CN112269986A - Process management method, device and storage medium - Google Patents

Abstract

The present application discloses a process management method, device and storage medium. Wherein, the method includes: monitoring a process of a terminal; when a first process is monitored, determining a first desktop corresponding to the first process among multiple desktops included in the terminal according to a desktop identifier carried by the first process; The system operation authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox; using the corresponding relationship between the desktop and the process processing strategy, determining a first policy corresponding to the first desktop; and allowing or prohibiting the terminal to perform an operation corresponding to the first process according to the first policy.

Description

Process management method, device and storage medium

technical field

The present application relates to the field of information security, and in particular, to a process management method, device and storage medium.

Background technique

With the development of technology, more and more mobile office (BYOD, Bring Your Own Device or Become Your Office Device) scenarios appear in people's work, and the proportion of corresponding BYOD devices continues to rise.

However, due to factors such as cost, network, and user privacy protection, the data protection (that is, data leakage prevention) solutions in related technologies can only cover a part of the enterprise's personal computer (PC, Personal Computer) users, and cannot be used in BYOD scenarios and small and micro branches. Office scenarios (such as file transfer with the staff of the R&D department and the staff of the sales department in the company) are used for data protection.

SUMMARY OF THE INVENTION

In order to solve related technical problems, embodiments of the present application provide a process management method, device, and storage medium.

The technical solutions of the embodiments of the present application are implemented as follows:

The embodiment of the present application provides a process management method, including:

Monitoring the process of the terminal; when monitoring the first process, according to the desktop identifier carried by the first process, determine the first desktop corresponding to the first process in the multiple desktops included in the terminal; The system operating authority corresponding to each desktop in the multiple desktops is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox;

The first policy corresponding to the first desktop is determined by using the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to perform the operation corresponding to the first process.

In the above scheme, the method also includes:

The correspondence between the desktops and the process processing policy and the first policy are acquired from the shared memory of the multiple desktops.

In the above solution, the multiple desktops included in the terminal include a first-type desktop and a second-type desktop; the system operation authority corresponding to the first-type desktop is lower than the system operation authority corresponding to the second-type desktop;

The allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy includes:

In the case that the operation corresponding to the first process includes the operation of the second type of desktop on the file in the file directory corresponding to the first type of desktop, allowing the terminal to perform the operation corresponding to the first process;

In the case that the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; in,

The files in the file directory corresponding to each desktop in the plurality of desktops are isolated based on the sandbox.

In the above solution, the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; allowing the terminal to execute the operation corresponding to the first process. In operation, the method further includes:

In the case that a redirection file corresponding to the first file exists in the file directory corresponding to the second type of desktop, controlling the terminal to perform an operation corresponding to the first process with respect to the redirection file;

In the case where the redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, the redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop file, and control the terminal to perform an operation corresponding to the first process with respect to the redirected file.

In the above scheme, the method also includes:

When the terminal is controlled to perform an operation corresponding to the first process on the redirection file, the redirection file is encrypted.

In the above solution, according to the first policy, allowing or prohibiting the terminal from executing the operation corresponding to the first process includes:

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the second type by the desktop of the first type, prohibiting the terminal from executing the operation corresponding to the first process ;

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the first type by the desktop of the second type, the terminal is allowed to perform the operation corresponding to the first process ;in,

The clipboards of each desktop in the plurality of desktops are isolated based on the sandbox.

In the above solution, according to the first policy, allowing or prohibiting the terminal from executing the operation corresponding to the first process includes:

In the case that it is determined according to the first policy that the first desktop has the authority to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

In the case that it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibit the terminal from executing the operation corresponding to the first process; wherein,

The system service interface and network connection function corresponding to each desktop in the plurality of desktops are isolated based on the sandbox;

The operation corresponding to the first process includes one of the following:

access the first local area network;

Access the second local area network;

Call the system service interface.

In the above solution, the operation corresponding to the first process includes a screenshot operation;

The allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy includes:

Allowing the terminal to perform an operation corresponding to the first process when the first desktop has the right to take screenshots;

In the case that the first desktop does not have the right to take screenshots, the terminal is prohibited from executing the operation corresponding to the first process; or, a screenshot image including traceable watermark information is generated.

The embodiment of the present application also provides a process management device, including:

a monitoring unit, configured to monitor the process of the terminal; when the first process is monitored, according to the desktop identifier carried by the first process, determine the first desktop corresponding to the first process in the multiple desktops included in the terminal; The system operating authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox;

a processing unit, configured to use the correspondence between the desktop and the process processing strategy to determine the first strategy corresponding to the first desktop; and according to the first strategy, allow or prohibit the terminal from executing the corresponding first process operation.

Embodiments of the present application also provide a process management apparatus, including: a processor and a memory for storing a computer program that can be run on the processor;

Wherein, when the processor is configured to execute the steps of any of the above methods when running the computer program.

Embodiments of the present application further provide a storage medium, where the medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the foregoing methods are implemented.

The process management method, device, and storage medium provided by the embodiments of the present application monitor the process of the terminal; when the first process is monitored, according to the desktop identifier carried by the first process, it is determined that the first process is included in the terminal. The first desktop corresponding to the multiple desktops; the system operation authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the processes corresponding to the desktops in the multiple desktops are isolated based on the sandbox; using the desktop The first policy corresponding to the first desktop is determined according to the corresponding relationship with the process processing policy; and according to the first policy, the terminal is allowed or prohibited to perform the operation corresponding to the first process. The solution of the embodiment of the present application isolates the processes corresponding to multiple desktops with different permissions contained in the user terminal based on the sandbox. Or prohibit the terminal from executing the operation corresponding to the corresponding process. In this way, when the user implements BYOD scenarios and small and micro branch office scenarios based on the multi-desktop form of the terminal, office data leakage can be avoided, the security of office data can be improved, and the user experience can be improved.

