KR101092975B1 - Automatic system for removing password from diverse encrypted files and method thereof - Google Patents

Abstract

PURPOSE: A system and a method for cancelling an automated password about heterogeneous cryptogram files are provided to rapidly perform encryption and password verification/decryption about target files of digital forensic investigation. CONSTITUTION: A file analyzer(100) recognizes type and version of a heterogeneous encrypted files and draws an encryption algorithm and password verification information. A password analyzer(200) verifies an accurate password by using a candidate passwords and the password verification information. A password decryptor(300) decodes and outputs the file by generating a decoding key through the encryption algorithm and the accurate password.

Description

Automatic System for Removing Password from Diverse Encrypted Files and Method Thereof}

The present invention relates to an automated password unlocking system and method for a plurality of heterogeneous cryptographic files, and more particularly, to a plurality of heterogeneous cryptographic files for decrypting a file by decrypting the password in a plurality of heterogeneous files encrypted by specifying a password. An automated password release system and method are disclosed.

As the use of computers in personal and corporate activities is becoming more common, the use of electronic document files is increasing, and the types of electronic document files and the types of applications are diverse. Document files can store personal records, corporate activities, and so on, and are therefore subject to digital forensic investigations. Individuals or companies that want to protect the contents of a document file generally use encryption provided by the application of the document file. Alternatively, the encryption function of the compression program can be used to encrypt all file types other than document files.

In the existing digital forensic investigation, the application was used to check the contents of an encrypted document file. However, the recent increase in the capacity of storage media has increased the number of electronic document files, and accordingly the number of files for digital forensic analysis has increased enormously. In this situation, it is difficult to check all the encrypted document files existing on the storage medium by using the corresponding application program.

On the other hand, applying a different password for every encrypted document file is not an easy task from an administrative point of view. Due to such difficulty in password management, many individuals use the same password.

Elcomsoft and AccessData are two leading companies developing password recovery or decryption software for password-encrypted files. Elcomsoft's Advanced Archive Password Recovery is a software that recovers passwords for encrypted ZIP archives and RAR archives that have been encrypted using passwords. It can also recover passwords for files compressed with compression programs such as PKZip, WinZip, RAR, and WinRAR.

Elcomsoft's Advanced Office Password Recovery allows you to recover or remove passwords for password-protected documents using Microsoft Office applications. Elcomsoft's Advanced PDF Password Recovery can restore or remove passwords set in PDF documents. Elcomsoft's ElcomSoft Distributed Password Recovery is a distributed password recovery system that installs agents in a distributed environment and assigns each agent recovery of password-encrypted files on the server.

AccessData's Password Recovery Toolkit is software that supports password recovery and decryption of password-encrypted ZIP, RAR, Microsoft Office, and PDF files. AccessData's Distributed Network Attack is a distributed password recovery and decryption system that applies the functionality of the Password Recovery Toolkit to a distributed environment.

As such, existing commercial products have the purpose of deciphering passwords from certain types of encrypted files or using vulnerabilities in the use of cryptographic algorithms. And these products individually support password recovery software for specific file types, which makes it very inconvenient in a digital forensic investigation scene where files are randomly spilled into many different formats. In addition, the investigation efficiency is also low because most password recovery or decryption is performed for a single file.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to provide an automated password unlocking system and method for a plurality of heterogeneous encrypted files that can decrypt a plurality of heterogeneous encrypted files in a batch. Is in.

In addition, another object of the present invention, by automatically processing the password verification and decryption operation for the various types of encrypted files, it is possible to quickly perform encryption and password verification and decryption operations for a number of files that are the subject of digital forensic investigation An automated password decryption system and method for a plurality of heterogeneous cryptographic files.

An object of the present invention includes a file analysis unit for receiving a plurality of heterogeneous encryption files to recognize the type and version of the file and to derive encryption algorithm and password verification information; A password analyzer configured to receive a plurality of candidate passwords and verify correct password recognition using password verification information derived from the file analyzer; And a password release unit for generating a decryption key through a file encryption algorithm derived from the file analyzer and a correct password verified by the password analyzer, and then decrypting and outputting the file. This is accomplished by an automated password decryption system for the file.

