An apparatus for shielding a sensitive file, the apparatus for connecting to a server computer via a network, the apparatus comprising: an encryption-decryption unit for encrypting the sensitive file with an encryption key and decrypting the encrypted sensitive file with a decryption key corresponding to the encryption key, wherein an encryption key ID is embedded in the encrypted sensitive file, and the encryption key and the decryption key correspond to the encryption key ID; an encryption key storing unit for storing the encryption key received from the server; a decryption key storing unit for storing the decryption key received from the server; a security compliance requirements storing unit that stores security compliance requirements of the apparatus, wherein the security compliance requirements are sent from the server computer on request; and a security requirements monitoring unit for determining whether the apparatus complies with the security compliance requirements or not in response to a read instruction or a write instruction of the sensitive file by application software, wherein said security requirements monitoring unit requests the server computer to verify user information of the apparatus and a version of the security compliance requirements, and unlocks said encryption key storing unit and said decryption key storing unit when the user information and the version are successfully verified, wherein when the apparatus complies with the security compliance requirements, said security requirements monitoring unit, passes the encryption key and the encryption key ID corresponding to the encryption key from said encryption key storing unit to said encryption-decryption unit in response to the write instruction, or passes the decryption key corresponding to the encryption key ID embedded in the encrypted sensitive file from said decryption key storing unit to said encryption-decryption unit in response to the read instruction. an encryption-decryption unit for encrypting the sensitive file with an encryption key and decrypting the encrypted sensitive file with a decryption key corresponding to the encryption key, wherein an encryption key ID is embedded in the encrypted sensitive file, and the encryption key and the decryption key correspond to the encryption key ID; an encryption key storing unit for storing the encryption key received from the server; a decryption key storing unit for storing the decryption key received from the server; a security compliance requirements storing unit that stores security compliance requirements of the apparatus, wherein the security compliance requirements are sent from the server computer on request; and a security requirements monitoring unit for determining whether the apparatus complies with the security compliance requirements or not in response to a read instruction or a write instruction of the sensitive file by application software, wherein said security requirements monitoring unit requests the server computer to verify user information of the apparatus and a version of the security compliance requirements, and unlocks said encryption key storing unit and said decryption key storing unit when the user information and the version are successfully verified, wherein when the apparatus complies with the security compliance requirements, said security requirements monitoring unit, passes the encryption key and the encryption key ID corresponding to the encryption key from said encryption key storing unit to said encryption-decryption unit in response to the write instruction, or passes the decryption key corresponding to the encryption key ID embedded in the encrypted sensitive file from said decryption key storing unit to said encryption-decryption unit in response to the read instruction.