Description of drawings

1 is a schematic flowchart of a process management method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of an application scenario of an embodiment of the present application;

3 is a schematic structural diagram of a process management apparatus according to an application embodiment of the present application;

4 is a schematic structural diagram of a process management apparatus according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a hardware structure of a process management apparatus according to an embodiment of the present application.

Detailed ways

The technical solutions of the present application will be described in further detail below with reference to the accompanying drawings and embodiments.

In the related art, an enterprise's office data protection (ie, office data leakage prevention) solution can be divided into a hardware-based solution and a software-based solution. Among them, the deployment cost of hardware solutions is usually high. It may be necessary to configure an external device for office data protection for each PC user in the enterprise. This device usually has high requirements on the network and cannot support ultra-low bandwidth. Office and offline work. Software solutions usually include functions such as screen recording, remote control, and behavior auditing, which infringe on the privacy of PC users in the enterprise, and are difficult to promote in BYOD scenarios and small and micro branch office scenarios. At the same time, when some hardware solutions and software solutions are applied to scenarios with low bandwidth and no administrators, such as small and micro branch office scenarios, there may be complex O&M and compatibility issues. It can be seen that the office data protection solutions in the related technologies have the problems of high deployment cost, complicated deployment methods and operation and maintenance, and poor user experience.

In addition, when designing office data protection solutions in BYOD scenarios and small and micro branch office scenarios, users' concerns about office data security in BYOD scenarios and small and micro branch office scenarios need to be considered. The use of virtual private network (VPN, Virtual Private Network) may lead to concerns about intranet virus infection. Therefore, it is necessary to consider the user's needs for the security control of office data flow, such as the need for security control of office data flow after using VPN. . At the same time, users' concerns about the security of the operating system also need to be taken into account.

Based on this, in various embodiments of the present application, processes corresponding to multiple desktops with different permissions included in the user terminal are isolated based on the sandbox, and when the process of the terminal is monitored, the process processing policy corresponding to the corresponding desktop is determined, And based on the determined policy, the terminal is allowed or prohibited to perform the operation corresponding to the corresponding process. In this way, when the user implements the BYOD scenario and the small and micro branch office scenario based on the multi-desktop form of the terminal, it can avoid the leakage of office data and improve the security of office data. In order to improve the user experience.

At the same time, since the various embodiments of the present application are implemented based on the multi-desktop form of the terminal itself, there is no need to protect office data through external devices, thus greatly reducing the deployment cost, the difficulty of the deployment method and the subsequent operation. dimension difficulty.

In addition, since various embodiments of the present application are implemented based on the multi-desktop form of the terminal itself, users can directly implement BYOD scenarios and/or small and micro branch office scenarios and other application scenarios (such as user's personal application scenarios) through desktop switching. The switching of , the operation is simple and convenient, therefore, the user experience is further improved.

An embodiment of the present application provides a process management method, as shown in FIG. 1 , the method includes the following steps:

Step 101: monitor the process of the terminal; when the first process is monitored, according to the desktop identifier carried by the first process, determine the first desktop corresponding to the first process among the multiple desktops included in the terminal;

Here, the system operation authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox;

Step 102: Determine the first policy corresponding to the first desktop by using the correspondence between the desktop and the process processing policy; and allow or prohibit the terminal from executing the operation corresponding to the first process according to the first policy .

Here, it should be noted that the terminal may be any electronic device having a multi-desktop form, such as a PC, a mobile phone, etc.; the PC may include a desktop computer, a notebook computer, a tablet computer, and the like. Each desktop in the plurality of desktops corresponds to a virtual workspace, and the workspace corresponding to each desktop in the plurality of desktops is isolated based on the sandbox; in addition, the plurality of desktops use the same physical disk, and the disk The use area of each desktop is not divided on the above, and the screen displayed by the terminal when the user operates on the corresponding desktop is the work space corresponding to the corresponding desktop.

Specifically, in practical application, the processes corresponding to each desktop in the multiple desktops can be isolated by using a sandbox implemented based on Unified Endpoint Management (UEM, Unified Endpoint Management), so that each desktop can correspond to a virtual workspace .

In practical application, the method of monitoring the process of the terminal may be set according to the operating system of the terminal and user requirements. Exemplarily, when the operating system of the terminal is a Microsoft Windows (Microsoft Windows) operating system, the process of the terminal may be monitored by means of a process callback.

In practical application, the terminal may be provided with the shared memory of the multiple desktops, and after the first desktop is determined, the corresponding relationship between the desktop and the process processing strategy may be obtained from the shared memory, such as Obtain a first configuration file, where the first configuration file includes the correspondence between the desktop and the process processing policy; and, after determining the first policy, obtain the first policy from the shared memory , such as acquiring a second configuration file, where the second configuration file contains the first policy.

Based on this, in an embodiment, the method may further include:

The correspondence between the desktops and the process processing policy and the first policy are acquired from the shared memory of the multiple desktops.

In practical application, the user can set the system operation authority corresponding to each desktop in the multiple desktops included in the terminal according to the requirements. Exemplarily, as shown in FIG. 2 , the user can set three desktops in the terminal 200: desktop A, Desktop B and Desktop C, where Desktop A can have the right to log in to the internal network of the first enterprise, but does not have the right to browse ordinary web pages; Desktop B can have the right to browse ordinary webpages, but does not have the right to log in to the internal network of the first enterprise Network permissions; Desktop C can have video and audio playback permissions, but does not have the permissions to log in to the first enterprise's intranet and browse ordinary web pages. The process processing policy corresponding to the corresponding desktop reflects the system operation authority corresponding to the corresponding desktop. Exemplarily, the desktop B does not have the right to log in to the intranet of the first enterprise, and the process processing policy corresponding to the desktop B may include: When the process includes an operation of accessing the intranet of the first enterprise, the terminal is prohibited from executing the operation corresponding to the monitored process, that is, the user is prohibited from accessing the intranet of the first enterprise through desktop B. Here, the task bar 201 of each desktop in the plurality of desktops may include a desktop switching button 202, and the user can switch the desktop through the desktop switching button 202, such as switching from desktop A to desktop C, and switching from desktop C to desktop B switching, etc.