In addition, according to the present invention, the file analysis unit, a file input unit for performing input to a plurality of heterogeneous cryptographic files; A file recognition unit for recognizing the type and version of the input file; An encryption confirmation unit for determining whether to encrypt; And an information derivation unit for deriving an encryption algorithm and password verification information.

In addition, according to the present invention, the file input unit is characterized in that for receiving one or more files in a file or folder unit.

In addition, according to the present invention, the file recognition unit recognizes the type of the file through the signature (Signature) unique to each individual file, characterized in that it is determined whether the type of the file that can be decoded.

In addition, according to the present invention, the file recognition unit is characterized in that to determine the version of the file by analyzing the contents of the file according to the internal structure information for each file type previously analyzed.

In addition, according to the present invention, the encryption check unit is characterized in that for filtering the unencrypted file by checking whether the file is encrypted.

According to the present invention, the information derivation unit reads the encryption algorithm and the password verification information from the file, and delivers the password analysis unit and the password release unit.

In addition, according to the present invention, the password analyzer may include: a password input unit for receiving a plurality of candidate passwords directly or via a file and transferring them to a password verification unit; And a password verification unit for determining which password is a correct password among a plurality of candidate passwords input by using password verification information derived from the file analyzer and a password verification algorithm for each file type previously analyzed. do.

In addition, according to the present invention, the password release unit, the key generation unit for generating a decryption key to be used in the encryption algorithm derived from the file analysis unit from the correct password derived from the password verification unit of the password analysis unit; A decryption unit for decrypting the input file using the encryption algorithm of the file derived from the file analysis unit with the generated decryption key; And a file output unit for storing the decrypted file in the designated location.

The above object of the present invention also includes: (a) a file analysis unit receiving a plurality of heterogeneous cryptographic files, recognizing the types and versions of the files, and deriving encryption algorithms and password verification information; (b) receiving a plurality of candidate passwords from a password analyzer and verifying whether the password is correct using password verification information derived from the file analyzer; And (c) a password releasing unit generating a decryption key using an encryption algorithm of the file derived from the file analyzing unit and a correct password verified by the password analyzing unit, and then decrypting and outputting the file. It is also accomplished by an automated password decryption method for multiple heterogeneous password files.

In addition, according to the present invention, the step (a), (a-1) the file input unit performing a plurality of input to the heterogeneous encrypted file; (a-2) recognizing, by the file recognition unit, the type and version of the input file; (a-3) checking the encryption unit to determine whether it is encrypted; And (a-4) deriving the encryption algorithm and the password verification information from the information derivation unit.

In addition, according to the present invention, the step (a-1) is characterized in that for receiving one or more files in a file or folder unit.

In addition, according to the present invention, the step (a-2) is characterized in that the type of files that can be decoded after recognizing the type of file through the signature (Signature) unique to each individual file.

In addition, according to the present invention, the step (a-2) is characterized in that to determine the version of the file by analyzing the contents of the file according to the internal structure information for each file type previously analyzed.

According to the present invention, the step (a-3) is characterized in that the file is encrypted by checking whether the file is encrypted or not.

In addition, according to the present invention, the step (a-4) is characterized in that the encryption algorithm and password verification information is read from the file and transmitted to the password analysis unit and the password release unit.

In addition, according to the present invention, the step (b), the password input unit receives a plurality of candidate passwords directly or via a file collectively delivered to the password verification unit; And determining, by a password verification unit, which password is a correct password among a plurality of candidate passwords input by using password verification information derived from the file analyzer and a password verification algorithm for each file type previously analyzed. It is done.

Also, according to the present invention, the step (c) may include: generating a decryption key to be used in the encryption algorithm derived from the file analyzer from the correct password derived from the password verification unit; Decrypting the input file using the encryption algorithm of the file derived from the file analyzer with the decryption key generated by the decryptor; And storing the decrypted file in the designated location by the file output unit.

According to the automated password release system and method for a plurality of heterogeneous cryptographic files of the present invention, there is an effect of enabling automated encryption determination, password verification and release, and decryption of files of various types.

In addition, by automatically processing password verification and decryption of various types of encrypted files, it is possible to quickly perform encryption and password verification and decryption operations on a large number of files subject to digital forensic investigation.

