WO2025066244A1 - Sandbox-based file operation processing method, apparatus, and electronic device - Google Patents

Abstract

Provided in the embodiments of the present application are a sandbox-based file operation processing method, an apparatus, and an electronic device. The sandbox-based operation processing method comprises: an electronic device, in response to an access request for a DLP file, creating a first sandbox clone of a first application, and opening the DLP file by means of the first sandbox clone, and then, in response to a first operation, acquiring a second sandbox clone for processing the first operation, and processing the first operation by means of the second sandbox clone, the first sandbox clone being associated with the DLP file, and management and control policies of the first sandbox clone and the second sandbox clone being the same as a management and control policy of the DLP file. Therefore, the security of the DLP file can be ensured; in addition, the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and the plurality of sandbox clones working cooperatively can reserve an operating environment and configuration information of the DLP file, so as to facilitate scenario reproduction when the DLP file is opened next time by a managed and controlled user, thus improving user experience.

Description

Sandbox-based file operation processing method, device and electronic device

This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 28, 2023, with application number 202311280981.5 and application name “Sandbox-based file operation processing method, device and electronic device”, the entire contents of which are incorporated by reference in this application.

Technical Field

The embodiments of the present application relate to the field of smart terminal technology, and in particular to a sandbox-based file operation processing method, device, and electronic device.

Background Art

In order to ensure data security, many companies deploy data loss prevention (DLP) services in their internal networks.

Before the file is transmitted, it can be encrypted locally by selecting a user list for authorization. During the processing, the file encryption and decryption control can also be carried out in combination with components such as file management, system capability management services, permission management services and/or user-mode file system (fuse).

DLP management applications implement sandbox-level control by creating sandbox clones of applications. Encrypted permission documents can only be viewed in the sandbox clones of legitimate users, and the transmission of encrypted permission documents is restricted due to permission control in the sandbox environment. This security-based design protects document data to the greatest extent.

Since the management and control is based on the sandbox mechanism, sandbox applications cannot pull up other external applications to share data according to the usage scenario. Therefore, the collaborative processing of the same business by multiple applications will be restricted, especially for read-only permission documents.

Summary of the invention

The present application provides a sandbox-based file operation processing method, device and electronic device. The present application also provides a computer-readable storage medium to realize the processing of operations on DLP files through associated sandbox clones. The management and control strategy of the associated sandbox clones is the same as the management and control strategy of the DLP files to ensure the security of the DLP files, and the associated sandbox clones can perform data communication and collaboratively process business, so as to restore the user's last usage scene and improve the user experience.

In a first aspect, the present application provides a sandbox-based file operation processing method, including: in response to an access request for a data leakage protection DLP file, creating a first sandbox clone of a first application, and opening the DLP file through the first sandbox clone; wherein the first sandbox clone is associated with the DLP file; in response to a first operation on the DLP file, obtaining a second sandbox clone for processing the first operation; wherein the second sandbox clone includes a sandbox clone of a second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file; and processing the first operation through the second sandbox clone.

In the above-mentioned sandbox-based operation processing method, the electronic device creates a first sandbox clone of the first application in response to an access request for the DLP file, opens the above-mentioned DLP file through the first sandbox clone, and then, in response to the first operation for the above-mentioned DLP file, obtains a second sandbox clone that processes the above-mentioned first operation, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone can be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the management and control policies of the first sandbox clone and the second sandbox clone are the same as the management and control policies of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones working together can retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time, thereby improving the user experience.

In one possible implementation, obtaining the second sandbox clone for processing the first operation includes: querying the sandbox clone associated with the first sandbox clone; in response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, creating the second sandbox clone, and associating the second sandbox clone with the first sandbox clone.

In one possible implementation, before obtaining the second sandbox clone that processes the first operation, it also includes: receiving a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file, the first operation processing request being used to request the second sandbox clone to process the first operation.

In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further includes: in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone, obtaining a second application that monitors the first operation; and notifying the second application of the first operation.

In one possible implementation, before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, it also includes: determining whether the second application is a trusted application; if the second application is a trusted application, executing the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone.

In a possible implementation, the determining whether the second application is a trusted application includes: determining whether the second application is in a data table; wherein the data table stores configured trusted applications.

In one possible implementation, the first sandbox clone and the second sandbox clone constitute a sandbox group; the method also includes: in response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, the second operation processing request is used to request a third application to process the second operation; creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; processing the second operation through the third sandbox clone.

