KR20180072158A - Methode for data hiding using timestamp information - Google Patents

Abstract

The present invention relates to a method for preventing security data from being detected from the outside by securely storing user′s security data in time stamp information in a Windows NTFS file system. The method includes: encoding data required to be hidden; extracting time stamp information from a random file; setting a data hidden area by bit-masking the least significant bit of the extracted time stamp information; and storing data in the data hidden area by bit OR operating the encoded data and time stamp information set with the data hidden area. According to the present invention, when some character codes are hidden in a particular part of the file time stamp in the Windows file system, confidential information such as a password and secret key information is safely stored in a computer not to be exposed or detected without changing data indicating time information (such as year, month, day, hour, minute, second) of the file.

Description

METHOD FOR DATA HIDING USING TIMESTAMP INFORMATION [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of hiding data in a file of a computer or a mobile terminal to prevent access and detection of security data by an external device, and more particularly, to a method of hiding data in a time stamp information of a file managed by a Windows NTFS file system The present invention relates to a method for hiding data so as to prevent access or detection of security data by the outside by securely storing the data.

Data hiding technology has been attracting attention in recent years because of its focus on various applications. Data is hidden, for example, to prevent unauthorized external access or data modification or copying, such as serial code attached to audio, video, and image files, which is not identified by the naked eye.

There are a number of ways to hide data in a computer, for example, in Windows systems, storing the contents of a file on a channel other than a conventional channel, such as alternate data stream (ADS) Programs such as TrueCrypt, Windows BitLocker, Camouflage, steganography programs that transfer the information you want to forward to other files, and Openstego, have.

Korean Patent Laid-Open Publication Nos. 2001-0044804 and 2006-0112682 propose a technique for hiding and restoring data in an image. Korean Patent Publication No. 10-0734940 and Publication No. 2006- 0062043 discloses an optional data hiding method in a mobile communication terminal that allows a user to set not to display data that he does not want to be exposed to others.

Korean Patent Laid-Open Publication No. 2001-0044804 (entitled " Method for Hiding and Restoring Secret Data in Picture Files " Korean Unexamined Patent Application Publication No. 2006-0112682 (entitled " System and method for performing robust reversible data hiding and data restoration in a spatial domain, 2006.11.01) Korean Patent Registration No. 10-0734940 (Title of the Invention: Method of setting data hiding function of a mobile communication terminal and its device. 2007.07.06) Korean Patent Laid-Open Publication No. 2006-0062043 (Title: Method for hiding optional data in a mobile communication terminal 2006.06.12)

The present invention provides a technology for hiding data by utilizing a structure of a file system in a computer OS program. The present invention safely stores data in time stamp information of a file managed by a Windows NTFS file system, The present invention provides a method for preventing access or detection of security data by a security function.

In order to achieve the above object, the present invention provides a method of hiding data using timestamp information of a file in a Windows file system, comprising the steps of: (a) encoding data to be hidden; (b) (C) setting a data-hidden area by removing a least significant bit of the extracted time stamp information with a mask bit, and (d) setting the encoded data and the timestamp information set by the data- (OR) arithmetic operation to store data in the data hidden area.

In this case, the data is encoded as an ASCII code or Unicode as a character.

Also, the lowest interval bit is the lowest 8 bits or 16 bits.

It is also a step of extracting time stamp information of any one of generation time, modification time, MFT entry modification time, and access time from the standard information property ($ STANDARD_INFORMATION) and the file name ($ FILE_NAME) .

In addition, the encoded data is divided to be stored in the data-hidden area, and the time stamp information of the file and the divided data are sequentially bit-processed to sequentially store data in a plurality of time stamp information.

When the number of pieces of information of the time stamp, which is the place where the divided data is to be stored, exceeds the number of time stamps that can be extracted from the file, the time stamp information of any other file is further extracted, Information of a plurality of files from which time stamp information has been extracted is stored after performing the steps (c) and (d) with respect to the information.

It should be understood, however, that the terminology or words of the present specification and claims should not be construed in an ordinary sense or in a dictionary, and that the inventors shall not be limited to the concept of a term It should be construed in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be properly defined. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and not all of the technical ideas of the present invention are described. Therefore, It is to be understood that equivalents and modifications are possible.

According to the present invention, when certain character codes are hidden in a specific portion of a file's timestamp in a Windows file system, passwords, secret key information, and the like can be displayed without changing data (year, month, day, hour, minute, Can be safely stored without being exposed or detected.

1 is a flowchart showing a data hiding method according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described in detail with reference to the accompanying drawings.

The present invention relates to a method of safely hiding data in a computer or a mobile terminal using timestamp information of a file. Timestamp information of a Windows NTFS file system is composed of 64 bits and is counted and stored in units of 100 nanoseconds, A method for hiding data by utilizing some information of time stamps which are not displayed due to storing very precise time information more than time stamp information confirmed by attribute information or general forensic tool.