In addition, there is an effect of automating password unlocking operations for a plurality of files and password verification operations for a plurality of candidate passwords.

1 illustrates the overall configuration of an automated password release system for a plurality of heterogeneous cryptographic files in accordance with an embodiment of the present invention.
2 is a diagram illustrating a configuration of a file analyzer of an automated password unlocking system for a plurality of heterogeneous password files according to an exemplary embodiment of the present invention.
3 is a diagram illustrating a configuration of a password analysis unit of an automated password release system for a plurality of heterogeneous password files according to an embodiment of the present invention.
4 is a diagram illustrating a configuration of a password canceling unit of an automated password unlocking system for a plurality of heterogeneous password files according to an exemplary embodiment of the present invention.
5 is an overall flow diagram illustrating an automated password decryption method for multiple heterogeneous cryptographic files in accordance with an embodiment of the present invention.
6 is a flowchart illustrating a file analysis process of an automated password decryption method for a plurality of heterogeneous cryptographic files according to an embodiment of the present invention.
7 is a flowchart illustrating a password analysis process of an automated password decryption method for a plurality of heterogeneous cryptographic files according to an embodiment of the present invention.
8 is a flowchart illustrating a password decryption process of an automated password decryption method for a plurality of heterogeneous cryptographic files according to an embodiment of the present invention.

The terms or words used in this specification and claims are not to be construed as being limited to their ordinary or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a view showing the overall configuration of an automated password unlocking system for a plurality of heterogeneous password files according to an embodiment of the present invention.

As shown in FIG. 1, the automated password unlocking system for a plurality of heterogeneous password files of the present invention receives a large number of heterogeneous password files P1, P2,. File analysis unit 100 for recognizing and deriving encryption algorithm and password verification information, and password verification information derived from the file analysis unit 100 by receiving a plurality of candidate passwords (C1, C2, ... Cl) Decryption key through the password analysis unit 200 to verify whether the correct password using the encryption algorithm of the file derived from the file analysis unit 100 and the correct password verified by the password analysis unit 200 And a password release unit 300 for decrypting and outputting the file after generation.

2 to 4 illustrate the configuration of the file analysis unit 100, the password analysis unit 200, and the password release unit 300 of the automated password release system for a plurality of heterogeneous password files according to an embodiment of the present invention. The figure shown.

As shown in FIG. 2, the file analyzer 100 may include a file input unit 110 for performing input on a plurality of heterogeneous cryptographic files P1, P2,... Pn, and types of input files. And a file recognition unit 120 for recognizing a version, an encryption confirmation unit 130 for determining whether to encrypt, and an information derivation unit 140 for deriving encryption algorithm and password verification information.

First, the file input unit 110 receives a plurality of heterogeneous cryptographic files P1, P2, ... Pn.

The file input unit 110 allows a quick and easy input by receiving a number of files that are subjects of digital forensic investigation in individual files, a plurality of files, or a folder unit.

The file recognition unit 120 analyzes the inside of the input file to recognize the type and version of the file. After recognizing the file type through a unique signature for each file, it is determined whether the file is supported by the password unlocking system. In addition, even if a file of the same type may have a different encryption method depending on the version, the file version is analyzed by analyzing the content of the file according to the internal structure information of each file type analyzed in advance.

In the case of a file that supports encryption, the file contains information that can be used to verify whether the file is encrypted. The encryption check unit 130 uses this information to check whether the file is encrypted, and to filter the unencrypted file.

The encrypted file contains the encryption algorithm and information for password verification for later decryption. The information derivation unit 140 reads the encryption algorithm and the password verification information from the file and transfers them to the password analysis unit 200 and the password release unit 300.

As shown in FIG. 3, the password analyzer 200 receives a plurality of candidate passwords C1, C2,... Cl directly or via a file, and transmits them to the password verifier 220. A plurality of candidate passwords (C1, C2, ... Cl) input using the password input unit 210, the password verification information derived from the file analyzer 100, and a password verification algorithm for each file type previously analyzed. And a password verification unit 220 for determining which of the passwords is the correct password.