In a possible implementation, after the second sandbox clone processes the first operation, the method further includes: detecting a write operation of the second sandbox clone on the DLP file; and in response to the write operation, the first sandbox clone reading the modified DLP file.

In one possible implementation, the first operation includes a selection operation of the first sandbox clone on the content of the DLP file, and the DLP file is a read-only file; and processing the first operation by the second sandbox clone includes: translating the selected content in the DLP file by the second sandbox clone.

In a second aspect, the present application provides a document operation processing device, which is included in an electronic device, and has the function of implementing the electronic device behavior in the first aspect and the possible implementation of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions. For example, a creation module, an opening module, an acquisition module, and a processing module.

In a third aspect, the present application provides an electronic device comprising: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, enable the electronic device to perform the method provided in the first aspect.

It should be understood that the second and third aspects of the present application are consistent with the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here.

In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the method provided in the first aspect.

In a fifth aspect, the present application provides a computer program, which, when executed by a computer, is used to execute the method provided in the first aspect.

In one possible design, the program in the fifth aspect may be stored in whole or in part on a storage medium packaged together with the processor, or may be stored in whole or in part on a memory not packaged together with the processor.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application;

FIG2 is a schematic diagram of an application scenario of a sandbox-based operation processing method provided by an embodiment of the present application;

FIG3 is a diagram of an implementation architecture of a sandbox-based operation processing method provided by an embodiment of the present application;

FIG4 is a flow chart of a sandbox-based operation processing method provided by an embodiment of the present application;

FIG5 is a schematic diagram of a file owner configuring a trusted application according to an embodiment of the present application;

FIG6 is a schematic diagram of a first sandbox clone actively requesting to associate with a second sandbox clone provided by an embodiment of the present application;

FIG7 is a schematic diagram of an external application passively associating with a first sandbox clone according to an embodiment of the present application;

FIG8 is a schematic diagram of the structure of an electronic device provided by another embodiment of the present application;

FIG9 is a schematic diagram of the structure of an electronic device provided in yet another embodiment of the present application.

DETAILED DESCRIPTION

The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

Currently, the management and control is based on the sandbox mechanism. Sandbox applications cannot pull up other external applications to share data according to the usage scenario. Therefore, the collaborative processing of the same business by multiple applications will be restricted, especially for read-only permission documents. In addition, the existing sandbox mechanism does not support multiple sandbox applications to automatically configure the same management policy, and cannot support multiple applications with the same policy to collaboratively process the same document; and in the existing related technologies, the DLP mechanism does not support the controlled sandbox application to pull up external applications, especially read-only control, and the operations of the applications in the sandbox cannot be perceived by external applications and cannot be collaboratively processed. For users, many common collaborative operation scenarios cannot be completed, and the user experience is poor.

Based on the above problems, an embodiment of the present application provides a sandbox-based operation processing method, in which operations on DLP files are processed through associated sandbox clones, and the associated sandbox clones are managed by the DLP management application. The control strategy of the associated sandbox clone is the same as the control strategy of the DLP file, and the associated sandbox clones can share data, such as encrypted files; and, in an embodiment of the present application, the associated sandbox clone provides a monitoring interface to the outside, and the events triggered by the associated sandbox clone can be monitored by external applications. The DLP management application can create a sandbox clone of the external application, and add the created sandbox clone of the external application to the associated sandbox clone, so as to collaboratively process operations on the DLP file.

The sandbox-based operation processing method provided in the embodiment of the present application can be applied to electronic devices, wherein the above-mentioned electronic devices can be smart phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR)/virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks or personal digital assistants (PDA) and other devices; the embodiment of the present application does not impose any restrictions on the specific types of electronic devices.

Exemplarily, FIG1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. As shown in FIG1 , the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

It is to be understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and/or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated in one or more processors.

The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

For ease of understanding, the following embodiments of the present application will take an electronic device having the structure shown in Figure 1 as an example, and combine the accompanying drawings and application scenarios to specifically explain the sandbox-based operation processing method provided in the embodiments of the present application.