1 is a flowchart showing a data hiding method according to the present invention. Referring to FIG. 1, a data hiding method according to the present invention includes encoding (S10) data to be hidden, extracting time stamp information from an arbitrary file (S20), extracting a least significant bit (S30) of setting a data-hidden area by removing the data-hidden area with a bit mask, and storing data in the data-hidden area by performing an OR operation on the encoded data and the timestamp information set in the data-hidden area (S40 ).

The data to be hidden in step S10 of encoding the data to be hidden may be applied to various data types, such as ASCII codes encoded with 8 bits per character or Unicode encoded with 16 bits per character if the data is characters .

The step S20 of extracting the time stamp information from an arbitrary file selects any file to store data from a mobile terminal such as a terminal, a computer or a smart phone for storing data. The selected file can be selected regardless of the file type, if it is a file operated by the Windows NTFS file system. If the amount of data to be hidden is large, a plurality of files can be selected. If a plurality of files are selected, the file order in which data is stored is stored as separate data. When the file is selected, the time stamp information of the file is extracted. The time stamp is divided into an attribute group SI and a name group FN for information on a file creation time Tc, a modification time Tw, an MFT modification time Te, and a read time Ta. That is, four kinds of information (Tc, Tw, Te, Ta), which is the attribute time of the file information ($ FILE_NAME) and four pieces of information (Tc, Tw, Te, Ta) Respectively.

The step S30 of removing the least significant bit of the extracted time stamp information with a mask bit to set a data hidden area is a step of selecting a least significant bit (LSB) 8 bits or 16 bits To " 0 " so that the encoded data can be stored. To do this, logical AND (AND) is performed with mask bits of 0xFFFFFFFFFFFFFF00 (for storing in the lowermost 8 bits) or 0xFFFFFFFFFFFF0000 (for storing in the lowermost 16 bits). Here, it is preferable that the lowest-order interval bit of the removed time stamp information is 16 bits or less so as not to cause a change of more than the time stamp SEC information.

Next, a step (S40) of performing bitwise OR (OR) operation between the encoded data and the time stamp information set in the data-hidden area to store the data in the data-hidden area is performed in a step S40, The method comprising the steps of: if the length of the encoded data is equal to or less than the data hidden area (e.g., the encoded data is 16 bits or 8 bits and the data hidden area is 16 bits) Data is ORed with the time stamp information and stored in the data hidden area of any extracted time stamp information. If the length of the encoded data is larger than the data-hidden area (for example, when the encoded data is 128 bits and the data-hidden area is 16 bits), the encoded data may be the same length as the data- (Eight pieces of information), and time stamp information (four pieces of information Tc, Tw, Te, Ta from the standard information and file name of the corresponding file) extracted by the number of divided data files (eight pieces) (Eight time stamp information in total) and the divided data are sequentially subjected to OR operation, thereby sequentially storing the data in a plurality of time stamp information. On the other hand, if the number of data files divided by the data hidden area length exceeds the number of time stamp information (8 pieces) that can be extracted from the file (for example, the encoded data is 256 bits and the data hidden area is 16 bits , The time stamp information of any other file is extracted and the same step is performed. That is, after a data-hidden area is set in the time stamp information from an arbitrary other file, the data not stored in the time stamp information of the previous file and the time stamp information of the other file are ORed, / RTI > At this time, the plurality of file information from which the time stamp information is extracted is stored as separate data.

Hereinafter, a data hiding method according to the present invention will be described in detail.

<< Examples >>

In this embodiment, the following experiment was performed so as to hide the string data "Hello hide world" on a computer running Windows.

- Operating System: Windows 7 Ultimate K Service Pack 1

- Disk format: NTFS v3.1

- Storage drive: Samsung SSD

- Storage space: 1TB

- Disk allocation cluster size: 4,096 bytes

- working directory: c: \ timestompTest

- Test file: TimestampHideTest.txt

- Hidden data: "Hello hide world"

First, we encode the string "Hello hide world", which is the data we want to hide, into 128-bit ASCII code as follows.

<Data encoding> data H e l l o (space) h i Binary code (hexadecimal) Ox48 Ox65 Ox6C Ox6C Ox6F Ox20 Ox68 Ox69

<Data encoding> data d e (space) w o r l d Binary code (hexadecimal) Ox64 Ox65 Ox20 Ox77 Ox6F Ox72 Ox6C Ox64

Then, a test file (TimestampHideTest.txt) is selected as a file to store the encoded 128-bit data, and the following time stamp information is extracted.

<< First timestamp information of test file >>

<Standard information property>

- Creation time: 01 D1 73 05 31 6D DC 79

- Correction time: 01 CA 11 A4 B2 78 08 00

- MFT modification time: 01 D1 C6 47 5A 46 76 94

- Reading time: 01 D1 73 05 31 6D DC 79

<File name property>

- Creation time: 01 D1 73 05 31 6D DC 79

- Correction time: 01 CA 11 A4 B2 78 08 00

- MFT modification time: 01 D1 C6 47 5A 46 76 94

- Reading time: 01 D1 73 05 31 6D DC 79

Then, the file attribute information of the selected test file (TimestampHideTest.txt) was confirmed as follows using a window program.