As illustrated in FIG. 4, the password canceling unit 300 may select a decryption key to be used in the encryption algorithm derived from the file analyzer 100 from the correct password R1 derived from the password verifying unit 220. A decryption unit 320 for decrypting an input file using a key generation unit 310 for generating the file, an encryption algorithm for a file derived from the file analysis unit 100 with the generated decryption key, and decrypted And a file output unit 330 for storing the release files D1, D2, ... Dm at a designated location.

The key generation unit 310 includes a key generation algorithm for each file type.

5 is an overall flowchart illustrating an automated password release method for a plurality of heterogeneous cryptographic files according to an embodiment of the present invention, and FIGS. 6 to 8 are automated diagrams for a plurality of heterogeneous cryptographic files according to an embodiment of the present invention. A flowchart illustrating a file analysis process, a password analysis process, and a password release process of the password release method, respectively.

As shown in FIG. 5, the file analyzer 100 receives a plurality of heterogeneous cryptographic files P1, P2,... Pn, recognizes file types and versions, and derives encryption algorithms and password verification information. (S500 ~ S504).

Thereafter, the password analyzer 200 receives a plurality of candidate passwords C1, C2, ... Cl, and verifies whether the password is correct using password verification information derived from the file analyzer 100 (S506). ).

Finally, the password release unit 300 generates a decryption key through the encryption algorithm of the file derived from the file analyzer 100 and the correct password verified by the password analyzer 200, and then decrypts and releases the file. Output files D1, D2, ... Dm (S508, S510)

As shown in FIGS. 6 to 8, the file input unit 110 receives a plurality of heterogeneous cryptographic files P1, P2,... Pn. The file input unit 110 allows for quick and easy input by receiving a number of files that are subjects of digital forensic investigation in units of individual files, a plurality of files, or folders (S600).

Referring to FIG. 6, the file recognition unit 120 analyzes the input file to recognize the type and version of the file, and recognizes the type of the file through a unique signature for each file. After that, it is determined whether the file is supported by the password unlocking system (S602, S604).

 In addition, even if a file of the same type may have a different encryption method depending on the version, the file version is analyzed by analyzing the content of the file according to internal structure information for each file type analyzed in advance (S606).

In the case of a file that supports encryption, the file contains information that can be used to verify whether the file is encrypted. The encryption checker 130 checks whether the file is encrypted using this information and filters the unencrypted file (S608, S610).

The encrypted file contains the encryption algorithm and information for password verification for later decryption. The information derivation unit 140 reads the encryption algorithm and the password verification information from the file and transfers them to the password analysis unit 200 and the password release unit 300 (S612).

Referring to FIG. 7, the password input unit 210 receives a plurality of candidate passwords C1, C2,..., Cl directly or via a file, and transmits them to the password verification unit 220 (S700).

In the password verification unit 220, among the plurality of candidate passwords C1, C2,..., Cl inputted by using the password verification information derived from the file analyzer 100 and a password verification algorithm for each file type previously analyzed. Determine which password is the correct password. The correct password thus obtained is transferred to the password release unit 300 for decryption (S702, S704).

Referring to FIG. 8, the key generation unit 310 generates a decryption key to be used in the encryption algorithm derived from the file analyzer 100 from the correct password derived from the password verification unit 220 (S800).

To this end, the key generation unit 310 includes a file generation key generation algorithm.

The decryption unit 320 decrypts the input file using the encryption algorithm of the file derived from the file analysis unit 100 using the decryption key generated above (S802).

The file output unit 330 stores the decrypted release files D1, D2, ... Dm in the designated location (S804).

According to the automated password release system and method for a plurality of heterogeneous cryptographic files of the present invention, it is possible to automatically determine whether to encrypt various files, verify and release passwords, and decrypt files. By automating and verifying password verification and decryption operations for files, you can quickly perform encryption and password verification and decryption operations on numerous files that are subject to digital forensic investigation. This has the effect of automating password verification for multiple candidate passwords.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the appended claims and their equivalents.