FIG2 is a schematic diagram of an application scenario of a sandbox-based operation processing method provided by an embodiment of the present application. In the embodiment of the present application, the DLP management application processes operations on DLP files through associated sandbox clones. As shown in FIG2, in order to manage the above-mentioned associated sandbox clones, the DLP management application creates a sandbox group for the above-mentioned DLP files. The DLP management application manages the sandbox group corresponding to the DLP files. The DLP management application manages the life cycle of the sandbox group. The control policy of the sandbox group is the same as the control policy of the DLP files. Applications that are subsequently added to the sandbox group are uniformly configured by the DLP management application with the same control policy as the DLP files. In FIG2, application A is the first application to process DLP files. In specific implementation, the DLP management application creates a sandbox clone of application A, and processes the above-mentioned DLP files through the sandbox clone of application A. The sandbox clone of application A and the DLP files are controlled by the same policy. After the DLP management application creates a sandbox group corresponding to the DLP files, Add the sandbox clone of application A to the above sandbox group. If application A needs application B to jointly process a business, application A can send a request to the DLP management application, and the DLP management should query whether there is a sandbox clone of application B in the sandbox group. If there is a sandbox clone of application B in the sandbox group, the DLP management application will directly pull up the sandbox clone of application B, and the sandbox clone of application A and the sandbox clone of application B will share data and jointly process the business. If the sandbox clone of application A and the sandbox clone of application B need application C when working together, the sandbox clone of application A or the sandbox clone of application B can send a request, and the DLP management application will query whether the sandbox clone of application C is in the sandbox group. If not, the DLP management application will create a sandbox clone of application C and add the sandbox clone of application C to the sandbox group for data sharing and collaborative processing of business.

FIG3 is an implementation architecture diagram of a sandbox-based operation processing method provided by an embodiment of the present application. In FIG3, the owner user of the document interacts with the DLP management application, sets the control policy and generates the DLP file of the corresponding document. The DLP management application creates a sandbox group corresponding to the DLP file, and configures the control policy of the sandbox group to be the same as the control policy set by the owner user. When a controlled user accesses the above-mentioned DLP document, application A needs to be used to collaboratively process the access request of the above-mentioned controlled user. The DLP management application creates a sandbox clone of application A and adds the sandbox clone of application A to the sandbox group corresponding to the above-mentioned DLP file. Through the above process, the DLP management application can add multiple external applications to the sandbox group, and the sandbox group can form a small system. Multiple sandbox applications can work together to retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time.

The embodiment of the present application proposes a sandbox-based operation processing method, which processes operations on DLP files through associated sandbox clones, and the associated sandbox clones can share data and collaboratively process the same business. The DLP management application can associate the sandbox clones in two ways: active and passive, and provide a monitoring mechanism that allows external applications to monitor the operations of the associated sandbox clones, so that the DLP management application can associate the sandbox clones of the external applications that perform monitoring to collaboratively process operations on DLP files.

FIG4 is a flow chart of a sandbox-based operation processing method provided by an embodiment of the present application. The sandbox-based operation processing method provided by the present embodiment can be implemented by a DLP management application in the electronic device 100. As shown in FIG4 , the sandbox-based operation processing method may include:

Step 401: The electronic device 100 creates a first sandbox clone of a first application in response to an access request for a DLP file, and opens the DLP file through the first sandbox clone.

In some examples, the first sandbox clone is associated with the DLP file described above.

Step 402: In response to a first operation on the DLP file, the electronic device 100 obtains a second sandbox clone for processing the first operation.

In some examples, the second sandbox clone is a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policies of the above-mentioned DLP files. The control policies of DLP files may include: document access rights, document outbound rights, document automatic backup rights and/or document copy rights, etc. In this embodiment, the first sandbox clone is associated with the DLP file, and the second sandbox clone is associated with the first sandbox clone. In this way, the DLP file, the first sandbox clone and the second sandbox clone can form a small system. Multiple sandbox clones can work together to retain the operating environment and configuration information of the DLP file, which is convenient for the controlled user to reproduce the scene after opening the DLP file next time.

In some examples, the first operation for the above-mentioned DLP file may include: selecting the content of the DLP file and requesting translation, or selecting the content of the DLP file and searching, etc., which is not limited in this embodiment. For example, after the electronic device 100 receives the access request for the DLP file from the controlled user, it creates a first sandbox clone of the first application and opens the above-mentioned DLP file through the first sandbox clone. During the process of the controlled user browsing the DLP file, there is a need to translate part of the content of the DLP file. Then, the controlled user can select the content to be translated in the DLP file and request translation of the selected content. Then, the operation of the controlled user selecting the content to be translated and requesting translation is the operation for the above-mentioned DLP file. Then, in response to this operation of the controlled user on the above-mentioned DLP file, the DLP management application obtains from the sandbox clone associated with the first sandbox clone, and a second sandbox clone that can execute translation of the selected content.