In practical application, in order to further ensure the security of office data, the user can classify the system operation authority corresponding to each desktop in the multiple desktops included in the terminal as required, so that the user cannot pass the desktop with a lower level of system operation authority. Open or edit files in the file directory corresponding to the desktop with a higher level of system operating authority. Exemplarily, the user can set the above-mentioned desktop A and desktop D as office desktops, and desktop D has the right to log in to the intranet of the second enterprise, but does not have the right to browse ordinary web pages, and the system corresponding to desktop A and desktop D is set. The operation authority is set to the first level; at the same time, the above desktop B, the above desktop C and desktop E are set as personal desktops. Desktop E has the authority to browse ordinary web pages, but does not have the authority to log in to the intranet of the second enterprise. B. The system operation permissions corresponding to desktop C and desktop E are set to the second level. Here, the workspaces corresponding to desktop B, desktop C, and desktop E can be collectively referred to as personal domains, and the workspaces corresponding to desktop A and desktop D can be collectively referred to as security domains. The usage methods (such as file storage methods) of personal domains and security domains are completely The same (that is, the original file storage method of the terminal itself), the user cannot perceive the difference between using the personal domain and using the security domain, and does not need to change their own usage habits; both the personal domain and the security domain can directly access the terminal's disk files, and can Isolation is implemented based on file redirection, but the files before and after redirection are stored on the same disk (that is, the disk currently set by the terminal). Through the process processing policy corresponding to the corresponding desktop, the user cannot pass the desktop B, desktop C and desktop E. Open or edit the files in the file directories corresponding to desktop A and desktop D, that is, the personal domain cannot access and use the files of the security domain, but the security domain can access and use the files of the personal domain, and the user does not need to copy the files, and the operation is simple convenient. In this way, the isolation of the files in the file directory corresponding to each desktop among the multiple desktops included in the terminal is realized, and the security of the office data is further guaranteed.

Based on this, in an embodiment, the multiple desktops included in the terminal may include a first-type desktop and a second-type desktop; the system operating authority corresponding to the first-type desktop is lower than that corresponding to the second-type desktop System operation authority; the allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy may include:

In the case that the operation corresponding to the first process includes the operation of the second type of desktop on the file in the file directory corresponding to the first type of desktop, allowing the terminal to perform the operation corresponding to the first process;

In the case that the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; in,

The files in the file directory corresponding to each desktop in the plurality of desktops are isolated based on the sandbox.

Specifically, in practical application, each desktop of the multiple desktops included in the terminal may correspond to a different file directory, and the user cannot view or edit the file directory corresponding to the second type of desktop through the first type of desktop. However, the user can view or edit the files in the file directory corresponding to the desktop of the first type through the desktop of the second type. Here, when the user views or edits the files in the file directory corresponding to the first type of desktop through the second type of desktop, in order to enable the user to use the second type of desktop to view or edit the file directory corresponding to the first type of desktop The editing of the file below is invisible to the desktop of the first type, and the file under the file directory corresponding to the desktop of the first type that the user is viewing and/or edited can be redirected to the file directory corresponding to the desktop of the second type, In this way, the security of office data can be further guaranteed.

Based on this, in an embodiment, in the case that the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; When the terminal performs the operation corresponding to the first process, the method may further include:

In the case that a redirection file corresponding to the first file exists in the file directory corresponding to the second type of desktop, controlling the terminal to perform an operation corresponding to the first process with respect to the redirection file;

In the case where the redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, the redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop file, and control the terminal to perform an operation corresponding to the first process with respect to the redirected file.

In practical application, in order to further ensure the security of office data, when the terminal is controlled to perform the operation corresponding to the first process on the redirected file, the redirected file may be encrypted. If the terminal is lost, the redirection file will not be leaked, which further ensures the security of office data.

Based on this, in an embodiment, the method may further include:

When the terminal is controlled to perform an operation corresponding to the first process on the redirection file, the redirection file is encrypted.

Specifically, in practical application, after controlling the terminal to perform the operation corresponding to the first process on the redirected file, encrypt the redirected file before writing the redirected file to the disk, and control the terminal The redirected file is decrypted when the redirected file is read from the disk before the operation corresponding to the first process is performed on the redirected file.

In practical application, the file redirection and the encryption and decryption of the redirected file can be realized by using the Minifilter technology.

In practical application, for each desktop in the multiple desktops included in the terminal, a large file can be allocated for the corresponding desktop in advance as the file storage space of the workspace corresponding to the corresponding desktop, that is, the virtual storage space of the workspace corresponding to the corresponding desktop. Disk, the files generated by the workspace corresponding to the corresponding desktop are stored in the corresponding virtual disk, and the entire virtual disk is encrypted, and there is no need to encrypt a single file. One large file is sufficient, which improves the convenience of data migration.

In practical application, the registry corresponding to each desktop in the desktop can also be isolated in the same manner as the file isolation, that is, the registry under the registry directory corresponding to each desktop in the multiple desktops is performed based on the sandbox. isolation. The allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy may include: the operation corresponding to the first process includes that the desktop of the second type is directed to the first type of desktop. In the case of the operation of the registry under the registry directory corresponding to the desktop, the terminal is allowed to perform the operation corresponding to the first process; in the case of the operation corresponding to the first process, the operation of the first type of desktop includes the In the case of the operation of the registry under the registry directory corresponding to the desktop of the second type, the terminal is prohibited from executing the operation corresponding to the first process.