100: file analysis unit 110: file input unit
120: file recognition unit 130: encryption confirmation unit
140: information derivation unit 200: password analysis unit
210: password input unit 220: password verification unit
300: password release unit 310: key generation unit
320: decoding unit 330: file output unit

Claims (18)

A file analysis unit for receiving a plurality of heterogeneous encryption files, recognizing the types and versions of the files, and deriving encryption algorithms and password verification information;
A password analyzer configured to receive a plurality of candidate passwords and verify correct password recognition using password verification information derived from the file analyzer; And
A password releasing unit for generating a decryption key through a file encryption algorithm derived from the file analyzer and a correct password verified by the password analyzer, and then decrypting and outputting the file;
The file analysis unit analyzes the contents of the file according to the internal structure information for each file type analyzed in advance to determine a version of the file. The method of claim 1,
The file analysis unit,
A file input unit for inputting a plurality of heterogeneous password files;
A file recognition unit for recognizing the type and version of the input file;
An encryption confirmation unit for determining whether to encrypt; And
And an information derivation unit for deriving encryption algorithms and password verification information. The method of claim 2,
And the file input unit receives one or more files in file or folder units. The method of claim 2,
The file recognizing unit recognizes a file type through a signature unique to each file and then determines whether the file is a type of file that can be decrypted. delete The method of claim 2,
The encryption verification unit checks whether the file is encrypted and filters the unencrypted file. The method of claim 2,
And the information derivation unit reads encryption algorithm and password verification information from a file and delivers the encryption algorithm and password verification information to a password analysis unit and a password release unit. The method of claim 1,
The password analysis unit,
A password input unit for receiving a plurality of candidate passwords directly or via a file and passing them to the password verification unit; And
And a password verification unit for determining which password is a correct password among a plurality of candidate passwords input by using the password verification information derived from the file analyzer and a password verification algorithm for each file type previously analyzed. Automated password decryption system for multiple heterogeneous password files. The method of claim 1,
The password release unit,
A key generation unit for generating a decryption key to be used in the encryption algorithm derived from the file analysis unit from the correct password derived from the password verification unit of the password analysis unit;
A decryption unit for decrypting the input file using the encryption algorithm of the file derived from the file analysis unit with the generated decryption key; And
And a file output section for storing the decrypted file in a designated location. (a) receiving a plurality of heterogeneous encrypted files by a file analyzer to recognize types and versions of the files, and deriving encryption algorithms and password verification information;
(b) receiving a plurality of candidate passwords from a password analyzer and verifying whether the password is correct using password verification information derived from the file analyzer; And
(c) a password releasing unit generating a decryption key using an encryption algorithm of the file derived from the file analyzer and a correct password verified by the password analyzer, and then decrypting and outputting the file;
The step (a) of the automated password release method for a plurality of heterogeneous password files, characterized in that for analyzing the contents of the file according to the internal structure information for each file type previously analyzed to determine the version of the file. The method of claim 10,
In step (a),
(a-1) a file input unit performing input for a plurality of heterogeneous cryptographic files;
(a-2) recognizing, by the file recognition unit, the type and version of the input file;
(a-3) checking the encryption unit to determine whether it is encrypted; And
(a-4) The information derivation unit comprises a step of deriving encryption algorithm and password verification information. 12. The method of claim 11,
In the step (a-1), at least one file is input in a file or folder unit. 12. The method of claim 11,
The step (a-2) is automated for a plurality of heterogeneous encrypted files, characterized in that it is determined whether the file types are decryptable after recognizing the type of the file through a unique signature for each individual file. How to unlock your password. delete 12. The method of claim 11,
In the step (a-3), verifying whether a file is encrypted or not, and filtering an unencrypted file. 12. The method of claim 11,
In the step (a-4), the encryption algorithm and password verification information are read from a file and transmitted to a password analyzing unit and a password canceling unit. The method of claim 10,
In step (b),
A password input unit receiving a plurality of candidate passwords directly or via a file and passing them to the password verification unit; And
And determining a password from among a plurality of candidate passwords input by using a password verification information derived from the file analyzer and a password verification algorithm for each file type previously analyzed. An automated password decryption method for a plurality of heterogeneous password files. The method of claim 10,
In step (c),
Generating, by the key generation unit, a decryption key to be used in the encryption algorithm derived from the file analysis unit from the correct password derived by the password verification unit;
Decrypting the input file using the encryption algorithm of the file derived from the file analyzer with the decryption key generated by the decryptor; And
And a file outputting unit storing the decrypted file in a designated location.

Images