2, in order to manage the sandbox clones associated with the first sandbox clone, the DLP management application in the electronic device 100 can create a sandbox group corresponding to the DLP file after creating the first sandbox clone of the first application, and add the first sandbox clone to the sandbox group. Then, in response to the first operation on the DLP file, the DLP management application obtains the second sandbox clone that processes the first operation from the sandbox group.

In some examples, the electronic device 100 obtains the second sandbox clone that processes the above operations as follows: the electronic device 100 queries the sandbox clone associated with the first sandbox clone, and in response to the fact that the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application in the electronic device 100 creates the above-mentioned second sandbox clone and associates the second sandbox clone with the first sandbox clone.

Step 403: The electronic device 100 processes the first operation through the second sandbox clone.

In some examples, after the electronic device 100 processes the first operation through the second sandbox clone, the electronic device 100 detects the write operation of the second sandbox clone on the DLP file, and in response to the write operation, the first sandbox clone can read the modified DLP file.

In some examples, the first sandbox clone and the second sandbox clone may constitute a sandbox group; thus, in response to a second operation on the DLP file, the electronic device 100 may receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone, and the second operation processing request is used to request a third application to process the second operation; then, the electronic device 100 creates a third sandbox clone of the third application, adds the third sandbox clone to the sandbox group, and processes the second operation through the third sandbox clone.

In some examples, referring to FIG. 5, before the electronic device 100 creates the second sandbox clone and associates the second sandbox clone with the first sandbox clone, the electronic device 100 may also first determine whether the second application is a trusted application. If the second application is a trusted application, the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone are performed. Specifically, the electronic device 100 may determine whether the second application is a trusted application in the following manner: determine whether the second application is in a data table; wherein the configured trusted application is saved in the data table. The trusted application may be configured by the DLP file owner, as shown in FIG. 5, which is a schematic diagram of a file owner configuring a trusted application provided by an embodiment of the present application. Specifically, the file owner may configure the trusted application in the following manner: save the name or package name of the trusted application in a data table, so that the electronic device 100 may determine whether the name or package name of the second application is in the configured data table. If so, the electronic device 100 may determine that the second application is a trusted application. If the name or package name of the second application is not in the configured data table, the electronic device 100 may determine that the second application is not a trusted application. In addition, the file owner may also configure indication information of whether the application is a trusted application in the configuration file of the application installation package, so that the electronic device 100 may determine whether the second application is a trusted application based on the above indication information in the configuration file of the second application installation package.

In addition, whether the second application is a trusted application can also be determined by application market review. If the second application passes the review of the application market, the electronic device 100 can determine that the second application is a trusted application; if the second application fails the review of the application market, the electronic device 100 can determine that the second application is not a trusted application.

In this embodiment, the manner of associating the sandbox clones may include active and passive methods, and the two joining methods are described below respectively.

In one implementation, before obtaining the second sandbox clone that processes the first operation, the electronic device 100 receives a first operation processing request initiated by the first sandbox clone in response to the first operation on the DLP file, and the first operation processing request is used to request the second sandbox clone to process the first operation. In other words, the active method is that the first sandbox clone actively requests the DLP management application to create a second sandbox clone of the second application and associate the second sandbox clone with the first sandbox clone.

FIG6 is a schematic diagram of a first sandbox clone actively requesting to associate with a second sandbox clone provided by an embodiment of the present application. As shown in FIG6 , the first sandbox clone actively requests the DLP management application in the electronic device 100 to pull up the second application. The DLP management application first queries whether the sandbox clone of the second application (i.e., the second sandbox clone) is in the sandbox clone associated with the first sandbox clone. If the second sandbox clone exists in the sandbox clone associated with the first sandbox clone, the DLP management application directly pulls up the second sandbox clone and notifies the first sandbox clone that the second sandbox clone is successfully pulled up. If the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the DLP management application creates a second sandbox clone, associates the second sandbox clone with the first sandbox clone, pulls up the second sandbox clone, and notifies the first sandbox clone that the second sandbox clone is successfully pulled up.