At the same time, when the operation corresponding to the first process includes the operation of the second type of desktop with respect to the first registry under the registry directory corresponding to the first type of desktop; the terminal is allowed to execute the first registry. During an operation corresponding to a process, the method may further include: in the case that a redirection registry corresponding to the first registry exists in the registry directory corresponding to the second type of desktop, controlling the terminal to target the The redirection registry executes the operation corresponding to the first process; in the case that the redirection registry corresponding to the first file does not exist in the registry directory corresponding to the second type of desktop, in the second A redirection registry corresponding to the first registry is generated under the registry directory corresponding to the desktop-like, and the terminal is controlled to perform an operation corresponding to the first process with respect to the redirection registry.

In practical application, in order to further ensure the security of office data, it is necessary to prevent the user from pasting the content (text or picture) copied from the second type of desktop to the first type of desktop.

Based on this, in an embodiment, the allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy may include:

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the second type by the desktop of the first type, prohibiting the terminal from executing the operation corresponding to the first process ;

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the first type by the desktop of the second type, the terminal is allowed to perform the operation corresponding to the first process ;in,

The clipboards of each desktop in the plurality of desktops are isolated based on the sandbox.

In practical application, in order to further ensure the security of office data, the first policy may include the permission of the first desktop to access the network, the permission to access the network, and the permission to call the system service interface, etc.; in this way, users can be prevented from using When the desktop is used for office, office data is leaked through interfaces such as network or printer.

Based on this, in an embodiment, the allowing or prohibiting the terminal to perform the operation corresponding to the first process according to the first policy may include:

In the case that it is determined according to the first policy that the first desktop has the authority to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

In the case that it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibit the terminal from executing the operation corresponding to the first process; wherein,

The system service interface and network connection function corresponding to each desktop in the plurality of desktops are isolated based on the sandbox;

The operation corresponding to the first process includes one of the following:

access the first local area network;

Access the second local area network;

Call the system service interface.

In practical application, the first local area network may be an enterprise intranet; the second local area network may be a wireless local area network such as a wireless Bluetooth local area network, a wireless infrared local area network, or the like. The system service interface may include a printer interface, a Universal Serial Bus (USB, Universal Serial Bus) interface, etc.; in this way, users can be prevented from leaking office data through a network, printer or USB, etc., and the security of office data can be further improved.

In practical application, in order to further ensure the security of office data, the first policy may further include a screenshot permission, so that the user can avoid leaking office data through screenshots when using the desktop for office.

Based on this, in an embodiment, the operation corresponding to the first process includes a screenshot operation; the allowing or prohibiting the terminal from executing the operation corresponding to the first process according to the first policy may include:

Allowing the terminal to perform an operation corresponding to the first process when the first desktop has the right to take screenshots;

In the case that the first desktop does not have the right to take screenshots, the terminal is prohibited from executing the operation corresponding to the first process; or, a screenshot image including traceable watermark information is generated.

In the process management method provided by the embodiment of the present application, the process of the terminal is monitored; when the first process is monitored, according to the desktop identifier carried by the first process, it is determined that the first process corresponds to a plurality of desktops included in the terminal the first desktop; the system operating authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the process corresponding to each desktop in the multiple desktops is isolated based on the sandbox; using the difference between the desktop and the process processing strategy determine the first policy corresponding to the first desktop; and according to the first policy, allow or prohibit the terminal from executing the operation corresponding to the first process; in this way, in the user terminal-based multi-desktop When implementing BYOD scenarios and small and micro branch office scenarios, it can avoid office data leakage, improve the security of office data, and improve user experience.

At the same time, because the process management method provided by the embodiments of the present application is implemented based on the multi-desktop form of the terminal itself, and does not need to use external devices to protect office data, the deployment cost is greatly reduced, and the difficulty and complexity of the deployment method are also reduced. The difficulty of subsequent operation and maintenance.

In addition, since the process management method provided by the embodiment of the present application is implemented based on the multi-desktop form of the terminal itself, the user can directly realize the BYOD scenario and/or the small and micro branch office scenario and other application scenarios (such as the user's personal application) through desktop switching. Scene) switching, the operation is simple and convenient, therefore, the user experience is further improved.

The present application will be described in further detail below in conjunction with application examples.

This application embodiment provides a data leakage prevention solution based on UEM sandbox, which comprehensively protects user terminals in BYOD scenarios and small and micro branch office scenarios from multiple perspectives (that is, protection of office data) . Specifically, one or more dedicated desktop workspaces are created based on the user's personal desktop space provided by the operating system of the user terminal, that is, a multi-desktop form is constructed in the user terminal. At the same time, as shown in FIG. 3, a UEM data leakage prevention control unit 301, a multi-desktop form unit 302, a process identification and isolation unit 303, a file isolation unit 304, a file encryption and decryption unit 305, a VPN and a network isolation unit are set in the user terminal. 306, registry isolation unit 307, clipboard isolation unit 308, screen watermark and anti-screenshot unit 309, service isolation unit 310, and infrared and Bluetooth device isolation unit 311, for implementing work corresponding to each desktop in the multiple desktops Data protection such as VPN security link isolation, file isolation, file encryption, network isolation, clipboard isolation, process isolation, registry isolation, screen watermarking, service isolation, and infrared and Bluetooth device isolation for software (applications) running in the space Function.

Specifically, the UEM data leakage prevention control unit 301 is used to provide a sandbox function based on UEM, as the process identification and isolation unit 303, the file isolation unit 304, the file encryption and decryption unit 305, the VPN and network isolation unit 306, and the registry isolation unit 306. unit 307, clipboard isolation unit 308, screen watermark and anti-screenshot unit 309, service isolation unit 310 and infrared and Bluetooth device isolation unit 311; The corresponding relationship between desktops and data protection policies (that is, the above-mentioned process processing policies) is obtained from the shared memory (which may be referred to as global shared memory), and the data protection policies corresponding to each desktop are provided to other units.

