TWI769038B - Method for preventing data kidnapping and related computer program - Google Patents

Abstract

A method for preventing data kidnapping and related computer program are disclosed. The method includes the steps: a) setting a protected directory and protected files with a designated extension in the protected directory; b) creating a target directory in a root directory or a user directory where the protected directory is located, wherein a first character of the name of the directory is ranked higher than a first character of the names of all directories in the root directory or the user directory in the Unicode character list; c) creating at least 100 target files with the specified extension in the target directory; d) cyclically creating an image file with a first frequency for all the protected files in the protected directory are storing them in a designated space; e) checking if specific target files in the target directory with a second frequency whether they have been modified or deleted; and f) if the total number of modified or deleted target files checked in step e) reaches a specific value, stopping creating the image file and setting the handle values of these protected files to restrict writing.

Description

Methods for preventing data kidnapping and related computer programs

The present invention relates to an information operation method and related computer program products, in particular to a method for preventing data kidnapping and related computer program products.

In today's advanced IT world, information security is very important. From electronic products for personal use to public works at the national level, if the software or data used by them are "hacked", the corresponding services may be reduced in performance or even shut down. A common hacking method is to invade the computer host through the network, and use malicious software to encrypt the data in the storage device (such as hard disk, SSD) through the loopholes or special settings of the operating system, so as to make the computer host inoperable, This is called data kidnapping. The hackers who launch the cyberattack can demand a ransom from the owner of the host computer, and only after receiving the ransom can decrypt the data and restore the system to normal.

After these malicious software invades the computer host, it will encrypt the data in the computer storage device according to certain rules. Since the computer host will display different characteristics from the usual operation during the execution process, some cloud anti-hack systems can monitor these characteristics and propose relative protection measures to fight against malicious software to ensure information security. But on the other hand, these cloud anti-hack systems may also obtain or even steal user data, which has become another information security concern. Therefore, in order to solve this contradiction, it is better to have stand-alone applications to prevent data kidnapping by malicious software, and these applications are only configured to operate within the scope allowed by the user. The present invention is a novel solution.

This text extracts and compiles certain features of the invention. Other features will be disclosed in subsequent paragraphs. It is intended to cover various modifications and similar arrangements within the spirit and scope of the appended claims.

In order to meet the aforementioned requirements, the present invention discloses a method for preventing data kidnapping, which comprises the steps of: a) setting a protected directory in a file system of a computer and a protected file with a specified file extension in the protected directory; b) In the root directory or user directory where the protected directory is located, create a target directory, the first character of the name of the target directory is higher than the first character of the names of all the directories in the root directory or user directory. elements in the Unicode character list are sorted first; c) create at least 100 subject files with the specified extension in the subject directory; d) start all protected files in the protected directory with a first The frequency cycle makes an image file, and stores it in a designated space; e) Check the target directory with a second frequency to see whether the first A and last B read target files have been modified or deleted according to the file name. Among them, A and B is a positive integer; and f) if the total number of modified or deleted target files checked in step e) reaches C, set the control codes of these protected files to limit writing, where C is a positive integer Not greater than A and not greater than B.

The aforementioned method for preventing data kidnapping may further include steps after step d): d1) Check whether the protected file has been modified or deleted, and if so, the modified image file will be modified in the image file produced in the next cycle. or deleted protected files are listed in a to-be-deleted area; and d2) repeat step d), and determine whether the modified or deleted target file is restored to its original state before making an image file in the next round: if not, then The modified or deleted subject file is deleted from the to-be-deleted area and moved back to its original position; if so, the modified or deleted subject file will be deleted from the to-be-deleted area and the current status of all protected files at that time will be followed. into an image file.

If the first character of the name of a distinctively named directory exists in the root directory or user directory where it is located, the first character of the name of the target directory is in the same order in the Unicode character list as the first character of the name of the target directory, then the name of the target directory The first character in the Unicode character list will be used from the second character of the name of the target directory until a character after the second character of the target directory name is in the Unicode character list Sort by top.

Preferably, A is 5, B is 5, and C is 3; the size of each target file is not less than 64kB; the designated space is a storage device not attached to the computer or a cloud storage platform; the first frequency is at least every 10 Once every minute; the second frequency is at least once every 100 microseconds.

The present invention also discloses a computer program, including readable code, installed in a computer. When the readable code is executed in the computer, the processor of the computer executes the aforementioned method for preventing data kidnapping.

Preferably, when the aforementioned readable code is executed in the computer, the processor of the computer displays an operation interface on a screen, and the operation interface guides the user to configure the protected directory and the protected file.

Since the method of preventing data kidnapping is executed by a computer program running on a single machine, it will not cause the situation of stealing user data. In addition, the present invention provides double protection of protected files, which is the first in the industry.

