TWI488066B - System and method to prevent confidential documents from being encrypted and delivered out - Google Patents

Description

Protection method to prevent files from being leaked in encrypted form

The invention is a protection method for preventing files from being leaked in an encrypted form, and is mainly applied to a Data Leakage Prevention system. When the confidentiality protection system performs the content analysis of the file, if the user's file has been encrypted and then transmitted, the confidentiality protection system cannot theoretically analyze the content of the ciphertext and decide how to control it. The invention proposes a solution to prevent confidential documents from being leaked in an encrypted form, and belongs to the core technology in the field of confidential protection.

The confidentiality protection system needs to analyze the content of the file to determine whether to allow users to transfer these files. However, if the user first encrypts the file and then transmits it to the outside, the confidentiality protection system cannot theoretically perform content analysis on the ciphertext. Some confidentiality protection systems use a comprehensive monitoring method that prohibits the transmission of suspected ciphertext files, but this involves the identification of many ciphertext formats and also limits the functionality and convenience of the user's application system. The patent monitors the encryption and compression behavior of the user from the bottom of the system, and prevents the confidential file from being leaked by the user in an encrypted form, and does not affect the function and convenience of the user's application system.

Other conventional techniques for preventing leakage of confidential files, such as China Patent Publication No. 343301, "Information Security System and Method for Tracking Information Outflow Status", proposes to use different security policies to implement different data protection methods. The key point is that as long as the internal data of the enterprise is to be outflowed, the user terminal must be connected to a specific monitoring server to obtain the authorization before being released, or the server can transcode the data and then transmit the fake data. This method requires the server to respond immediately to the needs of the user, increasing the load on the internal network of the enterprise and affecting the speed and quality of the network service. Installation of maintenance and protection of specific servo systems can prevent the leakage of confidential information.

In addition, in China Patent Publication No. 200839549, "A Method for Tracking Files Outflow", it can be found that there are several similar technical ideas in this case. However, the case utilizes the file name of the file, the file size, and the file segment string comparison method to solve the problem that the prior art cannot immediately track and quickly find the relevant leak file and leaker. Another purpose is to prevent the user from using the files that should not be held to carry out illegal acts or the outflow of confidential files to achieve the function of tracking, supervising and managing files. However, this case is not as disclosed in this patent for the user to encrypt the file and then send it out. In theory, if the file transmitted by the user has been encrypted, any confidential protection system will be difficult to access the secret. The content of the text is analyzed and controlled. The invention proposes a solution for monitoring the encryption behavior of the user from the bottom of the system, and can control the confidential file to be encrypted by the application program at the first time, thereby improving the efficiency of the confidential protection operation and the application system function surface.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in researching and developing the protection method for preventing the file from being leaked in encrypted form.

The purpose of the patent of the present invention is to establish a protection method for preventing files from being leaked in an encrypted form, and is mainly applied to a confidential protection system. When the user first encrypts the confidential file and then transmits the ciphertext, the confidentiality protection system cannot theoretically analyze and control the content of the ciphertext file. The present invention proposes a solution to prevent the confidential file from being encrypted. The form is leaked and does not limit the functionality and usability of the application.

When conducting confidential monitoring operations, the confidential protection system must be able to correctly determine whether the contents of a document contain the confidentiality defined by the policy for execution. Proper protective work. However, in the content analysis of the file file, if the file transmitted by the user has been encrypted, theoretically, the confidentiality protection system cannot perform content analysis and subsequent control operations on the ciphertext file.

The invention provides a protection method for preventing a file from being leaked in an encrypted form. The confidential monitoring method first performs an application interface hook (API Hook) processing on a target thread, and the hooked API is a system related to file read and write behavior. APIs, such as the ReadFile and WriteFile APIs of kernel32.dll, are placed in the application software to install these hooks for monitoring. Once a thread reads a confidential file, the system of the present invention enters a protection state for preventing encrypted write files. In this state, all the actions of the thread to write the file are analyzed to determine whether the program encrypts and transcodes the confidential file and writes the ciphertext file. If the analysis result is that the thread has performed the operation of encrypting the file, The system of the present invention will perform protection operations such as warning, re-encryption, deletion, auditing, etc. according to the confidentiality protection policy, so that the application can prevent the application from encrypting the confidential file in the first time, thereby preventing the user from subsequently transmitting the confidentiality. Monitoring problems in dense documents, in order to be able to identify a large number of encrypted file formats for proper protection The present invention employs a comprehensive analysis of the information entropy, and a method based on the comparison file, the ciphertext can be effectively determined file format most encryption algorithms generated.

