KR20100054312A - A method to evaluate the information sensitivity and the risk of user action for the information leakage protection - Google Patents

Abstract

PURPOSE: A quantitative estimate method of information significance and a user behavior degree of danger is provided to use a model which quantizes the risk of user behavior about security significance and information, thereby effectively and economically preventing a leak of information. CONSTITUTION: Significance in security aspect of information is calculated by using significance score based on security level score of a user who access to information, significance score of information type, a keyword included in the information. A flow of the information is controlled based on degree of danger about sharing, moving, and renaming action of information among an action about the information of a user and on degree of danger according to a security level adjustment of a user.

Description

A method to evaluate the information sensitivity and the risk of user action for the information leakage protection}

Access control technology to prevent information leakage of organization

Confidentiality is a fundamental requirement in the field of information protection. A commonly used technique for providing confidentiality is the access control method. Information leakage prevention technology is used by organizations and enterprises to limit their information assets from being passed on to malicious people or flowing into unauthorized people. Information leakage prevention technology is generally provided by integrating access control technology, encryption / decryption technology, external device control technology, and network control technology.

Existing information leakage prevention technology and supporting software allow specific users' access rights to certain information under the qualitative and intuitive judgment of an individual or administrator, and technology to block specific leakage paths (for example, USB port blocking). Research has been carried out around the implementation. This type of control is not effective because it does not reflect the actual importance of the information in terms of security or the risk of user behavior. The present invention provides a model that quantifies the security importance of information and the risk of user behavior on the information, thereby enabling more effective and efficient information leakage prevention.

In order to calculate the importance of each information in terms of security, we use the security score of users who access the information, the importance score of the information type, and the importance score based on the keywords included in the information. In addition, the risk calculation method for information sharing, information movement, and information (file) renaming action among user's information actions and the risk calculation method according to the user's security level adjustment are used.

By using a model that quantifies the security importance and the risk of user behavior on information, more effective and efficient information prevention can be prevented.

In order for information leakage prevention technology or supporting software to be effective and efficient, it is necessary to assess how important the information to be protected is quantitatively in terms of security and how quantitatively dangerous the user's behavior with particular information is. have. In the present invention, a simple model for defining and quantifying the factors necessary for such quantitative evaluation was defined. 1 is a simplified diagram of the overall configuration of a system for quantifying the security importance of information and the risk of user behavior.

Table 1. Security Importance Factors for Information

A. Definition of Security Criticality Factors and Process of Information

Figure 2 (a) shows the data configuration of the history of the user access to the information, (b) shows the security importance data of the specific information, (a) is stored in the 'log DB', (b ) Is stored in the 'security data repository'. Detailed descriptions of each item constituting the data are shown in [Table 1].

When the user creates or accesses the information, the process of calculating the security importance of the information is shown in FIG. 3.

1) When the user accesses the information, the details are stored in the 'Log DB'.

▶ When a user accesses the information, check whether the record exists in the 'Information Security Importance' table of the 'Security Data Repository', and if not, create a new record. (The ‘information ID’ in the ‘information security importance’ data is the primary key)

▶ 'Info ID' field

-A method of distinguishing each piece of information is needed for the identification of information. For example, in the case of a file, the full path of the file can be used as data to give an ID.

-When ID information is copied or modified, ID identification system is also required.

The development of this mechanism is not included in this paper.

▶ ‘User Security Level’ field

-The security level information for each user exists in the 'HR database'.

-Since the security level is a value that can be changed or adjusted over time, the security level of the user when accessing the information should be recorded.

2) Read log about the information in 'Log DB'.

▶ Read information access log from 'Log DB' using information ID as a key. The number of logs read can be limited by time or by number.

▶ When access log is read, there is a method to process the information when access is detected or access occurs at regular intervals.

3) Security importance calculation

Calculate the security importance value using the logs obtained in 2).

▶ Specific method for calculating security importance is described in 'B'.

4) Update 'Security Data Repository'

  Record the value calculated in 3) into the field of the corresponding record.

B. Calculate the Security Importance of Information

  The security importance of the information is calculated using the values in the information generation / access log data and the information security importance data.

1) User Security Rating Score

  In general, a company systematically defines the positions or duties of members so that their work can be performed based on them, and in terms of security, the positions or duties of users are used as a basis for controlling access to information. The organization of a company basically has a hierarchical structure. As shown in the figure below, it can be defined based on affiliation and position, or can be organized by job.

  The information that an individual can access in terms of security may vary depending on the person's department, position, and job. Information accessed by people in higher positions may be more valuable in terms of security. In addition, even if the same kind of data (for example, a picture file), data accessed by someone in the design room and data accessed by someone in the finance department may have different values in terms of security.