            <Property information of the window program for the initial test file>

Then, the extracted eight pieces of time stamp information are subjected to AND operation with mask bits of 0xFFFFFFFFFFFF0000, and the least significant 16 bits of each time stamp information are all set to '0' as shown below to set a hidden area of data.

<< Timestamp information with the lowest 16-bit information removed >>

<Standard information property>

- Creation time: 01 D1 73 05 31 6D 00 00

- Correction time: 01 CA 11 A4 B2 78 00 00

- MFT modification time: 01 D1 C6 47 5A 46 00 00

- Reading time: 01 D1 73 05 31 6D 00 00

<File name property>

- Creation time: 01 D1 73 05 31 6D 00 00

- Correction time: 01 CA 11 A4 B2 78 00 00

- MFT modification time: 01 D1 C6 47 5A 46 00 00

- Reading time: 01 D1 73 05 31 6D 00 00

The encoded data and the time stamp information in which the least significant 16 bits have been removed are ORed. The data consists of 16 characters ('H', 'e', 'l', 'l', 'o', 'space', 'h', 'i', 'd', 'e' (Ox48 ',' Ox65 ',' Ox6C ',' Ox6C ',' Ox6F ', and' Ox6F ') encoded in the address space', 'w', 'o', 'r' , The data-hidden area is set to 'Ox20', 'Ox68', 'Ox69', 'Ox64', 'Ox65', 'Ox20', 'Ox77', 'Ox6F', 'Ox72', 'Ox6C', 'Ox64' Length of 16 bits and divided into 8 data files in order. The eight divided data files are ORed with the eight timestamp information in order to sequentially store the data in the timestamp information. Here, the order of the time stamp information stored in accordance with the string order as data is stored as separate data, and the calculated time stamp information is as follows.

<< Timestamp information computed by ORing with data >>

<Standard information ($ STANDARD_INFORMATION) property>

- Creation time: 01 D1 73 05 31 6D 65 48

- Correction time: 01 CA 11 A4 B2 78 6C 6C

- MFT modification time: 01 D1 C6 47 5A 46 20 6F

- Reading time: 01 D1 73 05 31 6D 69 68

<File name ($ FILE_NAME) property>

- Creation time: 01 D1 73 05 31 6D 65 64

- Correction time: 01 CA 11 A4 B2 78 77 20

- MFT modification time: 01 D1 C6 47 5A 46 72 6F

- Reading time: 01 D1 73 05 31 6D 64 6C

The lowest 16 bits of the above timestamp are encoded two character data, and the eight timestamp information stored is the sequence of characters ('H', 'e', 'l', 'l', 'o', ' data can be stored in the form of 'space', 'h', 'i', 'd', 'e', 'space', 'w', 'o', 'r', 'l', 'd' . The file attribute information of the test file in which the data is stored was confirmed using the window program as follows.

<Property information of the window program for the test file in which the data is stored>

When comparing the file property information according to the window program of the initial test file with the test file where the data is stored, the date of creation of the test file (Feb. 29, 2013, 3:23:51 pm), the modification date Day, 6:04 am) and the access date (February 29, 2016, 3:23:51 pm) was the same. This is because the least significant 16 bits of the timestamp in which the data is stored are changed, and the upper 48 bits are the same as the initial data. Accordingly, even if the data to be hidden is stored in the time stamp information of the test file, it is possible to safely store the data without being exposed to the outside.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. It is therefore intended that such variations and modifications fall within the scope of the appended claims.

S10: encoding the data
S20: Step of extracting file stamp information
S30: Set the lower bit section of the file stamp as a data-hidden area
S40: storing the encoded data in the data-hidden area

Claims (6)

A method for hiding data using timestamp information of a file in a Windows file system,
(a) encoding data to be hidden;
(b) extracting time stamp information from an arbitrary file;
(c) setting a data-hidden area by removing the lowest-order bit information of the extracted time stamp information with a mask bit; And
(d) storing data in the data-hidden area by performing an OR operation on the encoded data and time stamp information set in the data-hidden area, and storing the data in the data- . The method according to claim 1,
Wherein the data is encoded as ASCII code or Unicode as a character. 3. The method of claim 2,
And the lowest interval bit is the lowest 8 bits or 16 bits. The method according to claim 1,
Wherein the extracting of the time stamp information comprises:
The modification time, the MFT entry modification time, and the access time from the standard information attribute ($ STANDARD_INFORMATION) and the file name ($ FILE_NAME) attribute of the file, respectively Data Hiding Method Using Time Stamp Information. 5. The method of claim 4,
And storing the encoded data in the data-hidden area, wherein the time stamp information and the divided data are sequentially bit-processed in order to store the data in a plurality of time stamp information in order. How to hide used data. 6. The method of claim 5,
If the number of pieces of information of the time stamp, which is the place where the divided data is to be stored, exceeds the number of time stamps that can be extracted from the file, further extracts time stamp information of another arbitrary file, Storing a plurality of pieces of file information from which time stamp information is extracted after performing the steps (c) and (d).

Images