One application scenario of this implementation method is: when a document visitor with read-only permission uses the sandbox clone of word (the first sandbox clone) to read a DLP document, the translation software needs to be translated collaboratively. The document visitor can actively initiate a translation request, and the sandbox clone of word is used as the request initiator to request the DLP management application to pull up the translation software for collaborative work. The DLP management application queries whether there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of word. If not, the DLP management application creates a sandbox clone of the translation software and associates the sandbox clone of the translation software with the sandbox clone of word, and then translates the above DLP document through the sandbox clone of the translation software; if there is a sandbox clone of the translation software in the sandbox clone associated with the sandbox clone of word, the DLP management application directly pulls up the sandbox clone of the translation software without repeatedly creating the sandbox clone, and then translates the above DLP document through the sandbox clone of the translation software. The control policy of the associated sandbox clone is the same as the control policy of the DLP file.

This implementation solves the problem that document visitors with read-only permissions cannot launch external applications for collaborative work, and ensures the security of data communication. Based on the existing DLP protection mechanism, it enables visitors to launch external applications in reasonable scenarios, greatly improving the visitor's user experience, and the associated sandbox clones are controlled by the same management policy, ensuring data security.

In another implementation, before creating a second sandbox clone and associating the second sandbox clone with the first sandbox clone, if the second sandbox clone does not exist in the sandbox clone associated with the first sandbox clone, the electronic device 100 can obtain a second application that monitors the above operation and associate the second sandbox clone with the first sandbox clone. That is, the passive joining method is to allow the external application to passively join the sandbox clone associated with the first sandbox clone through the monitoring mechanism.

Figure 7 is a schematic diagram of an external application passively associating a first sandbox clone provided by an embodiment of the present application. As shown in Figure 7, when the first sandbox clone triggers operation A for a DLP file, and the external second application is monitoring operation A through a monitoring mechanism, the DLP management application can notify the external second application that a usage scenario in the sandbox has triggered operation A, and the DLP management application can create a second sandbox clone for the external second application, and associate the second sandbox clone with the first sandbox clone, and then the second sandbox clone works collaboratively with the first sandbox clone.

For example, after the electronic device 100 receives an access request for a DLP file from a user with read-only access, it creates a first sandbox clone of the first application and opens the DLP file through the first sandbox clone. Obviously, for the user with read-only access, the DLP file is a read-only file. Assume that the DLP file is an English document, and the specific content may be as follows: "Some people, no matter how old they are, are always young; Some people, regardless of whether it is honor or disgrace, are calm and calm;..." The user with read-only access has a need to translate part of the content in the English document. The user with read-only access can select the content to be translated with the mouse. Here, it is assumed that "Some people, regardless of "ess of whether it is honor or disgrace, are calm and calm;" is the part selected by the read-only access user with the mouse. The read-only access user requires the translation software to translate the selected sentence. Then the operation of "selecting" this sentence by the read-only access user with the mouse can be used as a trigger operation for the external translation software to monitor. After the external translation software monitors the above selection operation through the monitoring mechanism, the DLP management application creates a sandbox clone of the translation software, associates the sandbox clone of the translation software with the first sandbox clone, and then translates the selected content in the above DLP file through the sandbox clone of the translation software.

This implementation can solve the problem that external applications cannot perceive the operations of applications in the sandbox. Through the monitoring mechanism, a sandbox clone of the external application can be created, and the sandbox clone of the external application can be associated with the sandbox clone of the application that opens the DLP file. The two work together to improve the user experience.

In the above-mentioned sandbox-based operation processing method, the electronic device 100 creates a first sandbox clone of the first application in response to an access request for the DLP file, and opens the above-mentioned DLP file through the first sandbox clone. Then, the electronic device 100 obtains a second sandbox clone that processes the above-mentioned first operation in response to the first operation for the above-mentioned DLP file, and processes the above-mentioned first operation through the second sandbox clone; wherein, the second sandbox clone may be a sandbox clone of the second application, the first sandbox clone is associated with the DLP file, and the management and control policies of the first sandbox clone and the second sandbox clone are the same as the management and control policies of the DLP file, thereby ensuring the security of the DLP file, and the DLP file, the first sandbox clone and the second sandbox clone can form a small system, and multiple sandbox clones can work together to retain the operating environment and configuration information of the DLP file, so as to facilitate the reproduction of the scene after the controlled user opens the DLP file next time, thereby improving the user experience.

