1331722 九、發明說明： 【發明所屬之技術領域】 本發明係有關於一種保密方法，特別是運用一保密 策略對特定操作過程之任意類型檔案進行加密保護及利 用一權限讀取以對加密檔案進行保密方式之操作。 【先前技術】 在現今資訊數位化的時代，許多的個人私密訊息與 重要的組織訊息大多藉由電腦加以處理與儲存，因此電腦 資訊安全的重要性日趨增加。習知技術中關於電腦資訊系 統安全性的方法包括訪問控制表、群組控制、用戶身份認 證等，各有其特點，如美國專利公告第5991751號專利「多 層安全性評估系統及方法」（Method and apparatus for multi-level security evaluation)，揭露一種結合各種單一方 法，如訪問控制表、群組控制等，利用各方法在系統處理 速率上之優點提供一種提昇安全處理速度的系統及方 法，該系統將用戶分為各種擁有不同權限之等級；同時將 系統資源對應用戶類別也分為多類，然後依據一定規則來 選擇一適當的方法判斷系統訪問請求是否允許。此外，中 華民國專利公告第486629、494344及583559號，皆揭露 數種權限安全管理系統與方法，請參閱第丨圖，第1圖係 為習知技術流程圖，習知技術之架構可略述如下：首先設 定權限規則（S10)，其中，該權限規則係限定使用者之操 作動作，隨後讀取使用者權限與權限規則（S11)，當使用 者開始進行一操作動作時(S12)，先由電腦判別使用者之 權限是否足以進行該操作動作（S13)，若使用者之權限充1331722 IX. Description of the invention: [Technical field of the invention] The present invention relates to a security method, in particular, using a privacy policy to encrypt and protect any type of file in a specific operation process and using a permission read to perform an encrypted file. Operation of confidentiality methods. [Prior Art] In the era of digital information, many personal and important organizational messages are processed and stored by computers. Therefore, the importance of computer information security is increasing. The methods for the security of computer information systems in the prior art include access control lists, group control, user identity authentication, etc., each having its own characteristics, such as the "Multilayer Security Evaluation System and Method" of the US Patent Publication No. 5991751 (Method) And apparatus for multi-level security evaluation), discloses a system and method for improving security processing speed by combining various single methods, such as access control list, group control, etc., by utilizing the advantages of each method in system processing rate. The user is divided into various levels with different rights; at the same time, the system resources are divided into multiple categories, and then an appropriate method is selected according to certain rules to determine whether the system access request is allowed. In addition, the Republic of China Patent Publication Nos. 486629, 494344, and 583559 disclose several types of rights security management systems and methods. Please refer to the drawings. Figure 1 is a flow chart of a prior art, and the architecture of the prior art can be outlined. As follows: First, a permission rule (S10) is set, wherein the permission rule defines an operation action of the user, and then the user authority and the permission rule are read (S11), when the user starts an operation action (S12), first It is determined by the computer whether the authority of the user is sufficient for the operation (S13), and if the user's authority is charged
5 程e ，並告知使用者權限不足，結束流 ‘、、、而右是當權限足夠之使用者將應保密資訊外流 * 1無法對所有的外流資訊進行保護，因此許多高保密 =公司團體及組織皆禁止連接外接儲存裝置，以避免資 1步机次但此方式會訝使用者造成資訊傳輸上的不便，若 =兩^訊下載或外傳料料，則需運用特定方式在特 2腦上進行資訊下栽與外傳，且若是在大量使用者需經 方式進行m與外傳時，㈣影響工作效率，並增 加公司團體及組織整體在資訊操作之負擔。 9 習知技術中相關於資訊安全管理方法係採用權限控 =之方式，於資訊下載與外傳之f求卻可能無法提供全 面而完整解決方案。因此，提供—種完善的資訊安全管理 方法已有極為迫切之需求。 【發明内容】 本發明之主要目的係在於提供一種資訊安全 法，係運用保密策略以對特定操作過程之檔 護’並可運用隱藏模式讓加密保護之過程不顯示於使= 之操作畫面’減少錢者操作上之錢，並能有效 心人士對加密保護過程之破壞。 句 本發明之另一目的係在於提供一種資訊安 法，係讀取使用者權限以保護加密檔案，當 ^方 以對加密檔案進行解密操作時，對已完 ^權限足 稽案再次進行加密，使檔案得到完整保i，/作之加密 並可運用隱藏 1331722 模式讓解密操作與再次加密之過程不顯示於使用者之操 作晝面，減少使用者操作上之不便，並能有效防止有心人 士對加密保護過程之破壞。 本發明提供一種資訊安全加密方法，首先由系統管 理者預先設定一保密策略，該保密策略内具有複數個加密 規則，該加密規則用以對一檔案操作過程進行控制，隨後 藉由連線方式使一保密系統内的電腦擁有該保密策略，當 使用者開始對一未加密檔案執行一項操作時，則判別該項 操作是否合乎該保密策略内之該加密規則，若該項操作並 不合乎該加密規則，則結束加密流程，讓使用者自由進行 該項操作；若該項操作合乎該加密規則，則在使用者完成 該項操作後，對該未加密檔案進行加密保護，使該未加密 檔案轉換為一加密檔案，最後將該加密檔案進行存檔動 作。 本發明亦提供一種資訊安全解密方法，首先使用者 經由一認證程序以登入該保密系統内的電腦，並藉由該認 證程序以讀取使用者之權限，當使用者開始對該加密檔案 進行操作時，則判別使用者之權限是否足以對該加密檔案 進行解密；若使用者之權限不足以對該加密檔案進行解 密，則告知使用者權限不足以讀取該加密檔案，並結束解 密流程；若使用者之權限足以對該加密檔案進行解密，則 對該加密檔案進行解密動作，使該加密檔案轉換為一解密 檔案，接著讓使用者自由對該解密檔案執行-檔案搡作， 待使用者完成該檔案操作後，則對該解密檔案進行加密保 護，使該解密檔案轉換為一新加密檔案，最後將該新加密 檔案進行存檔動作。