TWI579726B - Method for recording operation history, and method and systme for managing information security - Google Patents

Description

Operation history recording method, and information security management method and system

The present invention relates to an information security management method, and in particular to a management method suitable for information security within an enterprise.

In today's Internet and the groundbreaking development, data acquisition has become easier. In the early days of society, when people were looking for information, they might need to go to the library to inquire about many related books before they could find relevant information. Today, however, people can get a lot of relevant information by sitting at home, linking to the portal, and typing in keywords. Although the Internet makes human life more convenient, on the other hand, the confidentiality of information is getting lower and lower.

There are two main aspects of information security management for general enterprises. One of them is to prevent foreign intrusions, such as the invasion of malicious programs or hackers. To protect against external intrusions, you can set up a firewall or install anti-virus software or anti-virus software. On the other hand, companies must also guard against the leakage of internal employees. There are two types of technologies that can be divided into two types of technologies: one is to prohibit anti-blocking and the other is to manage elastically.

The so-called prohibition of anti-blocking is to close all pipelines that may be leaked, such as prohibiting the use of external storage devices, prohibiting users from connecting to most external websites, and prohibiting the use of instant messaging software. However, such a precautionary approach sometimes causes a rebound in internal staff, which leads to low morale. In addition, it may also reduce the efficiency of the execution of the enterprise. Therefore, some enterprises currently adopt flexible management methods to prevent data leakage.

The technology of the traditional flexible management to prevent data leakage is to monitor the host from the remote end and monitor each terminal host in the enterprise. The means of monitoring includes periodically intercepting the screen displayed on the screen of the terminal host. In this way, the manager can judge whether the internal staff leaks information that is not allowed to leak from the intercepted picture.

However, this approach does not apply to large companies. Due to the large number of employees in large enterprises, the number of terminal hosts is also very large. In other words, the amount of data to be stored is very large, so a very large storage device is needed to store the captured picture data. As a result, it costs a lot of hardware. Even with such a large storage device to store the captured image data, the manager can hardly find the information needed from such a large amount of information, resulting in poor prevention.

In view of this, the present invention provides a recording method of an operation history, which can record an operation situation of a user on a user host.

The invention also provides an information security management method, which can manage the operation history of a user host without requiring a large storage space.

In addition, the present invention further provides an information security management system, which can effectively prevent leakage of information.

The invention provides a recording method of an operation history, which can be used for a user host, which is equipped with an operating system. The recording method provided in this embodiment intercepts the picture displayed on the user host at a first preset time point, generates a picture interception data, and determines whether a picture redraw event occurs on the picture displayed by the user host. If the replay event occurs on the screen displayed by the user host, the content of the at least one string output command output by the operating system for the redraw event is intercepted. In addition, the recording method also intercepts the screen displayed on the user host at a second preset time point after the first preset time point after the redraw event occurs, and generates a second screen intercepting data. In this way, the second picture interception data can be compared with the first picture interception data to find the difference between the second picture intercepted data and the first picture intercepted data. Then, at least one of the first picture interception data and the second picture interception data is recorded, and the content of the string output instruction corresponding to the difference between the second picture interception data and the first picture interception data is recorded.

From another point of view, the present invention also provides an information security management method that can be applied to a user host that has an operating system installed. The management method of the present invention includes detecting whether the user host is activated. When the user host is started, timing begins. Each time a first preset time elapses, the screen displayed on the user host is intercepted, and a screen capture data is generated, and whether a picture redraw event occurs on the screen displayed by the user host is detected. When it is detected that the picture displayed by the user host has a redraw event, the content of the at least one string output instruction output by the operating system for the redraw event is intercepted. In addition, after the redraw event occurs, the recording method displays a screen displayed on the user host after a second preset time is obtained, and a second screen interception data is generated. In this way, the second picture interception data can be compared with the first picture interception data to find the difference between the second picture interception data and the first picture interception data. Then, according to the content of the string output instruction corresponding to the difference between the second picture interception data and the first picture interception data, the character input to the user host is obtained, and an input character interception data is generated. When the input character intercepting data conforms to one of the plurality of preset keyword words, at least one of the first screen intercepting data and the second screen intercepting data is stored for viewing by a manager.

