TWI574172B - The method of encrypting the network to monitor confidentiality - Google Patents

Description

Method of monitoring confidentiality in an encrypted network

The invention relates to a method for monitoring confidentiality in an encrypted network, which is mainly applied to a confidential protection system. Due to the advancement of computer and network technology, the pipelines for which data may be leaked are increasingly diversified, and the confidential protection system must be able to detect Some materials are being transmitted through various network agreements, thus avoiding the outflow of confidential documents, which is a key technology in the field of confidential protection.

The network monitoring of the confidential protection system usually uses a dedicated network gateway or agent to analyze and monitor the transmission content in the organization's external network architecture, but it can also use the endpoint monitoring technology to analyze the computer. The content of the network transmission, the characteristics and comparison of the two are listed in Table 1.

In theory, if you use a cryptographic protocol such as SSL, the network transmission content is The confidential protection system cannot be analyzed and monitored. However, there are two possible solutions to this problem. One is to set up a proxy server for SSL on the network gateway. When the client computer performs SSL connection, the SSL proxy server pretends to be the server of the URL, and The client performs the relevant request and then passes the response of the remote URL to the original client, which is like Man in the Middle Attack. Of course, the disadvantage of this method is that the client will generate a security warning message, because the target URL is different from the SSL certificate, and the network performance will be slowed down due to the proxy server transfer. If the proxy server's credentials are set to the trust credentials of all computers in advance, and the proxy server immediately signs the SSL certificate of the URL and then performs the above-mentioned intermediary transfer, the client's security warning message can be avoided, but the SSL connection is avoided. Time will also be slowed by the burden of signing temporary documents. At present, the new version of the SQUID agent plus the ICAP module can be used to achieve the above SSL monitoring function. However, because many SSL connections are applied to the protection of login passwords, such as online banking and various e-commerce websites, this SSL monitoring method has the problem of infringing the privacy of users.

Another solution is to use the underlying functions of the system to monitor the network behavior of the local computer. When the confidential protection system detects that a network application software needs to transfer files after SSL connection, it may take the first step to analyze the file. Protected by the content. The disadvantage of this method is that it must go deep into the bottom layer of the system, and develop the corresponding monitoring functions for different behavior modes of various network application software, which is not conducive to product version maintenance. However, because it is the source of the network protocol, that is, the data flow of the network application software is monitored, even if the transmission pipeline of the confidential security gateway is not installed, for example: Wi-Fi, 3G wireless network or telephone dial-up Connections, etc. can also be monitored. In addition, because the confidential protection program does not record the data in the password field, it can also avoid infringement of the user's privacy.

This patent uses the technology of endpoint monitoring to transmit the content of the computer network. Analysis and behavior control, in addition to the previous monitoring methods through network gateways or agents, in addition to not affecting the overall network performance, can also more completely monitor various network transmission pipelines, and avoid infringement Account privacy. In the US US 2008/0066180 A1: Instant Message Scanning patent case, a similar technical concept can be found in this case. However, this case only analyzes and protects the malware transmitted by IM Instant. The encrypted network leaks externally.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and finally successfully developed a method for monitoring confidentiality in an encrypted network.

The purpose of the invention patent is to establish a method for monitoring confidentiality in an encrypted network, which is mainly applied to a confidentiality protection system. When a user adopts an encrypted network protocol, such as SSL or SSH, the confidentiality protection system cannot theoretically analyze the transmission content. And control, the present invention proposes a solution for monitoring the content of data transmission in any network encryption environment.

The invention provides a method for monitoring confidentiality in an encrypted network. The monitoring method first performs an application interface hook (API Hook) processing on a target thread, and the hooked API is a system API related to network transmission behavior, for example, ws2_32 .dll's send() or kernel32.dll's CreateFile(), etc., these hooks are placed for monitoring when the application software starts. Once the thread is connected to the external network by encryption protocol and reads the local file, The program name can be transmitted to the confidential protection system through Inter-Process Communication, and the content of the file can be analyzed, and then the result of the analysis can be returned to allow the application software to perform the protection operations specified by the policy. This allows for early analysis and protection of network transmission content in any cryptographic environment without affecting the overall network performance and monitoring any network. pipeline.