1: Computer

2: Hard Disk

21: System slot

22: File slot

221: target directory

3: Internet

4: Cloud storage platform

4a: Area to be deleted

41: The first storage area

42: Second storage area

43: The third storage area

S01~S06: Steps

FIG. 1 is a flowchart of a method for preventing data kidnapping according to an embodiment of the present invention.

FIG. 2 illustrates an application scenario of the method for preventing data kidnapping.

FIG. 3 shows the aspect of a target file in a target directory.

FIG. 4 shows the state of the image file and its storage method.

The present invention will be described more specifically by referring to the following embodiments.

Please refer to FIG. 1 , which is a flowchart of a method for preventing data kidnapping (hereinafter referred to as the method) according to an embodiment of the present invention. In practice, the method is performed by a computer program installed in a computer when the computer executes the computer program. The first step of the method is to set a protected directory in a file system of a computer and a protected file with a specified file extension in the protected directory (S01). For a better understanding of this, please refer to FIG. 2 , which illustrates an application scenario of the method. In FIG. 2, the computer 1 has a hard disk 2, and the hard disk 2 is a physical device for storing data. The operating system of the computer 1 can effectively manage the magnetic areas in the hard disk, so as to store data (files) whose structure is a combination of 0 and 1, and point to the location where the files exist for reading and writing. According to the present invention, the protected object is the designated file in the designated protected directory, not all files stored in the hard disk 2 . According to the intrusion method of hackers, if kidnapping is used, the files with specific filenames are usually encrypted, so that the files cannot be read and form useless data types. Common file extensions that will be kidnapped are doc, xls, bin, rft, pdf, dbf, jpg, dwg, cdr, psd, cd, mdb, png, lcd, zip, rar, csv, log, etc. These are The aspect of the specified file extension in step S01. Users of this computer program can set what the protected directory is. In Fig. 2, the hard disk of the computer 1 is logically divided into a system slot 21 (C slot) and a file slot 22 (D slot), and the system slot 21 and the file slot 22 are both a "directory" (root directory) . Taking the file slot 22 as an example, in this embodiment, there are three directories whose names are "document", "!!important" and "figure" respectively. According to requirements, the protected files to be protected are located in the "document" directory, which is the so-called protected directory. However, not all files in a protected directory are protected, and only files with a specified extension can be protected. In this embodiment, there are 6 files in the "document" directory, namely abc.doc, friend.doc, mydata.log, time1937.log, time245.log and ffnuefne.bin. By setting, the 3 files with the extension "log" are protected files. It should be noted that, in the embodiment, only one protected directory and one protected file with a specified file extension are used for description, but in practice, there may be multiple protected directories and multiple specified file extensions at the same time.

The second step of the method is to create a target directory in the root directory or user directory where the protected directory is located, and the first character of the name of the target directory is compared with the root directory or user directory where the protected directory is located. The first character of the name is ranked first in the Unicode character list (S02). According to step 112, the computer program creates a target directory 221 named "!!!" in the file slot 22 (the root directory where the "document" directory is located). The first character of the name of the target directory 221 is "!", and its order in the Unicode character list is higher than the first character of the existing directory names "document" and "figure". However, the first character of the "!!important" directory name also happens to be "!". If no "!!important" directory exists, the name of the target directory 221 created by the computer program may simply use "!". In order to solve the problem of the "!!important" directory name, that is, if there is a unique name directory ("!!important" directory) in the root directory where the first character of the name and the first character of the name of the target directory 221 exist The order of a character in the Unicode character list is the same, then the second character of the name of the target directory 221 will use the first-ordered symbol in the Unicode character list (excluding control codes and spaces, etc. symbol "), until a certain character after the second character of the name of the target directory 221 is ranked higher in the Unicode character list than the character in the same position of the unique name directory. Since the first two characters of the "!!important" directory name are both "!", the target directory 221 must be extended to the third character "!" in order to meet the above requirements. The purpose of creating the target directory 221 is to create an object that is first attacked by hacker kidnapping software. Generally speaking, if the kidnapping software wants to encrypt and kidnap the files in hard disk 2, the priority order is also according to the read priority order defined by the operating system, that is, the list of Unicode characters from the first character of the directory name. The ordering is determined before and after, and the files in the higher-ordered directory will be attacked first. Note that the distinguished name directory may also be a protected directory. In addition, according to the present invention, if the protected directory is a logical slot divided by the operating system, under the user directory, the target directory can also be created in the user directory. If there are more than two users who can control the computer 1 according to their accounts under the operation of the operating system, there will be more than two user directories, both of which can be the application objects of the second step of the method.