In addition, when the input character intercepting data does not meet any of the preset keyword words, the first screen intercepting data and the second screen intercepting data are deleted.

In an embodiment of the present invention, the content of the string input instruction includes the starting coordinate data of the input string on the user host screen, the length and width data of the input string, and the content of the input string.

From another point of view, the present invention further provides an information security management system that can manage a user host. The information security management system of the invention comprises a connection module, a control module and a management tool. The connection module is connected to the user host through a network. In addition, the control module is coupled to the connection module to monitor the user host through the connection module. The management tool is also connected to the control module to intercept the screen displayed on the user host every time a first preset time is elapsed to generate a first screen interception data when the user host is found to be powered on. At this time, if a redraw event is displayed on the screen displayed on the user host, the content of the at least one string output command generated by the operating system is intercepted, and the screen displayed on the user host is intercepted again to generate a The second screen intercepts the data. In this way, the second picture interception data can be compared with the first picture interception data to find the difference between the second picture intercepted data and the first picture intercepted data. Then, according to the content of the string output instruction corresponding to the difference between the second picture interception data and the first picture interception data, the character input to the user host is obtained, and an input character interception data is generated. Therefore, the management tool will intercept the data according to the input character to determine whether to store the first screen interception data and the second screen interception data.

Since the present invention stores the corresponding picture interception data under the condition that the intercepted input character intercepts the data according to one of the preset keywords, the present invention does not require a huge storage device. As such, the present invention also assists the manager in determining whether a leak event has occurred more accurately and more efficiently.

The above and other objects, features and advantages of the present invention will become more <RTIgt;

1 is a block diagram of an information security management system in accordance with a preferred embodiment of the present invention. Referring to FIG. 1 , the information security management system 100 provided in this embodiment can be connected to a user host 160 through the network 150 . In the present embodiment, the information security management system 100 is implemented using a server, a personal computer, a portable computer, or a tablet. In addition, the network 150 can be a wired network or a wireless network, such as a regional network.

The information security management system 100 in this embodiment includes a control module 102, a connection module 104, and a management tool 106. The connection module 104 is connected to the network 150 and is coupled to the user host 160 via the network 150. The control module 102 is connected to the management tool 106 and coupled to the connection module 104. Thereby, the control module 102 can monitor the user host 160 through the network 150.

In some embodiments, the information security management system 100 further has a storage unit 110, such as a hard disk, a flash memory, or the like, which can be coupled to the control module 102. Moreover, in some embodiments, the management tool 106 can be implemented using software, which can be stored in the storage unit 110 and used to record the history of a user's operation on the user host 160. In addition, in the storage unit 110, a database 112 can also be installed, which can be connected to the management tool 106. The database 112 can store a plurality of preset keyword words, which can be set by the administrator.

Referring to FIG. 1, the user host 160 can also be a personal computer, a portable computer or a tablet computer. The user host 160 can be coupled to the screen 162 and the keyboard 164. In some embodiments, screen 162 and keyboard 164 are external peripheral devices. However, in other embodiments, screen 162 and keyboard 164 are included within user host 160. When the user host 160 is activated, the control module 102 notifies the management tool 106 of this information. At this time, the management tool 106 intercepts the screen displayed on the screen 162 of the user host 160 through the network 150 at a first preset time point, and generates a first screen interception data.

After the first screen capture data is obtained, the management tool 106 also detects whether a redraw event occurs on the screen displayed by the screen 162 of the user host 106. The so-called redraw event is that when the user performs any operation on the screen 162 of the user host 160, the operating system installed in the user host 160 performs the screen displayed on the screen 162 in response to the user's operation. Redraw operation.