A method for monitoring confidentiality in an encrypted network is used for network monitoring operations of a confidential protection system. The method for monitoring includes the following steps: Step 1: When the system detects that the user enables the network application, Load a dynamic library that monitors confidentiality and place an application interface hook associated with the network transmission behavior; Step 2: When the hook is placed, it detects that the network application has a connection to the external network. When there is an act of reading a file or editing a text file, the confidential protection system program is notified through an inter-program communication channel to perform an analysis of the content of the file or text to determine whether the network application is confidentially exposed; and Step 3: When receiving the content analysis result returned by the confidential protection system program, the network application allows the non-confidential file to continue the network transmission operation, and the confidential file performs corresponding protection according to the returned value. operation.

The confidential protection system program is a resident program pre-installed in the user's computer system, and is responsible for the policy loading and application, content analysis, audit record operation of the confidential protection system program; the network transmission behavior related application Program interface hook refers to the operating system library that must be used when reading files, editing text data, transferring data, and opening files for the application by using the application interface hooking technology. The monitoring process; wherein the first step is when the web application is launched, the method for hooking the network application related application interface is loaded, and when the dynamic function library of the confidential monitoring is loaded, whether the application is the network application If the program is determined to be the network application, the application interface hook associated with the network transmission behavior is set to monitor the subsequent network transmission behavior. If the program is not the network application, End confidential monitoring of the loading of the dynamic library; the web application interface is linked to the supervisor Methods of web applications, web-based application after the external connection, a reader or edit text files of information act, that is, into the monitoring process of the relevant hook, the The process uses the inter-program communication pipeline to notify the confidential protection program, and requests the program to perform the content analysis of the target file or text, and the analysis result has been obtained.

The inter-program communication pipeline is a named pipeline agreement for the inter-program communication pipeline used in the file, and the complete path file name of the file is transmitted to the confidential protection program for content analysis of the file, and for the text editing data, the operation system is used for scraping The book mechanism passes the text content and uses the named pipeline agreement to query the confidential protection program for the most recent scrapbook text analysis result.

The named pipeline agreement is to continue the network transmission behavior of the program if the target file or text content is not confidential, and the confidential file is in accordance with the content analysis result returned by the confidential protection system. The return value is used for the corresponding protection operation, and the protection operation includes the operation of auditing, encrypting or blocking.

The method of transferring text by using the scrapbooking mechanism of the operating system is that after the user inputs a plurality of text materials in the editing area, the application interface hooks to save the original content of the scrapbook and the cursor position, and then uses the operating system function. The library downloads the text editing content, selects and copies the command, and restores the cursor position. Then, after obtaining the content analysis result returned by the confidential protection program, the original content of the scrapbook is restored.

A method for monitoring confidentiality in an encrypted network, the steps of the confidential content classification and auditing method are: Step 1: The resident program of the confidential protection system opens a specific named pipeline agreement in the system; Step 2: When receiving The request information is parsed when the named pipeline agreement is transmitted by the network terminal; and the third step is performed, and the corresponding result is returned according to the requested information.

If the request received by the named pipeline agreement is to request file analysis, the content analysis operation is performed on the file using the file name conveyed, and then the result of the content analysis is formed into the response data of the named pipeline agreement, and Pass to the web application.

If the request received by the named pipeline agreement is to obtain the analysis result of the executive text editing, the latest analysis result of the scrapbook content is taken out, and then the return operation of the named pipeline agreement is performed.

If the request received by the named pipeline agreement is an auditing operation for the confidentiality protection event, the relevant event information composition audit record is uploaded to the confidential management terminal.

The method for monitoring confidentiality in an encrypted network provided by the present invention has the following advantages when compared with the aforementioned citations and other conventional techniques:

1. A method of monitoring confidentiality in an encrypted network of the present invention to prevent leakage of confidential files in any encrypted network environment.

2. A method for monitoring confidentiality in an encrypted network according to the present invention does not form a bottleneck in the gateway servo end as the network traffic increases, thereby impacting the transmission efficiency of the entire network.

3. A method of monitoring confidentiality in an encrypted network of the present invention, which can monitor any network transmission pipeline without physical limitations of the network architecture and monitoring device.