Next, the third step of the method is to create at least 100 target files with the specified file extension in the target directory 221 (S03). For a better understanding of this step, please refer to FIG. 3 , which illustrates the aspect of the target file in the target directory 221 . In this embodiment, 1000 target files with the extension name of log are created, ! 0000001.log,! 0000002.log,...,! 0001000.log. The naming method of the target files is not limited, because the operating system determines the priority order of the target files when they are fully read. You can also separate which files will be read first and those will be later without special naming. According to the practice of kidnapping software attack, the file read earlier may be attacked first, or the file read later may be attacked first. It should be noted that the purpose of creating numerous target files in this step is to induce kidnapping software to attack (encrypt kidnapping), and determine whether the computer 1 is attacked by kidnapping software by monitoring the status of these target files. When attacked by kidnapping software, the encryption time of the target files will delay the time when the kidnapping software attacks the protected files, so that these protected files can be specially protected. In terms of strategy, it is a confrontation method of "time for space". Since the time for encrypting a file is positively related to the file size, the size of the target file is preferably limited to a minimum value without affecting the operation of the computer 1 and occupying too much storage space. According to the present invention, the size of each target file is preferably not less than 64kB.

The fourth step of the method is to rotate all the protected files in the protected directory into image files at a first frequency, and store them in a designated space (S04). In order to have a better understanding of this step, please refer to FIG. 4 , which shows the state of the image file and the storage method thereof. According to the present invention, the designated space for storing protected files can be a storage device not attached to the computer 1 (such as a network hard disk or a removable portable solid-state hard disk), or a cloud storage platform (such as Google Drive), Storage over the network. The designated space must not be attacked by kidnapping software. In this embodiment, the designated space is the cloud storage platform 4 , which is connected to the computer 1 for information through the network 3 . The first protection of the protected files in the present invention is to keep the current state of the protected files in the form of image files, and after a period of time (the first frequency), make another image file for the protected files, and restore if necessary. According to the invention, the first frequency is at least once every 10 minutes. but According to actual needs, it can also be once every hour, depending on the workload of the computer 1 and the possibility of being attacked.

Next, the fifth step of the method is to check, at a second frequency, whether the first A and last B read target files in the target directory have been modified or deleted, wherein A and B are positive integers (S05 ). ). This step is mainly to continuously observe whether the target file that is most likely to be attacked by kidnapping software suffers an encryption attack in a very short period of time. In practice, the second frequency is at least once every 100 microseconds. This is very fast, so the number of target directories that can be monitored is not too large without affecting the performance of the computer 1. In this embodiment, take A as 5 and B as 5, that is, to observe whether the first 5 and last 5 read target files (indicated by the dashed box in FIG. 3 ) are modified or deleted each time. If these target files are modified or deleted, it means that they may have been attacked by kidnapping software. It is worth noting that although this step is executed after the image file is created, step S04 is continuously performed simultaneously with this step, and only the activation time is different. This step is also repeated continuously.

The last step of the method is to set the control codes (handles) of these protected files to limit writing and stop making images when the total number of modified or deleted target files to be checked in step S05 reaches C. file, wherein C is a positive integer not greater than A and not greater than B (S06). In this embodiment, the value of C is 3 (in practice, it is not limited to this, but can vary with A and B). That is, when the computer program finds that in an observation, 3 of the first 5 or last 5 read target files have been modified or deleted, it is determined that the kidnapping software has been attacked. At this time, since the kidnapping software has to encrypt other target files in the target directory 221 in a short period of time, and there is still time to protect the protected files in the computer 1, the computer program will obtain the protected files through the operating system. The control code is quickly locked to restrict writes. This way, kidnapping software cannot encrypt these protected files later. This is the second layer of protection for protected archives of the present invention. The purpose of stopping the image file creation is that if the attack speed of the kidnapping software is still too fast, causing some protected files to be encrypted, and unfortunately, the image file creation is being performed at this time, the latest image file may contain Part of the kidnapped protected file. To prevent this When this happens, the best way to draw money from the bottom line is to stop making image files. After all the attacked conditions are cleared, this method is enabled, and the image file will continue to be created cyclically.