The multi-desktop form unit 302 is configured to construct a multi-desktop form including a personal desktop (ie, the above-mentioned first type of desktop) and a secure desktop (ie, the above-mentioned second type of desktop). Here, user data protection needs to be reflected in the secure desktop, which can be guaranteed by the following key technologies, such as process identification, file encryption and decryption, file isolation, registry isolation, network isolation, clipboard isolation and other technologies. At the same time, a desktop switching button is displayed on the task bar of each desktop, which is used to quickly switch between the personal desktop and the secure desktop.

The process identification and isolation unit 303 is used to accurately identify whether the process operating the data belongs to the personal desktop or the secure desktop, so as to protect the data in the secure desktop. Exemplarily, in the Windows system, the process space belonging to a certain desktop contains corresponding desktop information (that is, the above-mentioned desktop identifier, which can be expressed as DesktopInformation in English, referred to as DesktopInfo for short), so as to mark the process as a personal process ( That is, the process corresponding to the personal desktop) or the secure process (that is, the process corresponding to the secure desktop); at the same time, a process callback function can be registered in the Windows driver by calling the corresponding application programming interface (API, Application Programming Interface) PsSetCreateProcessNotifyRoutineEx. When a process starts and exits, the system will call the registered callback function to notify the driver, and then obtain the PEB information of the process (representing the PEB structure) through the EPROCESS object of the process (representing the EPROCESS structure of the process), and obtain the DesktopInfo from the PEB information to determine The desktop to which this process belongs.

The file isolation unit 304 is used for file isolation. Specifically, in the initial state, the files in the personal desktop and the files in the secure desktop are the same, and when the security process opens the file with write permission, before the file is actually opened, the Minifilter technology can be used to convert the file Copy a copy to the redirection directory belonging to the secure desktop, and then open the file corresponding to the file in the redirection directory. Subsequent operations on this file are replaced by operations on the corresponding files in the redirection directory.

The file encryption and decryption unit 305 is configured to encrypt and decrypt the files in the redirected directory. Specifically, in the initial state, the files in the personal desktop and the files in the secure desktop are the same, and both are in an unencrypted state. Through the Minifilter technology, when the subsequent security process writes to the files in the redirected directory, the corresponding The file will be encrypted before being written to the disk; when the secure process reads the file in the redirected directory, the read data of the corresponding file will be decrypted before returning to the secure process.

The VPN and network isolation unit 306 is used for VPN and network isolation. Specifically, the secure desktop needs to have the function of accessing the enterprise intranet. The network protocol support of the software in the secure desktop is no different from that of the intranet PC. It must support Transmission Control Protocol (TCP, Transmission Control Protocol), User Datagram Protocol ( UDP, UserDatagram Protocol) and Internet Control Message Protocol (ICMP, Internet Control Message Protocol); at the same time, it is necessary to ensure that only the software in the secure desktop can access the intranet, and the software in the personal desktop cannot access the intranet; The software needs to support Domain Name System (DNS, Domain Name System) resolution. Here, the network driver of Windows Filtering Platform (WFP, Windows Filtering Platform) based on sslVPN (VPN technology based on Secure Socket Layer (SSL, Security Socket Layer) to establish a remote secure access channel) can be used for security processes and individuals. Process for network isolation.

The registry isolation unit 307 is used to isolate the registry. Specifically, in the initial state, the registry in the personal desktop and the registry in the secure desktop are the same. When the security process opens the registry with write permission later, before the corresponding registry is actually opened, you can Through the driving technology, the path of the corresponding registry is replaced with the redirected registry path of the secure desktop, thereby opening the registry under the redirected path corresponding to the corresponding registry path, and subsequent operations on the corresponding registry are replaced by Operations on the registry under the redirected registry path. Exemplarily, a registry callback can be registered in the Windows driver by calling the CmRegisterCallbackEx API, and when a registry operation occurs, the system will call the registered callback to notify the driver.

The shearing board isolation unit 308 is used to isolate the shearing board. Specifically, the data inside the secure desktop is not allowed to be copied to the personal desktop. The Hook technology can be used to Hook the APIs (including user32.dll!GetClipboardData and user32.dll!SetClipboardData) for the process to operate the clipboard. When the process call user32.dll! When SetClipboardData is copied, the security attribute of the currently copied process can be set in the global shared memory, when the process calls user32.dll! When GetClipboardData is pasting, it obtains the security attribute of the process that triggers the copy from the global shared memory, and compares it with the security attribute of the current pasting process to determine whether the current pasting behavior is trusted. That is, when the security attribute of the process that triggers copying is a secure process, and the security attribute of the currently pasted process is a personal process, it can be determined that the current pasting behavior cannot be trusted, and the execution of the pasting process is refused; the security attribute of the process that triggers copying is a personal process , when the security attribute of the currently pasting process is a safe process, it can be determined that the current pasting behavior can be trusted, and the pasting process is allowed to execute.

The screen watermark and screen capture prevention unit 309 is used to prevent users from leaking secrets through screen capture. Specifically, an eye-catching watermark (such as DesktopInfo, user name, user account, etc.) can be displayed in the corresponding workspace, and the screenshot generated after the screenshot will contain watermark information for subsequent tracking.

The service isolation unit 310 is used for service isolation. Specifically, the user can be prevented from leaking secrets through printing by prohibiting the process within the secure desktop from using the printing function. Exemplarily, through the Hook technology, Hook the APIs (including Winspool.drvl!OpenPrinter, Winspool.drv!AddPrinter, Winspool.drv!StartDocPrinter, Winspool.drv!StartPagePrinter and Winspool.drv!WritePrinter) that call the printer service, When the security process calls these APIs for operating printers, it returns failure directly.