5 process e, and inform the user that the authority is insufficient, the end of the flow ',, and right is when the user with sufficient authority will be out of confidential information * 1 can not protect all outflow information, so many high security = company groups and Organizations are forbidden to connect external storage devices to avoid the 1st step, but this method will surprise users of the inconvenience of information transmission. If the two downloads or the external materials are used, the specific method should be used on the special brain. Information is downloaded and circulated, and if a large number of users need to conduct m and rumor, (4) affect work efficiency and increase the burden of information operations of the company group and the organization as a whole. 9 In the prior art, the information security management method is based on the method of privilege control = the information download and the rumor may not provide a comprehensive and complete solution. Therefore, there is an urgent need to provide a comprehensive approach to information security management. SUMMARY OF THE INVENTION The main object of the present invention is to provide an information security method, which uses a privacy policy to protect a specific operation process and can use the hidden mode to reduce the process of encryption protection from being displayed on the operation screen of =. The money is operated by the money, and the effective person can destroy the encryption protection process. Another object of the present invention is to provide an information security method for reading user rights to protect encrypted files. When the party decrypts the encrypted file, the encrypted file is encrypted again. The file is completely protected, encrypted, and the hidden 1331722 mode can be used to prevent the decryption operation and the re-encryption process from being displayed on the user's operation, thereby reducing the inconvenience of the user's operation and effectively preventing the interested person from The destruction of the encryption protection process. The present invention provides an information security encryption method. First, a security policy is preset by a system administrator. The security policy has a plurality of encryption rules for controlling a file operation process, and then is connected by a connection method. A computer in a secure system has the privacy policy. When the user starts an operation on an unencrypted file, it determines whether the operation conforms to the encryption rule in the privacy policy, and if the operation does not meet the Encryption rule, the encryption process is ended, and the user is free to perform the operation; if the operation conforms to the encryption rule, after the user completes the operation, the unencrypted file is encrypted and protected, so that the unencrypted file is encrypted. Convert to an encrypted file, and finally archive the encrypted file. The present invention also provides an information security decryption method. First, a user logs in to a computer in the security system via an authentication program, and the user searches for the encrypted file by the authentication program. When it is determined whether the user's authority is sufficient to decrypt the encrypted file; if the user's authority is insufficient to decrypt the encrypted file, the user is notified that the authority is insufficient to read the encrypted file, and the decryption process is ended; If the user's authority is sufficient to decrypt the encrypted file, the encrypted file is decrypted, the encrypted file is converted into a decrypted file, and then the user is allowed to perform the file-free operation on the decrypted file, and the user completes the file. After the file is operated, the decrypted file is encrypted and protected, the decrypted file is converted into a new encrypted file, and finally the new encrypted file is archived.