According to the present invention, if the protected file is accidentally deleted or rewritten by the user or the file is lost due to the damage to the magnetic area of the storage device, the storage method in the image file can be slightly modified to determine the cause and take appropriate measures. . Therefore, the method can further include two steps after step S04. First, it is checked whether any of the protected files has been modified or deleted, and if so, the modified or deleted protected files are listed in a to-be-deleted area 4a in the image file created in the next cycle (S041). For a detailed description of this step, please refer to Figure 4 again. When the image file in this round is created, the image file including the three files mydata.log, time1937.log and time245.log is stored in the first storage area 41 (physical storage area) of the cloud storage platform 4 . Before the next round of image files is created, the computer program finds that time1937.log has been modified through the operating system, and the new time1937.log will be stored in the to-be-deleted area 4a in the next round of image files, and the next round of image files will be The whole is stored in the second storage area 42 (logically, the image file of the next round will overwrite the image file of the current round). Next, step S04 is repeated, and it is judged whether the modified or deleted subject file is restored to its original state before the next round of creating an image file: if not, the modified or deleted subject file is deleted from the to-be-deleted area 4a , move back to the original position; if so, delete the modified or deleted target file from the to-be-deleted area 4a and create an image file according to the current status of all protected files at that time (S042). In the case of "No", that is, it is confirmed that time1937.log has disappeared or been modified due to non-hacking attacks, the new time1937.log file will be deleted from the to-be-deleted area 4a, and moved back to the original file created in the next round. In the image file (if it disappears, the to-be-deleted area 4a is empty, and the location of the original time1937.log file in the image file produced in the next round is also empty). In the case of "Yes", that is to say, the reason for the disappearance or modification of time1937.log does not exist. At this time, the computer program deletes the new time1937.log file in the to-be-deleted area 4a, and continues to follow step S04 for the protected file. Create an image file. As shown in FIG. 4 , at this time, the user adds a protected file time359.log, and the created image file is stored in the third storage area 43 as a whole (logically, the image file of the next round will image file overwrite).

It should be noted that steps S041 and S042 may occur before step S05, between steps S05 and S06, or even after step S06, and there is no fixed time point for them to occur.

The aforementioned computer program includes readable code, which is installed in the computer 1 . When the readable code is executed in the computer 1 , the processor of the computer 1 can execute the above-mentioned method for preventing data kidnapping. Preferably, when the aforementioned readable code is executed in the computer 1, the processor of the computer 1 can also display an operation interface on a screen (not shown), and the operation interface can guide the user to set the protected directory and the protected directory. file.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The protection scope of the present invention shall be determined by the scope of the appended patent application.

S01~S06: Steps

Claims (10)

A method for preventing data kidnapping, which is carried out by installing a computer program in a computer and executing the computer program by the computer, comprising the steps of: a) setting a protected directory and the protected directory in a file system of the computer A protected file with a specified extension in it; b) In the root directory or user directory where the protected directory is located, create a target directory, the first character of the name of the target directory is longer than the root directory or the user directory where it is located The first character of the names of all directories in the user directory is ranked first in the Unicode character list; c) Create at least 100 object files with the specified extension in the object directory; d) The recipient All protected files in the protected directory are cyclically made into image files with a first frequency, and stored in a designated space; e) Check the target directory with a second frequency, and read according to the first A and the last B of the file names Whether the selected subject file has been modified or deleted, where A and B are positive integers; and f) If the total number of modified or deleted subject files checked in step e) reaches C, control these protected files The code is set to limit writing and stop mapping, where C is a positive integer not greater than A and not greater than B. The method for preventing data kidnapping as described in claim 1, further comprising a step after step d): d1) checking whether the protected file has been modified or deleted, and if so, in the image file produced in the next round of circulation List the modified or deleted protected file in a to-be-deleted area; and d2) Repeat step d), and determine whether the modified or deleted target file is restored to its original state before creating an image file in the next round: if If not, the modified or deleted target file will be deleted from the to-be-deleted area and moved to Return to the original position; if so, delete the modified or deleted target file from the to-be-deleted area and create an image file according to the current status of all protected files at that time. According to the method for preventing data kidnapping as described in claim 1, if the first character of the name of a unique name directory and the first character of the name of the target directory exist in the Unicode word If the ordering in the metalist is the same, the first character in the Unicode character list will be used from the second character of the name of the target directory until a character after the second character of the name of the target directory is more specific Characters in the same position in the name directory are sorted first in the Unicode character list. The method for preventing data kidnapping according to claim 1, wherein A is 5, B is 5, and C is 3. The method for preventing data kidnapping according to claim 1, wherein the size of each target file is not less than 64kB. The method for preventing data kidnapping according to claim 1, wherein the designated space is a storage device not attached to the computer or a cloud storage platform. The method for preventing data kidnapping according to claim 1, wherein the first frequency is at least once every 10 minutes. The method for preventing data kidnapping according to claim 1, wherein the second frequency is at least once every 100 microseconds. A computer program, comprising readable code, installed in a computer, when the aforementioned readable code is run in the computer, the processor of the computer executes the anti-data kidnapping described in any of the request items 1 to 8 Methods. The computer program of claim 9, wherein when the readable code is executed in the computer, the processor of the computer displays an operation interface on a screen, the operation interface guides the user to configure the protected directory and the protected directory Protected files.

Images