A protection method for preventing a file from being leaked in an encrypted form is a content analysis and an endpoint monitoring operation of the confidential protection system, wherein the method for monitoring the operation of the endpoint includes the following steps: Step a. When the confidential protection system detects the use When the application is enabled, a dynamic library that monitors the secret is loaded, and the application interface hook associated with the file is read and written; step b. When the application interface is placed, the application is detected. When the program reads the file, it notifies a confidential protection program through the inter-program communication channel to perform the content analysis operation of the file to determine whether the application encrypts the confidential file. Behavior; Step c. When receiving the content analysis result returned by the confidential protection system, the application allows the file to be read and written if it is a non-confidential file, and enters the file monitoring state for the confidential file; The application will analyze the format of all written files in the file monitoring state. If it is determined to be an encrypted format, the corresponding protection operation is performed according to the confidentiality policy.

The confidentiality protection program is a resident program pre-installed in the user's computer system, and is responsible for the policy loading and execution of the confidential protection system, the content analysis, the audit recording operation, and the application interface associated with the file reading and writing. Refers to the application interface hooking technology, the operating system library necessary for the application to read files and write out the file job, intervening to perform additional monitoring processing, the application interface hooks, read in the application When the file is taken, the monitoring process of the hook is entered. The monitoring process notifies the confidential protection program by using the inter-program communication channel, requests the confidential protection program to perform the content analysis operation of the target file, and obtains the analysis result, the application interface. When the hook is in control of the encrypted write file, when the inter-program communication pipeline receives the content analysis result returned by the secret protection system, if the target file is not a confidential file, the file is read and written by the program, and no protection is performed. If it is a confidential file, enter the file monitoring state, the application When entering the file monitoring state, all the formats of the written files will be analyzed. If it is determined to be the encrypted format, the corresponding protection operations, including auditing, warning, re-encrypting or deleting the file operations, may be performed according to the confidentiality policy. The written file is not in the encrypted format, and the file is read and written by the program without any protection. The method for analyzing whether the file is in an encrypted format is based on the comparison of the information entropy value and the file length. To: a. Check and filter the file written by the application as the original file, so as not to misjudge the ciphertext format; b. Check and filter the file written by the application as Base64 encoding, so as to avoid misjudging the ciphertext format. ;c. Calculate the entropy value of the written file content, if the entropy value is lower than a certain threshold, it is regarded as a non-encrypted format; d. If the entropy value of the file content is higher than the Threshold value, further analyze whether the file content is a commonly used compression format to avoid a situation in which the compression format causes misjudgment; e. If the file content is not a compressed format, then perform comparison analysis of the file content length to determine the write Whether the file content is in an encrypted format.

The method for performing the comparison analysis according to the length of the file content is as follows: a. calculating the compressed length of the original file content as a reference value; b. performing comparison with the length of the written file; c. The length of the ciphertext file of the reference is: a specific multiple of the length of the original file content, and a specific multiple of the length of the original file content, both of which are ciphertext lengths; d. if the length of the written file matches the length If the length of the ciphertext file is determined, the written file is judged to be in cipher text format, otherwise it is in non-cipher text format.

The protection method for preventing the file from being leaked in an encrypted form provided by the present invention has the following advantages when compared with the foregoing cited documents and other conventional techniques:

1. The protection method for preventing the file from being leaked in an encrypted form according to the present invention performs the protection operation at the first time when the application encrypts the confidential file, thereby avoiding the monitoring problem when the subsequent user transmits the confidential document.

2. The protection method for preventing the file from being leaked in an encrypted form of the present invention does not limit the function and convenience of the user's application system.

3. The protection method for preventing leakage of files in encrypted form according to the present invention adopts a comprehensive analysis method based on information entropy value and file comparison, which can effectively judge the ciphertext file format generated by most encryption algorithms.

Please refer to FIG. 1 , which is a system architecture diagram of a protection method for preventing a file from being leaked in an encrypted form. As can be seen from the figure, the user 110 operates the computer system. At 150 o'clock, the enabled encryption application 130 reads the confidential file 120 and performs the transcoding and encryption operation. When the encryption application 130 is started, the confidential monitoring dynamic library 160 of the present invention is loaded first, and the loading mode can be loaded. The dynamics of the encryption application 130 is preset by the mechanism provided by the operating system or by the confidential protection system program 180 continuously monitoring the startup of all programs and being placed by the remote. When the encryption application 130 reads a certain confidential file 120, it is preset to the dynamic application of the encrypted application 130. The API hook monitored by the library 160, that is, the confidential protection system program 180 is notified by means of Inter Process Communication, and the content analysis of the file is performed, so that the encryption application 130 determines whether the file containing the confidential content has been read. However, it is necessary to enter the protection state of the encrypted write file. If the encryption application 130 writes out a certain file 140 in this protection state, the application 130 will immediately analyze whether the written file 140 is an encrypted file, if it is judged. To encrypt the file, delete the file 140 as shown in the confidential protection policy, or perform re-encryption, isolation, auditing and other protection operations. Program secret protection system 180 of this event record is uploaded to a server end 170 confidential management center audit management.

