detect the operating environment of the current device, and prohibit the target when the operating environment of the current device does not meet the preset conditions file access.

The file tracking device provided by the present application monitors file operation events by means of process injection, and when the file operation event is triggered, obtains the flow information of the target file corresponding to the file operation event, and stores the flow information in the attribute of the target file information, and/or, in the server, it is convenient to track and monitor the target file. Meanwhile, when the target file is created, the target script can also be injected into the target file, so that the external device cannot access the target file. In this way, the tracking and monitoring of confidential files can be realized without installing a client on the device, and the confidential files cannot be accessed after they are transferred to the external environment, thereby avoiding the occurrence of leakage.

FIG. 3 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 3 , the electronic device may include: a processor (processor) 310, a communication interface (Communications Interface) 320, a memory (memory) 330 and a communication bus 340, The processor 310 , the communication interface 320 , and the memory 330 communicate with each other through the communication bus 340 . The processor 310 can call the logic instruction in the memory 330 to execute the file tracking method, the method includes: monitoring the file operation event; when detecting that the file operation event is triggered, acquiring and recording the corresponding file operation event. The circulation information of the target file; wherein, the circulation information is used to track the circulation of the target file.

In addition, the above-mentioned logic instructions in the memory 330 may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

On the other hand, the present application also provides a computer program product, the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, A computer can execute the file tracking method provided by the above methods, and the method includes: monitoring a file operation event; when detecting that the file operation event is triggered, acquiring and recording the flow of the target file corresponding to the file operation event information; wherein, the circulation information is used to track the circulation of the target file.

In yet another aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and the computer program is implemented when executed by a processor to execute the file tracking methods provided above, the method comprising: monitoring file operation events ; In the case of detecting that the file operation event is triggered, acquire and record the flow information of the target file corresponding to the file operation event; wherein, the flow information is used to track the flow of the target file.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the present application.

Claims (10)

1. A method for file tracking, comprising:

monitoring file operation events;

under the condition that the file operation event is detected to be triggered, acquiring and recording the circulation information of a target file corresponding to the file operation event;

wherein the circulation information is used for tracking the circulation of the target file.

2. The method of claim 1, wherein the circulation information comprises at least one of: the node information of the previous node, the node information of the current node, the file information of the target file and the trigger time of the file operation event.

3. The method of claim 1 or 2, wherein the monitoring file operation events comprises:

associating the file operation event with a Hook function, and constructing a callback function corresponding to the Hook function;

wherein the file operation event comprises at least one of: a file creating event, a file opening event, a file saving event and a file closing event; and the callback function is used for acquiring and recording the circulation information.

4. The method according to claim 3, wherein the obtaining and recording the circulation information of the target file corresponding to the file operation event when the file operation event is detected to be triggered comprises:

and under the condition that the file operation event is detected to be triggered, acquiring the circulation information through the callback function, storing the circulation information into the attribute information of the target file through a COM (component object model) component, and/or storing the circulation information into a server.

5. The method according to claim 4, wherein after the obtaining and recording the circulation information of the target file corresponding to the file operation event when the file operation event is detected to be triggered, the method further comprises:

extracting the circulation information corresponding to each node of the target file in the circulation process from the attribute information of the target file and/or the server;

and generating a circulation path according to circulation information corresponding to each node of the target file in the circulation process, and tracing the source of the target file based on the circulation path.

6. The method according to claim 2, wherein the obtaining and recording the circulation information of the target file corresponding to the file operation event when it is detected that the file operation event is triggered includes:

under the condition that the triggered file operation event is the file creation event, injecting a target script into a target file created by the file creation event;

the target script is used for running the target script when the target file is accessed, detecting the running environment of the current equipment, and forbidding the access of the target file under the condition that the running environment of the current equipment does not meet the preset condition.

7. An apparatus for file tracking, the apparatus comprising:

the monitoring module is used for monitoring file operation events;

the recording module is used for acquiring and recording the circulation information of the target file corresponding to the file operation event under the condition that the file operation event is detected to be triggered;

and the circulation information is used for tracking the circulation of the target file.

8. The apparatus of claim 7,

the monitoring module is specifically configured to associate the file operation event with a Hook function, and construct a callback function corresponding to the Hook function;

wherein the file operation event comprises at least one of: a file creating event, a file opening event, a file saving event and a file closing event; and the callback function is used for acquiring and recording the circulation information.

9. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of a file tracking method according to any one of claims 1 to 6.

10. A computer program product comprising computer program/instructions, characterized in that the computer program/instructions, when executed by a processor, implement the steps of the file tracking method of any of claims 1 to 6.

Images