7 1331722 爲使熟悉該項技藝人士瞭解本發明之目的、特徵及 功效，茲藉由下述具體實施例，並配合所附之圖式，對本 發明詳加說明如後： 【實施方式】 請參閱第2圖，第2圖係為本發明一較佳實施例之 流程圖一。本發明提供一種資訊安全加密方法，首先由系 統管理者預先設定一保密策略（S20)，該保密策略内具有 ^ 複數個加密規則，該加密規則可對特定類型檔案進行加 密、對所有傳輸至外接式儲存裝置之檔案進行加密或對特 定名稱檔案進行加密等等，隨後藉由連線方式使一保密系 統内的電腦擁有該保密策略（S21)，當使用者開始對一未 加密檔案執行一項操作時(S22)，其中，該項操作包含讀 取、編輯、修改等動作，則判別該項操作是否合乎該保密 策略内之該加密規則（S23)，若該項操作並不合乎該加密 規則，則結束本發明資訊安全加密方法之流程，讓使用者 自由進行該項操作；若該項操作合乎該加密規則，則在使 • 用者完成該項操作後，對該未加密檔案進行加密保護 (S24)，使該未加密檔案轉換為一加密檔案，最後將該加 密檔案進行存檔動作（S25)。 此外，本發明另提供一種電腦可讀取之記錄媒體， 其記錄一種資訊安全加密方法，首先由系統管理者預先設 定一保密策略，該保密策略内具有複數個加密規則，該加 密規則用以對一檔案操作過程進行控制，隨後藉由連線方 式使一保密系統内的電腦擁有該保密策略，當使用者開始 對一未加密檔案執行一項操作時，其中，該項操作包含讀 8 1331722 ΐ略Γ、修改等動作’㈣別該項操作是否合乎該保密 策略内之該加密規則，若該項操作 β ^ m έ, 口乎該加密規則， 2加“程，讓使用者自由進行朗 作合乎該加密規則，則在使用者U 孭徕 加密梓宏m吃者7°成該項操作後’對該未 :讀案進订加进保護，使該未加密檔案轉換為一加密檔 案，最後將該加密檔案進行存檔動作。 〜 田 P圖J參^f 3圖’第3圖為本發明-較佳實施例之流 L ΐ。亦提供—料訊安讀密方法，首先使用 者，及由-認證程序以登人該保㈣統⑽電腦並藉由該 祕程序以讀取使用者之權限_)，#使用者開始對該 加密標案進行操作時(S31) ’其中，所進行之操作包含讀 取、編輯、修改等動作’則判別使用者之權限是否足以對 該加密檔案進行解密（S32) ; ^使用者之權限不足以對該 加密槽案進行解密，㈣知使用者權限不足以讀取該加密 槽案，並結束解密流程；若使用者之權限足以對該加密檐 案進行解密，則對該加密檔案進行解密動作（S33)，使該 加密檔案轉換為一解密檔案，接著讓使用者自由對該解密 檔案執行一檔案操作（S34)，待使用者完成該檔案操作 後，則對該解密檔案進行加密保護(S35)，若該解密檔案 執行槽案操作時並無改變或進行寫入之動作，則結束解密 流程；若該解密檔案執行標案操作時改變内容或進行寫入 動作，則使該解密槽案轉換為一新加密檔案，最後將該新 加密檔案進行存檔動作（S36)。 另外，本發明又提供一種電腦可讀取之記錄媒體， 其記錄一種資訊安全解密方法，首先使用者經由一認證程 序以登入該保密系統内的電腦，並藉由該認證程序以讀取 ⑧ 9 1331722 使用者之權限，當使用者開始對該加密檔案進行操作時， 其中，所進行之操作包含讀取、編輯、修改等動作，則判 別使用者之權限是否足以對該加密檔案進行解密；若使用 者之權限不足以對該加密檔案進行解密，則告知使用者權 限不足以讀取該加密檔案，並結束解密流程；若使用者之 權限足以對該加密檔案進行解密，則對該加密檔案進行解 密動作，使該加密檔案轉換為一解密檔案，接著讓使用者 自由對該解密檔案執行-檔案操作，待使用者完成該檔案 操作後，則對該解密檔案進行加密保護，若該解密檔案執 行檔案操作時並無改變或進行寫入之動作，則結束解密流 程；若該解密檔案執行檔案操作時改變内容或進行寫入動 作，則使該解密檔案轉換為一新加密檔案，最後將該新加 密檔案進行存檔動作。 需注意者，上述資訊安全加密方法及資訊安全解密 方法之流程可設定為隱藏模式，讓使用者不會因檔案進行 加密保護而造成操作上的困擾，更能有效防止有心人士對 加密保護之破壞。 由於本發明之資訊安全加密方法係運用保密策略以 對特定操作過程之檔案進行加密保護，故於特定操作過 程，如資訊外流、敏感性類型檔案執行或機密檔案複製等 操作過程，皆可進行保護。且無論檔案類型為何，皆可進 行加密保護。而相較於權限控制之方式，本發明之資訊安 全加密方法能對於外流資訊進行保護，而不致於運用禁止 連接外接儲存裝置之消極方式阻礙使用者進行資訊下載 與傳輸，且本發明之資訊安全加密方法所運用之加密方式 係為自動式加密，不僅可減少使用者對檔案進行加密之不 10 1331722 便，且可防止有心人士進行檔案外流，並可搭配隱藏模式 避免對加密過程進行破壞。另外，本發明之資訊安全解密 方法係對加密檔案進行操作，且在操作完成後再次進行加 密，能防止槽案在解密操作後受到破解，而造成資訊外流 之情況，進而對檔案形成完整保護，因此本發明極具進梦 性及符合申請發明專利之要件，爰依法提出申請，析鈎 局早日賜准專利，實感德便》 以上已將本發明做一詳細說明，惟以上所述者，僅 Φ 爲本發明之一較佳實施例而已，當不能限定本發明實施之 範圍。即凡依本發明申請範圍所作之均等變化與修飾等’ 皆應仍屬本發明之專利涵蓋範圍内。 【圖式簡單說明】 • 第1圖係習知技術流程圖； 第2圖係本發明一較佳實施例流程圖一； 第3圖係本發明一較佳實施例流程圖二。 φ 【主要元件符號說明】 S10設定權限規則 S11讀取使用者權限與權限規則 S12開始動作 S13判別動作 S14執行動作 S15終止動作 S20設定加密策略 S21讀取加密策略 S22開始操作 11 1331722 S23是否合乎加密規則 S24加密 S25存檔 S30讀取使用者權限 S31命令開啟加密檔案 S32判別權限是否足以解密 S33解密7 13 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 2 is a flow chart 1 of a preferred embodiment of the present invention. The invention provides an information security encryption method. First, a security policy is preset by a system administrator (S20). The security policy has a plurality of encryption rules, and the encryption rule can encrypt a specific type of file and transmit all to an external connection. The file of the storage device is encrypted or encrypted for a specific name file, etc., and then the computer in a security system has the privacy policy by connecting (S21), when the user starts executing an unencrypted file. In operation (S22), wherein the operation includes reading, editing, modifying, etc., determining whether the operation conforms to the encryption rule in the privacy policy (S23), if the operation does not comply with the encryption rule Ending the process of the information security encryption method of the present invention, allowing the user to perform the operation freely; if the operation conforms