  In the present invention, a person's job grade and job function are used as factors for calculating a user security grade score, and it is assumed that a higher score is given to a user with a higher security grade.

▶ Rank set of users: Position = {Postion ₁ , Position ₂ ,. , Position _m }

▶ rank set of users: PScore = {PScore ₁ , PScore ₂ ,.. , PScore _m }

User A's rank score: PS (A) = PScore _i if GetPosition (A) = Position _i (1)

                                     GetPosition (A): Function to get the rank of user A

▶ Job set of users: Role = {Role ₁ , Role ₂ ,... , Role _n }

Set of job scores for users: RScore = {RScore ₁ , RScore ₂ ,. , RScore _n }

  Job A for user A: RS (A) = RScorek if GetRole (A) = Rolek (2)

                                     GetRole (A): Function to get job of user A

  ▶ Using (1) and (2) US (A) = PS (A) + RS (A) (3)

                                US (A): User A's Security Rating Score

2) Information type score

  Depending on the type of information, security aspects can be defined differently. For example, a company that stores a large amount of customer data in a database will value the information stored in the database more than any other information. For businesses that frequently exchange information with third parties, email should be critically controlled.

  In addition, it is possible to subdivide in evaluating the importance of each type of information. For example, in the case of a file, the type of file itself is meaningful in terms of security. Also, the form of the document file itself may have meaning.

  In the present invention, the security aspect importance of each type of information is defined as the following set. The value of each kind is a value defined in advance by a security administrator or an expert. Since it is not a fixed value, the current value is taken from the 'security data repository'.

Information type set: InformationType = {InfomationType ₁ , InfomationType ₂ ,... , InfomationType _m }

A set of security importance scores for each type of information: ITScore = {ITScore ₁ , ITScore ₂ ,... , ITScore _m }

Security Criticality Score of Type B Information: IFTS (B) = ITScore _i if GetInfoType (B) = InfomationType _i (4)

                                                GetInfoType (B): A function to get the kind of information B

3) security keyword score

  There are important words or sentences in terms of security. For example, a name of a specific technology or a file name having a specific format corresponds to this. In evaluating how important information is in terms of security keywords, the methods used in the field of information retrieval can be applied.

Security Keyword Definition

  The first thing that needs to be done is to define the keywords. However, these keywords should be meaningful in terms of security. Therefore, the first consideration is to have experts or authorities list security keywords. This has the advantage of having a clear set of security keywords, but it has a limitation that requires continuous management by humans. The second available method is to use the basic method used in the field of information retrieval. That is, keywords are extracted from all documents to be searched, and stopwords and stemming may be applied. However, one consideration in applying this method is where to put the information to extract the keyword. You need to decide if it is necessary to extract keywords from information that is not important in terms of security.

▶ Build Security Index

  When the keyword definition process is completed, an index is built based on this. The constructed index can be used not only for calculating the security importance score but also for locating information including a specific keyword.

▶ Calculation of security importance score of keyword side information

  Based on the information retrieval model, the security importance score of keyword side information can be calculated. Although there are many information retrieval models, the present invention calculates the security importance of information by applying a vector model.

-Keyword set: Keywords = {K ₁ , K ₂ ,... , K _m }

  The keyword set elements are all meaningful in terms of security.

    Therefore, in this model, the query can be expressed as a weighted vector for each keyword set element.

    The weight for each keyword is determined by the administrator or authority.

The vector I _j for each information is defined as follows.

There is w _{m, j} values are some definitions in the existing vector model, in this case because they are not to find the information having the highest score object using the degree of similarity between the query to use the frequency of the keyword K _m may appear on each of the information I think it is reasonable.

  -Security importance of keyword side information

(5)

(5)

4) Calculate the security importance final value of the information

  The security importance of the final information can be calculated using the user security level score, information type score, and security keyword score as follows.

(6)

(6)

{U ₁ , U ₂ ,... , U _m } is the set of users accessing the information I _j ,

  α, β, and γ are values given by the user or determined by experiment

TS (I _j ) has the following limitations.

▶ There may be an association of security importance between users and types of information, but it does not reflect this.

▶ It is based on the assumption that the security of information accessed by users with high security level will be high. This can be false looking at individual events only, but it does not matter assuming sufficient events occur.

5) information security and information access control

  When defining a security policy or rule, access can be determined based on the security importance of the information.

C. Defining Factors and Processes for Calculating the Risk of User Actions

4 shows the configuration of the user action log data, and [Table 2] summarizes the security risk calculation factors.

Table 2. Arguments for calculating user action security risks

When the user takes action on the information, the risk calculation process according to this is shown in FIG. 5.

1) When the user takes action on the information, the information is stored in the log DB.

▶ Save the relevant information in the 'User Action Log' table of the 'Log DB'.