Please refer to FIG. 2, which is a flow chart of the encryption application monitoring method for preventing the file from being leaked in an encrypted form. When the system detects that the encrypted application starts 200, it enters the processing process of detection and analysis, firstly, The file read/write job related API hook setting 210 is used to monitor the subsequent encrypted write file related behavior. When the thread reads a file 220, the file related API hook, such as Kernel32.dll ReadFile, is immediately The confidential protection program will be notified to the content analysis of the file by means of a named pipeline (230). If the result of the file analysis is inorganic confidential content 231, the protection of the encrypted file is not required, and the application can continue to complete its file. The read/write job 270, if the analysis result indicates that the file that has been read is the confidential file 321, the monitoring of the application writing job is performed 240, and then if the application has any behavior of writing the file 250, then write File-related API hooks, such as Kernel32.dll's WriteFile and CloseHandle will first find the file and path name and then proceed Whether it is the analysis of the general file format 251 or the encrypted file 252, if the analysis result 251 indicates that the written file is in the general file format, the operation 270 of the file reading and writing can be continued, if not the general file format 252, Whether it is the analysis of the encrypted file 252, and the related protection operations 260 such as warning, re-encryption, auditing or deletion are performed according to the confidential protection policy. If the result 251 of the file analysis is not in ciphertext format, no protection is required and the application can continue to complete its file read and write operation 270.

Please refer to FIG. 3, which is a flow chart of analyzing the ciphertext format of the protection method for preventing the file from being leaked in an encrypted form. First, the file content 300 that has been written is read, and then the content is compared with the original file. If the content of the two is the same, it means that the ciphertext format 311 is not returned to the False value 380 and the analysis process of the ciphertext format is ended. Otherwise, it is determined whether the file content is the Base64 encoding format 311, and if the Base64 encoding format 312 is decoded. The job 320 then returns to the above-mentioned file content comparison process 310. If it is not the Base64 encoding format 312, the data content entropy value 330 is calculated. The entropy value is based on Information Theory regarding uncertainty (Uncertainty The mathematical metrics are as follows:

The unit indicates that the unit is usually bits/byte, the minimum value approaches 0, and the maximum value approaches 8. The present invention applies the judgment to the ciphertext file format. Generally speaking, if the calculated entropy value is high, it represents The coding combination of the file content is quite random, and it is difficult to further compress the file content. Most ciphertext files, compressed files or multimedia files and files are files with high entropy values, if the calculation result The entropy value of the file content is less than the default threshold value 331, for example, less than 7.0, the False value 380 is returned to end the analysis process of the ciphertext format, and if the entropy value of the file content is greater than the default threshold 331, For the analysis of general compression formats 332, the so-called general compression format It refers to the common file compression format such as ZIP, GZIP, RAR, ARJ, LZH, etc. When it is judged that the file content is compressed, it is further analyzed whether it belongs to the compressed encryption format 333. If the analysis result is not the compressed encryption format, the False value is returned. 360, otherwise, returning the True value ends the ciphertext format analysis process 370; if it is determined that the file content is not the general compression format 332, then the comparison with the original file content is continued, where the file length comparison 350 is used to further Determining whether the content of the written file content is cipher text format 351, which is based on the length of the ciphertext file produced by the general encryption algorithm, usually equal to or slightly larger than the original plaintext file length Lo, but because of many encryption programs The compression function will be integrated, and the length of the ciphertext file is smaller than the original file length. Therefore, the method also needs to calculate the length Lc of the original file content to perform the standard ZIP compression as the reference value 340, and as a reference. The possible length of the ciphertext Le can be defined as: 0.8 times the compressed length Lc of the original file content to about 1.3 times of the Lc, and the original About 1.1 to text length Lo Lo, both of which are possible ciphertexts Le. When the length of the written file content is not the above two possible ciphertext lengths, the False value 380 is returned to the end of the process. If the ciphertext length is ciphertext format, the cipher text format is returned and the cipher text format is terminated. Process.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

110‧‧‧Users

120‧‧‧Confidential documents

130‧‧‧Encryption application

140‧‧‧Files

150‧‧‧ computer system

160‧‧‧Dynamic Library

170‧‧‧Confidential Management Center

180‧‧‧Confidential Protection System Program

200 ^~ 260‧‧‧Encrypted application monitoring process

300 ^~ 380‧‧‧ ciphertext format analysis process

Please refer to the detailed description of the present invention and the accompanying drawings, which can further understand the technical content of the present invention and its function. The related drawings are: FIG. 1 is a system architecture of the protection method for preventing the file from being leaked in an encrypted form. Figure.