to the encryption rule, encrypting the unencrypted file after the user completes the operation (S24), the unencrypted file is converted into an encrypted file, and finally the encrypted file is archived (S25). In addition, the present invention further provides a computer readable recording medium for recording an information security encryption method. First, a security policy is preset by a system administrator, and the security policy has a plurality of encryption rules, and the encryption rule is used to A file operation process is controlled, and then the computer in a security system has the privacy policy by connecting, and when the user starts an operation on an unencrypted file, the operation includes reading 8 1331722 ΐ Skip, modify, etc. '(4) Whether the operation conforms to the encryption rule in the privacy policy, if the operation β ^ m έ, the encryption rule, 2 plus "process, let the user freely perform the operation In accordance with the encryption rule, after the user U 孭徕 encrypts the macro, the eater 7° becomes the operation, 'adds protection to the unreading, and converts the unencrypted file into an encrypted file, and finally The encrypted file is archived. ~ Field P Figure J Figure 3 Figure 3 Figure 3 is a flow chart of the preferred embodiment of the present invention. And by the -authentication procedure to board the person (4) system (10) computer and use the secret program to read the user's authority _), # user begins to operate the encrypted standard (S31) 'where The operation includes reading, editing, modifying, etc. 'determining whether the user's authority is sufficient to decrypt the encrypted file (S32); ^ the user's authority is insufficient to decrypt the encrypted slot case, and (4) knowing the user The permission is insufficient to read the encrypted slot file, and the decryption process is ended; if the user's authority is sufficient to decrypt the encrypted file, the encrypted file is decrypted (S33), and the encrypted file is converted into a decrypted file. Then, the user is free to perform a file operation on the decrypted file (S34), and after the user completes the file operation, the decrypted file is encrypted and protected (S35), and if the decrypted file performs the slot operation, there is no The action of changing or performing the writing ends the decryption process; if the decrypted file changes the content or performs the writing operation when performing the marking operation, the decrypted slot is converted into a new encrypted file. Finally, the new encrypted file is archived (S36). In addition, the present invention further provides a computer readable recording medium for recording an information security decryption method, firstly, the user logs in to the security system via an authentication program. Inside the computer, and by the authentication program to read the rights of the user of 8 9 1331722, when the user starts to operate the encrypted file, wherein the operation includes reading, editing, modifying, etc., Determining whether the user's authority is sufficient to decrypt the encrypted file; if the user's authority is insufficient to decrypt the encrypted file, the user is notified that the authority is insufficient to read the encrypted file, and the decryption process is ended; If the authority is sufficient to decrypt the encrypted file, the encrypted file is decrypted, the encrypted file is converted into a decrypted file, and then the user is free to perform the file operation