The infrared and Bluetooth device isolation unit 311 is used to isolate the wireless infrared local area network and the wireless Bluetooth local area network. Specifically, similar to the network isolation, the WFP is used to realize the isolation of the wireless infrared local area network and the wireless Bluetooth local area network. Here, the protocol family (which can be expressed as AF in English) used to realize the isolation of the wireless infrared local area network is AF_IRDR(26), and the AF used to realize the isolation of the wireless Bluetooth local area network is AF_BTH(32). The AFs used for isolation are AF_INET and AF_INET6. Here, the infrared and bluetooth device isolation unit 311 determines whether to enable infrared and bluetooth device interception according to the data protection policy corresponding to the corresponding desktop. If the corresponding interception is enabled, the access of the safe process to the infrared and bluetooth devices will be rejected, and the non-safety process will not be controlled. (ie non-secure processes can access IR and Bluetooth devices).

In practical application, compared to building a multi-desktop form on the user terminal, it can also be in the form of a widget (which can be expressed as a Web Widget in English, or abbreviated as Widget), and adding a workspace (ie, desktop) means adding a Widget. And through the UEM sandbox to achieve the isolation of the workspace corresponding to each Widget.

The UEM sandbox-based data leakage prevention solution provided by this application embodiment creates one or more secure workspaces (that is, the above-mentioned security domains) that are completely logically isolated from the personal desktop (that is, the above-mentioned personal domain) in the user terminal. The software (application) running in the workspace has data such as VPN secure link isolation, file isolation, file encryption, network isolation, clipboard isolation, process isolation, registry isolation, screen watermark, service isolation, and infrared and Bluetooth device isolation. Protective function. Compared with the data leakage prevention solution in the related art, it does not change the user's existing desktop usage habits. At the same time, the network and file operations for the secure workspace are completely isolated from the personal workspace, and the security is higher.

In order to implement the method of the embodiment of the present application, the embodiment of the present application further provides a process management device, which is set on a terminal. As shown in FIG. 4 , the device includes:

The monitoring unit 401 is configured to monitor the process of the terminal; when the first process is monitored, according to the desktop identifier carried by the first process, determine the first process corresponding to the multiple desktops included in the terminal. a desktop; the system operating authority corresponding to each desktop in the multiple desktops included in the terminal is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox;

A processing unit 402, configured to determine a first policy corresponding to the first desktop by using the correspondence between the desktop and the process processing policy; and allow or prohibit the terminal from executing the first process according to the first policy corresponding operation.

Wherein, in an embodiment, the process management apparatus further includes:

an obtaining unit, configured to obtain the correspondence between the desktops and the process processing policy and the first policy from the shared memory of the multiple desktops.

In one embodiment, the multiple desktops included in the terminal include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop;

The processing unit 402 is used for:

In the case that the operation corresponding to the first process includes the operation of the second type of desktop on the file in the file directory corresponding to the first type of desktop, allowing the terminal to perform the operation corresponding to the first process;

In the case that the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; in,

The files in the file directory corresponding to each desktop in the plurality of desktops are isolated based on the sandbox.

In one embodiment, the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; allowing the terminal to execute the first process During corresponding operations, the processing unit 402 is configured to:

In the case that a redirection file corresponding to the first file exists in the file directory corresponding to the second type of desktop, controlling the terminal to perform an operation corresponding to the first process with respect to the redirection file;

In the case where the redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, the redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop file, and control the terminal to perform an operation corresponding to the first process with respect to the redirected file.

In an embodiment, the processing unit 402 is configured to perform encryption processing on the redirected file when controlling the terminal to perform an operation corresponding to the first process on the redirected file.

In one embodiment, the processing unit 402 is configured to:

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the second type by the desktop of the first type, prohibiting the terminal from executing the operation corresponding to the first process ;

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the first type by the desktop of the second type, the terminal is allowed to perform the operation corresponding to the first process ;in,

The clipboards of each desktop in the plurality of desktops are isolated based on the sandbox.

In one embodiment, the processing unit 402 is configured to:

In the case that it is determined according to the first policy that the first desktop has the authority to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

In the case that it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibit the terminal from executing the operation corresponding to the first process; wherein,

The system service interface and network connection function corresponding to each desktop in the plurality of desktops are isolated based on the sandbox;

The operation corresponding to the first process includes one of the following:

access the first local area network;

Access the second local area network;

Call the system service interface.

In one embodiment, the operation corresponding to the first process includes a screenshot operation; the processing unit 402 is configured to:

Allowing the terminal to perform an operation corresponding to the first process when the first desktop has the right to take screenshots;

In the case that the first desktop does not have the right to take screenshots, the terminal is prohibited from executing the operation corresponding to the first process; or, a screenshot image including traceable watermark information is generated.

Here, the function of the monitoring unit 401 is equivalent to part of the function of the process identification and isolation unit 303 in the application embodiment of the present application; the function of the acquisition unit is equivalent to the part of the UEM data leakage prevention control unit 301 in the application embodiment of the present application Function; the function of the processing unit 402 is equivalent to the other functions of the UEM data leakage prevention control unit 301 and the process identification and isolation unit 303 in the application embodiment of this application, as well as the multi-desktop form unit 302, the file isolation unit 304, the file encryption and decryption unit 302 Functions of unit 305, VPN and network isolation unit 306, registry isolation unit 307, clipboard isolation unit 308, screen watermark and anti-screenshot unit 309, service isolation unit 310 and infrared and bluetooth device isolation unit 311.