Please refer to FIG. 1 , which is a system architecture diagram of a method for monitoring confidentiality in an encrypted network according to the present invention. When the user 110 operates the computer system 150 , the enabled network application 130 is connected to the external network 120 by using an encryption protocol. When the web application 130 is launched, the confidential monitoring dynamic library 160 is loaded first, and the loading mode can continuously monitor the startup of all programs and be placed by the remote end by using the mechanism provided by the operating system or by the confidential protection system program 180. When the web application 130 reads a certain file 140 or edits a plurality of text materials, the application programming interface (API) preset to the web application 130 is inter-process communication (Inter Process Communication). Way to notify the confidential protection system program 180, to file or The analysis of the text content, so that the web application 130 decides whether to allow the data to be transmitted to the outside through the network. If the confidentiality protection event occurs, the network is prevented from being transmitted from the API hook according to the policy, and the confidential protection system program is used. 180 uploads the record to the confidential management center 170 server for audit management.

Please refer to FIG. 2, which is a flowchart of a network application monitoring method for encrypting a network in a secret network. When the system detects that a network application starts 200, the main hook of the system enters an execution point. Determine whether it is a web application to put in the network-related hook function, and enter the detection and filtering process. The filtering method can be: the thread name is listed in the monitoring list defined by the system or loaded into Windows. The underlying network library ws2_32.dll, which is the hook setting 210 of the network behavior related API, monitors its subsequent network transmission behavior, and when the thread performs external connection or transmits the data 220, the monitoring is started. The file reading behavior or text editing operation, and whether the external connection is judged, can be compared to the Internet connection setting of the operating system, or the content of the HTTP protocol is resolved, and then if the ReadFile in Kernel32.dll Or the read file behavior 230 found in the GetOpenFileName hook of Comdlg32.dll, first find the file and path name and then pass the file name to the confidential protection program for content. Analysis 250, to determine whether to protect the network transmission behavior of this thread, by means of a named pipeline (Named Pipe) agreement to transfer the file name to the resident program of the confidential protection system, request analysis of the file content, if it is In the SetCaretPos hook of User32.dll, it is found that the thread has the behavior of editing the text data 240, and the text data is transferred to the resident program 260 of the confidential protection system in the scrapbook to analyze the text content, and how to use the scrapbook to transfer the user edit. In the text data, the method can be: when detecting the user at a specific moment of editing the text, for example, when the line is changed, the hook of the application can issue a keyboard command such as Ctl-A or Ctl-C, and immediately edit the content of the text. The scrapbook is passed to the confidentiality protection program, which triggers the program to analyze the contents of the scrapbook, but In the process of transferring the text data to the confidential protection program 260 in the scrapbook, it is necessary to save the original scrapbook content and the cursor position, and then reply after the text data is transmitted.

When the confidentiality protection program completes the content analysis of the file or text material and returns the result of the analysis, the network application determines whether the file is a confidential file based on the return code, and assumes that the value is 0, indicating that the file is confidential. The operation 280 of the network transmission can be continued. If the value of the return code is 1 to 3, the file is a confidential file, and the event 270 and the network protection operation 290 must be audited. The audit program 270: The dialog box allows the user to select and confirm the handling of the event, and then notify the confidential protection program by the named pipeline agreement to perform the audit of the event. The network protection operation 290 program: adopt different protection measures according to the return value, for example, A value of 1 only audits this event but does not block the transmission of the network; 2 encrypts the file and transmits it; or a value of 3 prevents the network from transmitting.

Please refer to FIG. 3 , which is a confidential analysis and auditing flowchart of the method for monitoring confidentiality in an encrypted network according to the present invention. The resident program of the confidential protection establishes a specific named pipeline agreement in the system, and receives the named name transmitted by the network terminal. When the pipeline request 310 is performed, the request information is parsed. If the file analysis is requested, the file name is used to perform the content analysis 320 on the file, and then the named pipeline returns the content analysis result 340, and the content analysis result is obtained. The response data constituting the named pipeline agreement is sent back to the web application. If the request is to obtain the analysis result of the executor text editing, the latest scrapbook content analysis result 330 is obtained, and then the backhaul operation 340 is performed. The named pipeline request is an auditing operation to perform a confidential protection event, and the related audit record is uploaded to the confidential management terminal 350.