2A-2C are schematic diagrams respectively showing a user inputting a character at an entrance website. Referring to FIG. 2A to FIG. 2C respectively, and referring to FIG. 1 in combination, when the user operates the user host 160 to connect to an portal website, the web page 200 of the portal website is displayed on the screen 162. If the user types the character "N" in the keyword input field 202 on the web page 200 at the first time (as shown in FIG. 2A); then enter the word in the keyword input field 202 at the second time point. The element "N" (as shown in Fig. 2B); then at the third time point, the character "N" is entered in the keyword input field 202 (as shown in Fig. 2C), at which time the operating system of the user host 160 is The positions of the screen 162 relative to the keyword input field 202 are respectively redrawn at the first time point, the second time point, and the third time point to display "N" and ", respectively" in the keyword field 202. NN" and "NNN". In addition, if the user operates the mouse to move the page 200 of the entire portal site on the screen 162, the operating system of the user host 160 re-drawing the range of the entire screen 162.

When the operating system of the user host 160 repaints the screen displayed on the screen 162, a string output command such as TextOut or TextOutW is issued. Therefore, when the management tool 106 obtains the screen capture data, it detects that the screen 162 of the user host 160 has a redraw event, and intercepts the content of at least the string output command issued by the operating system of the user host 160. In some embodiments, the manner in which the management tool 106 intercepts the string output instructions is intercepted using a hook application provided in the user host 160. At this time, the management tool 106 records the content of the string output command, for example, the start coordinate data input to the character data of the user host 160 on the screen, and the length and width of the character data input to the user host 160. Value and content. In FIGS. 2A to 2C, the contents of the string output command input to the user host 160 are "N", "NN", and "NNN", respectively.

On the other hand, the management tool 106 intercepts the screen of the user host 160 again at a second preset time after the first preset time point after the redraw event occurs on the screen displayed on the screen 162 of the user host 160. The screen displayed on 162 generates a second screen capture data. At this time, the management tool will perform the intersection comparison between the first screen intercepting data and the second screen intercepting data to find out the difference between the first screen intercepting data and the second screen intercepting data. Thereby, the management tool 106 can record the content of the string output instruction corresponding to the difference between the first picture interception data and the second picture interception data, and generate an input character interception data. Next, the management tool 106 compares the obtained input character interception data with the preset keyword words in the database 112.

For example, the first picture captured by the management tool 106 at the first time point is the picture shown in FIG. 2A, and the second picture intercepted data obtained at the second time point is the picture shown in FIG. 2C. Picture. At this time, the management tool 106 compares the first screen capture data and the second screen capture data, and finds that the difference is the region of the keyword input field 202. At this time, the management tool 106 records the content of the string output instruction corresponding to the area of the keyword input field 202, and generates the input character interception data.

In addition, the step of the management tool 106 performing the intersection alignment of the first screen intercepting data and the second screen intercepting data may be: comparing the second screen intercepting data with the region of the focus window in the first screen intercepting data. The so-called focus window is the window at the top of the screen displayed on the screen 162 of the user host 160. When a plurality of windows are opened on a display screen, the window at the top level is the window currently being used, and is defined herein as a focus window.

In some other embodiments, after the management tool 106 obtains the first screen capture data, it also detects whether the keyboard 164 of the user host is used. When the management tool 106 detects that the keyboard 164 of the user host 160 is used after acquiring the first screen interception data, it will delay the delay 162, that is, at the second time point, and then intercept the screen 162. The displayed picture produces a second picture capture.

If the management tool 106 finds that the obtained input character interception data matches one of the preset keyword words stored in the database 112, the screen capture data is stored in the storage unit 110 for the administrator to view. In some embodiments, the management tool 106 also stores the input character intercept data in the storage unit 110. In contrast, if the management tool 106 finds that the input character interception data does not match any of the preset keyword words in the database 112, the obtained screen capture data is deleted.

In some embodiments, when the management tool 106 finds that the input character interception data conforms to one of the preset keyword words, the call control module 102 can also generate a notification message to notify the administrator. The notification message is, for example, a voice notification message, an audio notification message, a notification dialog displayed on the screen of the information security management system 100, and the like.