It is to be understood that some or all of the steps or operations in the above embodiments are merely examples, and the present application embodiments may also perform other operations or variations of various operations. In addition, the various steps may be performed in different orders presented in the above embodiments, and it is possible that not all of the operations in the above embodiments need to be performed.

It is understandable that, in order to realize the above functions, the electronic device includes hardware and/or software modules corresponding to the execution of each function. In combination with the algorithm steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to exceed the scope of this application.

This embodiment can divide the electronic device into functional modules according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

FIG8 is a schematic diagram of the structure of an electronic device provided by another embodiment of the present application. In the case of dividing each functional module according to each function, FIG8 shows a possible schematic diagram of the composition of the electronic device 800 involved in the above embodiment. As shown in FIG8 , the electronic device 800 may include: a creation module 801, an opening module 802, an acquisition module 803 and a processing module 804;

The creation module 801 is used to create a first sandbox clone of the first application in response to an access request for the DLP file; wherein the first sandbox clone is associated with the DLP file;

An opening module 802 is used to open the DLP file through the first sandbox clone;

An acquisition module 803 is used to acquire, in response to the first operation on the DLP file, a second sandbox clone for processing the first operation; wherein the second sandbox clone includes a sandbox clone of the second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file;

The processing module 804 is used to process the above-mentioned first operation through the second sandbox clone.

It should be noted that all relevant contents of each step involved in the method embodiment shown in FIG. 4 of the present application can be referred to the functional description of the corresponding functional module and will not be repeated here.

The electronic device 800 provided in this embodiment is used to execute the sandbox-based operation processing method provided in the embodiment shown in FIG. 4 of the present application, and thus can achieve the same effect as the above method.

FIG9 is a schematic diagram of the structure of an electronic device provided in another embodiment of the present application. Compared with the electronic device shown in FIG8 , the difference is that the electronic device 900 shown in FIG9 may further include: a query module 805 and an association module 806;

The query module 805 is used to query the sandbox clones associated with the first sandbox clone;

The creation module 801 is further configured to create a second sandbox clone in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone;

The association module 806 is used to associate the second sandbox clone with the first sandbox clone.

In some examples, the electronic device 800 may further include: a receiving module 807;

The receiving module 807 is used to receive a first operation processing request initiated by the first sandbox clone in response to the first operation on the above-mentioned DLP file before the acquisition module 803 acquires the second sandbox clone that processes the above-mentioned first operation, and the above-mentioned first operation processing request is used to request the second sandbox clone to process the above-mentioned first operation.

In some examples, the electronic device 800 may further include: a notification module 808;

The acquisition module 803 is further configured to acquire a second application that monitors the first operation in response to the second sandbox clone not existing in the sandbox clones associated with the first sandbox clone before the association module 806 associates the second sandbox clone with the first sandbox clone.

The notification module 808 is used to notify the second application of the first operation.

In some examples, the electronic device 800 may further include: a determination module 809;

The judgment module 809 is used to judge whether the second application is a trusted application before the association module 806 associates the second sandbox clone with the first sandbox clone; if the second application is a trusted application, the creation module 801 and the association module 806 execute the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone. In this embodiment, the judgment module 809 is specifically used to judge whether the second application is in the data table; wherein the above data table stores the configured trusted applications.

In this embodiment, the first sandbox clone and the second sandbox clone constitute a sandbox group; the receiving module 807 is further used to receive a second operation processing request initiated by the first sandbox clone or the second sandbox clone in response to the second operation on the DLP file, wherein the second operation processing request is used to request the third application to process the second operation;

The creation module 801 is further used to create a third sandbox clone of the third application and add the third sandbox clone to the above sandbox group;

The processing module 804 is further configured to process the second operation through the third sandbox clone.

In some examples, the first operation may include a selection operation of the first sandbox clone on the content of the DLP file, where the DLP file is a read-only file; thus, the processing module 804 is specifically used to translate the selected content in the DLP file through the second sandbox clone.

It should be noted that all relevant contents of each step involved in the method embodiments shown in Figures 4 to 7 of the present application can be referred to the functional description of the corresponding functional modules and will not be repeated here.