The above implementation process can monitor the network transmission behavior of the application, even in the encrypted network protocol, the data flow of the network application software can be analyzed and controlled before the confidential data actually flows into the network.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

110‧‧‧System users

120‧‧‧Internet

130‧‧‧Web application

140‧‧‧Document reading

150‧‧‧Computer system operating environment

160‧‧‧Confidential Monitoring Dynamic Library

170‧‧‧Confidential Management Center

180‧‧‧Confidential Protection System Program

200 ^~ 290‧‧‧Web application monitoring process

310 ^~ 350‧‧‧ Confidential Analysis and Audit Process

Please refer to the detailed description of the present invention and the accompanying drawings, which can further understand the technical content of the present invention and its function. The related drawings are: FIG. 1 is a system architecture diagram of the method for monitoring confidentiality in an encrypted network according to the present invention. FIG. 2 is a flow chart of the network application monitoring of the method for monitoring confidentiality in the encrypted network of the present invention; FIG. 3 is a flow chart of confidential analysis and auditing of the method for monitoring confidentiality in the encrypted network of the present invention.

1 is a diagram of an embodiment of a software service uninterrupted system and method for modifying a database schema of the present invention;

110‧‧‧System users

120‧‧‧Internet

130‧‧‧Web application

140‧‧‧Document reading

150‧‧‧Computer system operating environment

160‧‧‧Confidential Monitoring Dynamic Library

170‧‧‧Confidential Management Center

180‧‧‧Confidential Protection System Program

Claims (8)

A method for monitoring confidentiality in an encrypted network is used for network monitoring operations of a confidential protection system. The method for monitoring includes the following steps: Step 1: When the system detects that the user enables the network application, Load a dynamic library that monitors confidentiality and place an application interface hook associated with the network transmission behavior; Step 2: When the hook is placed, it detects that the network application has a connection to the external network. When there is an act of reading a file or editing a text file, the confidential protection system program is notified through an inter-program communication channel to perform an analysis of the content of the file or text to determine whether the network application is confidentially exposed; and Step 3: When receiving the content analysis result returned by the confidential protection system program, the network application allows the non-confidential file to continue the network transmission operation, and the confidential file performs corresponding protection according to the returned value. operation. The method for monitoring confidentiality in an encrypted network as described in claim 1, wherein the confidential protection system program is a resident program pre-installed in a user computer system, and is responsible for policy loading of the confidential protection system program. Work with applications, content analysis, and audit records. The method for monitoring confidentiality in an encrypted network, as described in claim 1, wherein the application interface hook associated with the network transmission behavior refers to using an application interface hooking technology to read a file for the application, When editing text data, transferring data on the Internet, and opening files, The operating system library that must be used, intervening for additional monitoring. For example, in the method for monitoring confidentiality in an encrypted network as described in claim 1, the first step is to load the network application related application interface hook when the network application is started, and load the confidential monitoring. The dynamic library is used to determine whether the application is a judgment of the web application. If the program is determined to be the web application, the application interface hook associated with the network transmission behavior is placed to monitor the subsequent network. The transmission behavior, if it is determined that the program is not the web application, ends the confidential monitoring of the loading of the dynamic library. The method for monitoring confidentiality in an encrypted network, as described in claim 1, wherein the method for linking the network application to the network application is to read the file after the network application is externally connected. Or the act of editing the text data, that is, entering the monitoring process of the relevant hook, the process is to notify the confidential protection program by using the inter-program communication channel, and request the program to perform the content analysis operation of the target file or text, and the analysis result has been obtained. The method for monitoring confidentiality in an encrypted network as described in claim 5, wherein the inter-program communication pipeline is a named pipeline agreement for the inter-program communication pipeline used for the file, and the complete path name of the file is transmitted. The confidential protection program is used to analyze the content of the file. For the text editing data, the text file content is transmitted by using the scrapbooking mechanism of the operating system, and the confidential pipeline program is used to query the confidential protection program for the latest scrapbook text analysis result. The method for monitoring confidentiality in an encrypted network, as described in claim 6, wherein the named pipeline agreement is received by the confidential protection system. In the case of content analysis results, if the target file or text content is not confidential, the network transmission behavior of the program is continued without any protection. For the confidential file, the corresponding protection operation is performed according to the return value, and the protection operation includes Audit, encrypt, or block jobs. The method for monitoring confidentiality in an encrypted network, as described in claim 6, wherein the method for transmitting text by using a scrapbooking mechanism of the operating system is when the user inputs a plurality of text materials in the editing area, the application interface The hook first saves the original content of the scrapbook and the position of the cursor, and then uses the operating system library to release the full selection of the text editing content, copy the command and restore the cursor position, and then obtain the content analysis result returned by the confidential protection program. After that, restore the original content of the scrapbook.