3A and 3B are flow charts showing the steps of a method for managing information security according to a preferred embodiment of the present invention. Referring to FIG. 3A, the management method provided in this embodiment may be applied to a user host. First, the embodiment may determine whether the user host is powered on as described in step S302. When the user turns on (as indicated by YES in step S302), step S304 is performed to start timing to intercept the displayed image on the user host every time a first preset time elapses. A first picture intercepts the data, which is step S306. Next, as described in step S308, it is determined whether a redraw event occurs on the screen displayed by the user host.

If it is in step S308, the management method of the embodiment finds that a redraw event occurs on the screen displayed by the user host after obtaining the first screen interception data (as indicated by "YES" in step S308), then the steps are performed. S310, that is, intercepting the content of the string output instruction generated by the operating system of the user host for the redraw event. In addition, the management method of the embodiment further generates a second screen interception data by intercepting the screen displayed by the user host after a second preset time after obtaining the first screen interception data, as described in step S312. Since the content of the string output instruction obtained at step S310 may be too large, it is further filtered to find the required data.

Therefore, referring to FIG. 3B, in this embodiment, step S314 may be performed, that is, the first picture intercepted data and the second picture intercepted data are intersected and compared to find the difference between the two. Therefore, the management method of the embodiment may record the content of the string output instruction corresponding to the difference between the first picture interception data and the second picture interception data, as described in step S312, to generate an input character interception. data. In this way, the content of the required string output command can be obtained.

Next, as described in step S318, it is determined whether the input character interception data conforms to any of the plurality of preset keyword words. If the obtained input character interception data does not match any of the preset keyword words (as indicated by "NO" in step S318), then proceeding to step S320, the first screen capture data and the second screen capture data are deleted. Of course, the input character interception data will also be deleted. In contrast, if the input character intercepts the data in accordance with one of the preset keyword words (as indicated by the step S318, YES), as described in step S322, the screen capture data is stored for the administrator to view. In some embodiments, the retrieved input character intercept data is also stored for analysis by the manager.

In summary, the present invention intercepts the character data input to the user host when intercepting the user host screen, and uses this as a basis for storing the screen interception data. Therefore, the present invention can realize the technology of elastically monitoring the remote user host without requiring too much storage device. In addition, the manager does not have to view a lot of irrelevant data, but only needs to view the screenshots corresponding to the input characters intercepted by the preset keyword words. Therefore, the present invention can also allow the user to judge whether or not an event of information leakage has occurred more efficiently and more accurately.

While the present invention has been described in its preferred embodiments, the present invention is not intended to limit the invention, and the present invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application.

100. . . Information security management system

102. . . Control module

104. . . Connection module

106. . . Management tool

110. . . Storage unit

112. . . database

150. . . network

160. . . User host

162. . . Screen

164. . . keyboard

200. . . Web page

202. . . Keyword input field

S302, S304, S306, S308, S310, S312, S314, S316, S318, S322. . . Step process of information security management method

1 is a block diagram of an information security management system in accordance with a preferred embodiment of the present invention.

2A-2C are schematic diagrams respectively showing a user inputting a character at an entrance website.

3A and 3B are flow charts showing the steps of a method for managing information security according to a preferred embodiment of the present invention.

S302, S304, S306, S308, S310, S312. . . Step process of information security management method

Claims (16)