The monitoring unit 401 and the acquiring unit may be implemented by a processor in the process management apparatus in conjunction with a communication interface; the processing unit 402 may be implemented by a processor in the process management apparatus.

It should be noted that: when the process management apparatus provided by the above embodiments manages processes, only the division of the above program modules is used as an example for illustration, and in practical applications, the above processes may be allocated to different program modules to complete the process. The internal structure of the process management device is divided into different program modules to complete all or part of the processes described above. In addition, the process management apparatus and the process management method embodiments provided by the above embodiments belong to the same concept, and the specific implementation process thereof is detailed in the method embodiments, which will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the methods of the embodiments of the present application, the embodiments of the present application further provide a process management apparatus, which is set on a terminal. As shown in FIG. 5 , the process management apparatus 500 includes:

A communication interface 501, capable of information interaction with other electronic devices;

A processor 502, connected to the communication interface 501, to realize information interaction with other electronic devices, for executing the method provided by one or more of the above technical solutions when running a computer program;

The memory 503 is used to store computer programs that can be executed on the processor 502 .

Specifically, the processor 502 is configured to perform the following operations:

Monitoring the process of the terminal; when monitoring the first process, according to the desktop identifier carried by the first process, determine the first desktop corresponding to the first process in the multiple desktops included in the terminal; the terminal The system operating authority corresponding to each desktop in the multiple desktops included is the same or different; the processes corresponding to each desktop in the multiple desktops are isolated based on the sandbox;

The first policy corresponding to the first desktop is determined by using the correspondence between the desktop and the process processing policy; and according to the first policy, the terminal is allowed or prohibited to perform the operation corresponding to the first process.

Wherein, in one embodiment, the processor 502 is configured to perform the following operations:

The correspondence between the desktops and the process processing policy and the first policy are acquired from the shared memory of the multiple desktops.

In one embodiment, the multiple desktops included in the terminal include a first type of desktop and a second type of desktop; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop; The processor 502 is configured to perform the following operations:

In the case that the operation corresponding to the first process includes the operation of the second type of desktop on the file in the file directory corresponding to the first type of desktop, allowing the terminal to perform the operation corresponding to the first process;

In the case that the operation corresponding to the first process includes the operation of the first type of desktop on the file in the file directory corresponding to the second type of desktop, prohibiting the terminal from executing the operation corresponding to the first process; in,

The files in the file directory corresponding to each desktop in the plurality of desktops are isolated based on the sandbox.

In one embodiment, the operation corresponding to the first process includes the operation of the second type of desktop on the first file in the file directory corresponding to the first type of desktop; allowing the terminal to execute the first process During corresponding operations, the processor 502 is configured to perform the following operations:

In the case that a redirection file corresponding to the first file exists in the file directory corresponding to the second type of desktop, controlling the terminal to perform an operation corresponding to the first process with respect to the redirection file;

In the case where the redirection file corresponding to the first file does not exist in the file directory corresponding to the second type of desktop, the redirection file corresponding to the first file is generated in the file directory corresponding to the second type of desktop file, and control the terminal to perform an operation corresponding to the first process with respect to the redirected file.

In one embodiment, the processor 502 is configured to perform the following operations:

When the terminal is controlled to perform an operation corresponding to the first process on the redirection file, the redirection file is encrypted.

In one embodiment, the processor 502 is configured to perform the following operations:

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the second type by the desktop of the first type, prohibiting the terminal from executing the operation corresponding to the first process ;

In the case that the operation corresponding to the first process includes the operation of pasting the text or image copied from the desktop of the first type by the desktop of the second type, the terminal is allowed to perform the operation corresponding to the first process ;in,

The clipboards of each desktop in the plurality of desktops are isolated based on the sandbox.

In one embodiment, the processor 502 is configured to perform the following operations:

In the case that it is determined according to the first policy that the first desktop has the authority to execute the operation corresponding to the first process, allowing the terminal to execute the operation corresponding to the first process;

In the case that it is determined according to the first policy that the first desktop does not have the authority to execute the operation corresponding to the first process, prohibit the terminal from executing the operation corresponding to the first process; wherein,

The system service interface and network connection function corresponding to each desktop in the plurality of desktops are isolated based on the sandbox;

The operation corresponding to the first process includes one of the following:

access the first local area network;

Access the second local area network;

Call the system service interface.

In one embodiment, the operation corresponding to the first process includes a screenshot operation; the processor 502 is configured to perform the following operations:

Allowing the terminal to perform an operation corresponding to the first process when the first desktop has the right to take screenshots;

In the case that the first desktop does not have the right to take screenshots, the terminal is prohibited from executing the operation corresponding to the first process; or, a screenshot image including traceable watermark information is generated.

It should be noted that: the specific process for the processor 502 to perform the above operations can be found in the method embodiments, and details are not repeated here.

Of course, in practical application, the various components in the process management apparatus 500 are coupled together through the bus system 504 . It will be appreciated that the bus system 504 is used to implement connection communication between these components. In addition to the data bus, the bus system 504 also includes a power bus, a control bus and a status signal bus. For clarity, however, the various buses are labeled as bus system 504 in FIG. 5 .

The memory 503 in this embodiment of the present application is used to store various types of data to support the operation of the process management apparatus 500 . Examples of such data include: any computer program used to operate on the process management apparatus 500 .

The methods disclosed in the above embodiments of the present application may be applied to the processor 502 or implemented by the processor 502 . The processor 502 may be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above-mentioned method may be completed by a hardware integrated logic circuit in the processor 502 or an instruction in the form of software. The above-mentioned processor 502 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The processor 502 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of this application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 503, and the processor 502 reads the information in the memory 503, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the process management apparatus 500 may be implemented by one or more Application Specific Integrated Circuits (ASIC, Application Specific Integrated Circuits), DSPs, Programmable Logic Devices (PLDs, Programmable Logic Devices), complex Programmable Logic Devices ( CPLD, Complex Programmable LogicDevice), Field-Programmable Gate Array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronic Element implementation for performing the aforementioned method.