2 is a flow chart of the encryption application monitoring of the protection method for preventing the file from being leaked in an encrypted form according to the present invention.

FIG. 3 is a flow chart of analyzing a ciphertext format of a method for preventing a file from being leaked in an encrypted form.

110‧‧‧Users

120‧‧‧Confidential documents

130‧‧‧Encryption application

140‧‧‧Files

150‧‧‧ computer system

160‧‧‧Dynamic Library

170‧‧‧Confidential Management Center

Claims (8)

A protection method for preventing a file from being leaked in an encrypted form is a content analysis and an endpoint monitoring operation of the confidential protection system, wherein the method for monitoring the operation of the endpoint includes the following steps: Step a. When the confidential protection system detects the use When the application is enabled, a dynamic library that monitors the secret is loaded, and the application interface hook associated with the file is read and written; step b. When the application interface is placed, the application is detected. When the program reads the file, it notifies a confidential protection program through the inter-program communication channel to perform the content analysis operation of the file to determine whether the application has the function of encrypting the confidential file; step c. the application receives When the result of the content analysis returned by the confidential protection system, if it is a non-confidential file, it is allowed to continue the file reading and writing operation, and for the confidential file, it enters the writing file monitoring state; step d. The application is in the writing file monitoring state. The lieutenant will analyze the format of all written files. If it is judged to be an encrypted format, the corresponding protection work shall be carried out in accordance with the confidentiality policy. The protection method for preventing the file from being leaked in an encrypted form as described in the first paragraph of the patent application, wherein the confidential protection program is a resident program pre-installed in the user's computer system, and is responsible for the policy loading of the confidential protection system. Execution, content analysis, audit record operations. For example, the protection method for preventing the file from being leaked in an encrypted form as described in the first application of the patent scope, wherein the file interface is related to the application interface of the file. Refers to the application interface hooking technology, for the application to read the file, write the file system job must use the operating system library, intervene for additional monitoring processing. The protection method for preventing the file from being leaked in an encrypted form as described in the first aspect of the patent application, wherein the application interface is hooked, and when the application reads the file, the monitoring process of the hook is entered, and the monitoring process is The confidentiality protection program is notified by the inter-program communication pipeline, and the confidential protection program is requested to perform the content analysis operation of the target file, and the analysis result is obtained. The protection method for preventing the file from being leaked in an encrypted form as described in the first aspect of the patent application, wherein the application interface hook receives the content returned by the confidential protection system when controlling the encrypted write file. As a result, if the target file is not a confidential file, the file of the program is read and written without any protection, and if it is a confidential file, the file is monitored. The protection method for preventing the file from being leaked in an encrypted form as described in claim 5, wherein the application analyzes the format of all the written files when entering the file monitoring state, and if it is determined to be an encrypted format, According to the confidentiality policy, the corresponding protection operations, including auditing, warning, re-encryption or deletion of file operations, if the written file is not in an encrypted format, continue to read and write the file of the program without any protection. The method for preventing the file from being leaked in an encrypted form as described in claim 6 of the patent application scope, wherein the method for analyzing whether the file is an encrypted format is based on an analysis of the information entropy value and the file length, and the steps are: a. Check and filter the file written by the application as the original file, so as not to misjudge the cipher text format; b. Check and filter the file written by the application as Base64 encoding to avoid misjudging the ciphertext format; c. Calculate the entropy value of the written file content, if the entropy value is lower than a certain threshold value, it is regarded as Non-encrypted format; d. If the entropy value of the file content is higher than the threshold, further analyze whether the file content is a commonly used compression format to avoid a situation in which the compressed format causes misjudgment; e. if the file content is not a compressed format Then, the comparison analysis of the length of the file content is performed to determine whether the written file content is in an encrypted format. The method for preventing the file from being leaked in an encrypted form as described in claim 7, wherein the method for performing the comparison analysis according to the length of the file content is as follows: a. calculating the compressed length of the original file content as a reference value; b. performing a comparison with the length of the written file; c. the length of the ciphertext file as the comparison reference is: a specific multiple range of the length of the original file content after compression, and a specific multiple range of the length of the original file content, All are ciphertext lengths; d. If the length of the written file matches the length of the ciphertext file, it is judged that the written file is in cipher text format, otherwise it is a non-cipher text format.