▶ Since the user security level is an updated value, record the user security level when the user accesses the information.

▶ Record additional data required for each action.

-"Information sharing" action side data

  The ‘information sharing’ action should keep track of who shared the information. You should also leave details of the shared information (eg the size of the information). 'Information sharing' can happen for individual information or for a group of information (eg folder sharing). Sharing of bundled information can be handled by dividing into sharing of individual information.

-"Information move" action side data

  In case of 'information movement', the destination route information should be left as additional data. You should also leave details of the transferred information.

-"Security level adjustment" action data

  Adjusting the security level for a user involves a change in the range of information accessible to the user. This change can be treated as normal, but from a security standpoint it makes sense. Therefore, when the 'Security Level Adjustment' action occurs, the user's security level change history or the access range change resulting from this is recorded.

-Information (file) rename data

  We mentioned earlier that file names with specific formats can be a factor in assessing the security importance of information. However, if the user changes the file name to a name of a different format or does not have a format, it can be a dangerous behavior in terms of security. Therefore, it is necessary to record the specific change history regarding the "change information content" action.

2) Read the log for the action in 'Log DB'.

▶ Read user action log from 'Log DB'.

▶ When access log is read, there is a method to process the information when action is detected on the information or the action occurred at a certain period.

3) Security risk calculation

Calculate the security risk value using the log obtained in 2).

Specific methods for calculating security risks are described in 3.4.

4) Update 'Security Data Repository'

  Record the value calculated in 3) in the field of 'Log DB' record. Depending on your security policy or rules, you may be able to follow up with risk calculations.

D. Calculate Security Risks for User Actions

  The method of calculating the risk for each action is presented as follows. The larger the calculated value, the greater the risk.

1) Risk of information sharing action

  The measurement of risk due to the information sharing action can be made by evaluating how much more information to be shared is exposed.

Shared Information Set: Shared = {Shared ₁ , Shared ₂ ,… , Shared _m }

(7)▶ Security importance score of shared information:

(7)

▶ Set of users who can access information before sharing: User _Before = {User ₁ , User _{2 ,.} , User _n }

(8)▶ Sum of security level scores of users who can access information before sharing:

(8)

▶ Set of users who can access information after sharing: User _After = {User ₁ , User ₂ ,. , User _p }

(9)▶ Sum of security level scores of users who can access information after sharing:

(9)

▶ Risk of information sharing actions in (7), (8), and (9):

When sharing information, it is natural that TUS _After increases than TUS _Before . However, the higher the security level score of a newly added user, the larger the value of (TUS _After -TUS _Before ). Assuming that the higher security level user has more privileges, the higher the value (TUS _After -TUS _Before ), the greater the risk of leakage.

2) Risk of information movement action

  In this case, the risk was calculated by considering only the destination route.

Destination Classification Set: TargetClass = {TargetClass ₁ , TargetClass ₂ ,... , TargetClass _m }

Destination Risk Score Set: TScore = {TScore ₁ , TScore ₂ ,.. , TScore _m }

Risk Score for Destination Path: RTS (Path) = TScorei if GetTargetClass (Path) = TargetClass _i (10)

                                     GetTargetClass (Path): Gets the classification of the path Path

3) Security Level Adjustment Action

  Adjusting the security level will cause a change in the range of information accessible to the user, and the risk can be calculated based on this change.

▶ A set of information accessible before security level adjustment: Information _Before = {I ₁ , I ₂ . , I _m }

(11)▶ Sum of security importance scores of information accessible before security level adjustment:

(11)

▶ A set of information accessible after security level adjustment: Information _After = {I ₁ , I ₂ . , I _n }

(12)▶ Sum of security importance scores of information accessible after security level adjustment:

(12)

  ▶ Security Risk Leveling Action Risk in (11), (12):

(13)

(13)

  If the range of accessible information decreases after adjusting the security level, the action is considered not dangerous. Otherwise, there are security risks of increased information security importance.

4) Change Information (File) Name

  The risk of changing information security due to the change of information name.

Security Prior to Change: TS (I) _Before (14)

Security importance after change: TS (I) _After (15)

  ▶ Risk of information name change action (14), (15):

If the security importance of the information is increased or maintained due to the name change, the action is considered not dangerous. Otherwise, there is a security risk of reduced magnitude.

Figure 1 overall configuration of the system

Fig. 2 Information generation / access log data and information security importance data configuration

Figure 3 Security importance calculation process of information

4 user action log data configuration

Figure 5 Security Risk Calculation Process of User Action

Claims (2)

Defining factors for evaluating the security importance of information, evaluating each factor, and calculating the final information security importance Factor Definition for Security Risk Assessment of User Behavior and Risk Calculation Method for Each Behavior Type

Images