The electronic device 800 provided in this embodiment is used to execute the sandbox-based operation processing method provided in the embodiments shown in Figures 4 to 7 of the present application, and thus can achieve the same effect as the above method.

It should be understood that the electronic device 800 may correspond to the electronic device 100 shown in Figure 1. Among them, the functions of the opening module 802, the acquisition module 803, the processing module 804, the association module 805, the receiving module 806, the acquisition module 807, the notification module 808 and the judgment module 809 may be implemented by the processor 110 in the electronic device 100 shown in Figure 1.

In the case of adopting an integrated unit, the electronic device 800 may include a processing module, a storage module, and a communication module.

The processing module can be used to control and manage the actions of the electronic device 800, for example, it can be used to support the electronic device 800 to execute the steps executed by the above modules. The storage module can be used to support the electronic device 800 to store program codes and data, etc. The communication module can be used to support the communication between the electronic device 800 and other devices.

The processing module may be a processor or a controller, which may implement or execute various examples described in conjunction with the contents disclosed in this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory. The communication module may specifically be a device that interacts with other electronic devices, such as a radio frequency circuit, a Bluetooth chip and/or a Wi-Fi chip.

In one embodiment, when the processing module is a processor and the storage module is a memory, the electronic device 800 involved in this embodiment may be a device having the structure shown in FIG. 1 .

The embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the method provided in the embodiments shown in Figures 4 to 7 of the present application.

The embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is run on a computer, it enables the computer to execute the method provided by the embodiments shown in Figures 4 to 7 of the present application.

In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character "/" generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

In several embodiments provided in the present application, any function can be stored in a computer-readable storage medium if it is implemented in the form of a software functional unit and sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

The above is only a specific implementation of the present application. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. The protection scope of the present application should be based on the protection scope of the claims.

Claims (11)

A sandbox-based file operation processing method, characterized by comprising: In response to an access request for a data leakage prevention (DLP) file, create a first sandbox clone of a first application, and open the DLP file through the first sandbox clone; wherein the first sandbox clone is associated with the DLP file; In response to a first operation on the DLP file, obtaining a second sandbox clone that processes the first operation; wherein the second sandbox clone includes a sandbox clone of a second application, and the control policies of the first sandbox clone and the second sandbox clone are the same as the control policy of the DLP file; The first operation is processed by the second sandbox clone. The method according to claim 1, wherein obtaining a second sandbox clone for processing the first operation comprises: Querying the sandbox clone associated with the first sandbox clone; In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, the second sandbox clone is created and associated with the first sandbox clone. The method according to claim 1, characterized in that before obtaining the second sandbox clone for processing the first operation, it also includes: In response to a first operation on the DLP file, a first operation processing request initiated by the first sandbox clone is received, where the first operation processing request is used to request a second sandbox clone to process the first operation. The method according to claim 2, characterized in that before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further comprises: In response to the second sandbox clone not existing in the sandbox clone associated with the first sandbox clone, obtaining a second application that monitors the first operation; The second application is notified of the first operation. The method according to any one of claims 2 to 4, characterized in that before creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone, the method further comprises: Determining whether the second application is a trusted application; If the second application is a trusted application, the steps of creating the second sandbox clone and associating the second sandbox clone with the first sandbox clone are performed. The method according to claim 5, characterized in that the determining whether the second application is a trusted application comprises: Determine whether the second application is in a data table; wherein the data table stores configured trusted applications. The method according to claim 1, characterized in that the first sandbox clone and the second sandbox clone constitute a sandbox group; the method further comprises: In response to a second operation on the DLP file, receiving a second operation processing request initiated by the first sandbox clone or the second sandbox clone, where the second operation processing request is used to request a third application to process the second operation; Creating a third sandbox clone of the third application, and adding the third sandbox clone to the sandbox group; The second operation is processed by the third sandbox clone. The method according to claim 1, characterized in that after the second sandbox clone processes the first operation, it also includes: Detecting a write operation of the second sandbox clone on the DLP file; In response to the write operation, the first sandbox clone reads the modified DLP file. The method according to claim 1, wherein the first operation comprises a selection operation of the first sandbox clone on the content of the DLP file, and the DLP file is a read-only file; Processing the first operation by the second sandbox clone includes: The selected content in the DLP file is translated by the second sandbox clone. An electronic device, comprising: One or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 9. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 9.