on the decrypted file, after the user completes the file operation. , the decrypted file is encrypted and protected, and if the decrypted file is executed, If the action of changing or writing is performed, the decryption process is ended; if the decrypted file changes the content or performs a write operation when performing the file operation, the decrypted file is converted into a new encrypted file, and finally the new encrypted file is archived. . It should be noted that the above information security encryption method and the information security decryption method can be set to a hidden mode, so that the user does not suffer from the operation of the file encryption protection, and can effectively prevent the damage of the encryption protection. . Since the information security encryption method of the present invention uses a privacy policy to encrypt and protect a file of a specific operation process, it can be protected in a specific operation process such as information outflow, sensitive type file execution or confidential file copying. . And regardless of the file type, it can be encrypted. Compared with the method of authority control, the information security encryption method of the present invention can protect the outflow information without using the negative manner of prohibiting the connection of the external storage device to hinder the user from downloading and transmitting information, and the information security of the present invention. The encryption method used by the encryption method is automatic encryption, which not only reduces the user's encryption of the file, but also prevents the intentional person from performing file outflow, and can be used with the hidden mode to avoid damage to the encryption process. In addition, the information security decryption method of the present invention operates on the encrypted file, and performs encryption again after the operation is completed, which can prevent the slot case from being cracked after the decryption operation, thereby causing the situation of information outflow, thereby forming complete protection for the file. Therefore, the present invention is extremely dreamy and conforms to the requirements of applying for an invention patent, and the application is filed according to law, and the analysis of the patent is granted by the hook office as soon as possible. The above description has been made in detail, but the above is only Φ is a preferred embodiment of the invention and is not intended to limit the scope of the invention. That is, the equivalent changes and modifications made by the scope of the present application should remain within the scope of the patent of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS: Fig. 1 is a flow chart of a prior art; Fig. 2 is a flow chart 1 of a preferred embodiment of the present invention; and Fig. 3 is a flow chart 2 of a preferred embodiment of the present invention. φ [Description of main component symbols] S10 setting authority rule S11 reading user authority and authority rule S12 starting operation S13 determining action S14 performing action S15 terminating action S20 setting encryption policy S21 reading encryption policy S22 starting operation 11 1331722 S23 is encrypted Rule S24 Encryption S25 Archive S30 Read User Privilege S31 Command Open Encryption File S32 Determine whether the privilege is sufficient to decrypt S33 decryption
S34執行檔案操作 S35加密 S36存檔S34 performs file operations S35 encryption S36 archive
1212