It can be understood that the memory 503 in this embodiment of the present application may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM, Read Only Memory), a programmable read-only memory (PROM, Programmable Read-Only Memory), an erasable programmable read-only memory (EPROM, Erasable Programmable Read-only memory) Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (FlashMemory), Magnetic Surface Memory, Optical disk, or Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory can be a magnetic disk memory or a magnetic tape memory. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache memory. By way of example and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM, Synchronous Dynamic Random Access Memory), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), Enhanced Type Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory). The memories described in the embodiments of the present application are intended to include, but not be limited to, these and any other suitable types of memories.

In an exemplary embodiment, an embodiment of the present application further provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, for example, including a memory 503 for storing a computer program. The processor 502 executes to complete the steps of the aforementioned method. The computer-readable storage medium may be memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

It should be noted that "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence.

In addition, the technical solutions described in the embodiments of the present application may be combined arbitrarily unless there is a conflict.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (11)

1. A process management method, comprising:

monitoring the process of the terminal; when a first process is monitored, determining a first desktop corresponding to the first process in a plurality of desktops included in the terminal according to a desktop identifier carried by the first process; the system operation authorities corresponding to all desktops in a plurality of desktops contained in the terminal are the same or different; processes corresponding to each desktop in the multiple desktops are isolated based on sandboxes;

determining a first strategy corresponding to the first desktop by utilizing the corresponding relation between the desktop and the process processing strategy; and allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first strategy.

2. The method of claim 1, further comprising:

and acquiring the corresponding relation between the desktop and the process processing strategy and the first strategy from the shared memories of the desktops.

3. The method according to claim 1 or 2, wherein the plurality of desktops included in the terminal include a first desktop type and a second desktop type; the system operation authority corresponding to the first type of desktop is lower than the system operation authority corresponding to the second type of desktop;

the allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first policy includes:

allowing the terminal to execute the operation corresponding to the first process under the condition that the operation corresponding to the first process comprises the operation of the second type desktop on the file in the file directory corresponding to the first type desktop;

under the condition that the operation corresponding to the first process comprises the operation of the first class desktop on the file in the file directory corresponding to the second class desktop, prohibiting the terminal from executing the operation corresponding to the first process; wherein,

files under the file directories corresponding to the desktops in the multiple desktops are isolated on the basis of sandboxes.

4. The method according to claim 3, wherein the operation corresponding to the first process includes an operation of the second type desktop on a first file in a file directory corresponding to the first type desktop; when the terminal is allowed to execute the operation corresponding to the first process, the method further comprises the following steps:

under the condition that a redirection file corresponding to the first file exists in a file directory corresponding to the second type desktop, controlling the terminal to execute an operation corresponding to the first process aiming at the redirection file;

and under the condition that the redirection file corresponding to the first file does not exist in the file directory corresponding to the second type desktop, generating the redirection file corresponding to the first file in the file directory corresponding to the second type desktop, and controlling the terminal to execute the operation corresponding to the first process aiming at the redirection file.

5. The method of claim 4, further comprising:

and when the terminal is controlled to execute the operation corresponding to the first process aiming at the redirection file, the redirection file is encrypted.

6. The method according to claim 3, wherein the allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first policy includes:

when the operation corresponding to the first process comprises an operation of pasting the text or the image copied from the second desktop by the first desktop, the terminal is prohibited from executing the operation corresponding to the first process;

allowing the terminal to execute the operation corresponding to the first process under the condition that the operation corresponding to the first process comprises the operation of pasting the text or the image copied from the first desktop by the second desktop; wherein,

the shear plates of each of the plurality of table tops are isolated based on a sandbox.

7. The method according to claim 1 or 2, wherein the allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first policy includes:

allowing the terminal to execute the operation corresponding to the first process under the condition that the first desktop is determined to have the authority of executing the operation corresponding to the first process according to the first strategy;

under the condition that the first desktop does not have the authority of executing the operation corresponding to the first process according to the first strategy, the terminal is prohibited from executing the operation corresponding to the first process; wherein,

the system service interfaces and the network connection functions corresponding to the desktops in the desktops are isolated on the basis of sandboxes;

the operation corresponding to the first process comprises one of the following operations:

accessing a first local area network;

accessing a second local area network;

and calling a system service interface.

8. The method according to claim 1 or 2, wherein the operation corresponding to the first process comprises a screenshot operation;

the allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first policy includes:

allowing the terminal to execute the operation corresponding to the first process under the condition that the first desktop has the screenshot authority;

under the condition that the first desktop does not have the screenshot authority, prohibiting the terminal from executing the operation corresponding to the first process; alternatively, a screenshot picture containing traceable watermark information is generated.

9. A process management apparatus, comprising:

the monitoring unit is used for monitoring the process of the terminal; when a first process is monitored, determining a first desktop corresponding to the first process in a plurality of desktops included in the terminal according to a desktop identifier carried by the first process; the system operation authorities corresponding to all desktops in a plurality of desktops contained in the terminal are the same or different; processes corresponding to each desktop in the multiple desktops are isolated based on sandboxes;

the processing unit is used for determining a first strategy corresponding to the first desktop by utilizing the corresponding relation between the desktop and the process processing strategy; and allowing or prohibiting the terminal to execute the operation corresponding to the first process according to the first strategy.

10. A process management apparatus, comprising: a processor and a memory for storing a computer program capable of running on the processor;

wherein the processor is adapted to perform the steps of the method of any one of claims 1 to 8 when running the computer program.

11. A storage medium storing a computer program, characterized in that the computer program realizes the steps of the method according to any one of claims 1 to 8 when executed by a processor.

Images