A recording method of an operation history is applicable to a user host, and an operation system is installed, and the recording method includes the following steps: intercepting a screen displayed on the user host at a first preset time point, and generating a The first screen intercepts the data, and determines whether a picture redraw event occurs on the screen displayed by the user host; only when the redraw event occurs on the screen displayed by the user host, the operating system intercepts the redraw event The output string outputs the content of the instruction, and intercepts a picture displayed on the user host at a second preset time point after the first preset time point to generate a second picture interception data; The screen intercepting data is compared with the first screen intercepting data to find a difference between the second screen intercepting data and the first screen intercepting data; and recording the first screen intercepting data and the second screen intercepting data At least one of the two, and recording the second picture interception data and the string output instruction corresponding to the difference between the first picture interception data . The recording method of claim 1, wherein the content of the string input instruction comprises a starting coordinate data of the input string on the user host screen, a length and width data of the input string, and a content of the input string. . The recording method of claim 1, wherein the step of comparing the second picture intercepted data with the first picture intercepted data comprises: intercepting the second picture and intercepting the first picture The intersection of the uppermost window in the middle is performed. The recording method of claim 1, further comprising the steps of: detecting whether the keyboard of the user host is used after obtaining the intercepted data of the first screen; and detecting the host of the user When the keyboard is used after the first picture is intercepted, the second picture interception data is intercepted after a delay time. The recording method of claim 1, wherein the step of intercepting the string output instruction comprises intercepting the content of the string output instruction by using a hook application. An information security management method, suitable for managing a user host, which has an operating system installed, and the management method includes the following steps: detecting whether the user host is started; when the user host is started, starting Timing; each time a first preset time is passed, the screen displayed on the user host is intercepted, and a first screen interception data is generated, and it is determined whether a picture of the user host displays a redraw event; When the redraw event occurs on the screen displayed by the user host, the content of the string output command output by the operating system for the redraw event is intercepted, and a second pre-pass is obtained after the first screen capture data is obtained. Setting a time, intercepting a screen displayed on the user host, and generating a second screen intercepting data; and intersecting the second screen intercepting data with the first screen intercepting data Pairing, searching for the difference between the intercepted data of the second screen and the intercepted data of the first screen; and outputting the content of the command according to the string corresponding to the difference between the intercepted data of the second screen and the intercepted data of the first screen, and Obtaining a character input to the user host, and generating an input character intercepting data; and when the input character intercepting the data conforms to one of the plurality of preset keyword words, storing the first screen intercepting data and the The second screen intercepts at least one of the data for viewing by a manager. The management method of claim 6, wherein when the input character interception data does not match any of the preset keyword words, the first screen interception data and the second screen interception data are deleted. The management method of claim 6, wherein the content of the string input instruction comprises a starting coordinate data of the input string on the user host screen, a length and width data of the input string, and a content of the input string. . The management method of claim 6, wherein the step of comparing the second picture intercepted data with the first picture intercepted data comprises: intercepting the second picture and intercepting the first picture The intersection of the uppermost window in the middle is performed. The management method described in claim 6 further includes the following steps: after obtaining the intercepted data of the first screen, detecting whether the keyboard of the user host is used; When it is detected that the keyboard of the user host is used after acquiring the first picture interception data, the second picture interception data is intercepted after delaying a delay time. The management method of claim 6, wherein the step of intercepting the string output instruction comprises intercepting the content of the string output instruction by using a hook application. The management method described in claim 6 further includes establishing a database to store the preset keyword words and storing the screen capture data to be stored. An information security management system, configured to manage a user host, comprising: a connection module, connected to the user host through a network, wherein the user host is installed with an operating system; a control module, coupled The connection module is configured to monitor the user host through the connection module; and a management tool is connected to the control module to periodically intercept the user host after the user host is powered on Displaying a screen to generate a first screen interception data, and intercepting the content of at least one string output instruction generated by the operating system only when it is determined that a redraw event occurs on the screen displayed on the user host, and The second screen capture data is generated by intercepting the screen displayed on the user host to compare the second screen capture data with the first screen capture data, and obtain the input word to the user host. Metadata, and the management tool is based on the character data input to the user host. Whether to store at least one of the first picture interception data and the second picture interception data for a manager to view. The information security management system of claim 13, wherein the network comprises a wired network and a wireless network. For example, the information security management system described in claim 13 wherein the network is a regional network. The information security management system of claim 13 further includes a database coupled to the control module and storing a plurality of preset keyword words for the management tool to intercept the input characters. Comparing with the preset keyword words, and then determining whether to store the screen interception data according to the result of the comparison.