Method, system, electronic device and medium for tracing source files of encrypted compressed packages

Abstract

The embodiment of the present invention provides a method, system, electronic device and medium for tracing the source file of an encrypted compressed package, which belongs to the field of data security. The method includes: using a file filtering driver to monitor the compression software, and obtaining the source file path read by the compression software and the compressed package path created; sending it to a service program to save the source file path and the md5 value corresponding to the source file to a database; when it is necessary to trace the source file of the encrypted compressed package, query the corresponding source file path from the database according to the md5 value of the encrypted compressed package. All compression software running on the system are monitored by filtering the driver program and the service program, and the created encrypted compressed package path and the read source file path are saved. When it is necessary to trace the source file of the encrypted compressed package, the source file path information can be quickly and accurately located, which is helpful to analyze the value of the data in the encrypted compressed package, and finally provide technical guarantee for data protection and data leakage risk prevention and control.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method, system, electronic equipment and medium for tracing a source file of an encrypted compressed package. Background Art

[0002] In today's era of rapid development of computer technology, data security has become increasingly important, prompting the emergence of a variety of technical means to protect data. Encrypting and compressing files is a common way to protect data. Because it is very difficult to obtain the data in the compressed package generated by encryption and compression without knowing the decompression password, brute force cracking is usually used, that is, decrypting by constantly trying different character combinations until the password is found.

[0003] In real-world environments, although encryption and compression can effectively prevent data leakage, in some cases, it can also become a means of leaking data. For some purpose, important data is encrypted and compressed for storage or copying in an attempt to escape security monitoring. When these encrypted compressed packages are intercepted and the source files need to be traced to assess the risk, brute force cracking is usually used to decrypt without knowing the password. This method is not only inefficient and resource-consuming, but also has a relatively low chance of success. Therefore, it may be impossible to make effective prevention and control measures because the risk level of data leakage cannot be assessed in a timely and accurate manner. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method, system, electronic device and medium for tracing the source files of an encrypted compressed package, which are used to completely or at least partially solve the technical problems existing in the above-mentioned prior art.

[0005] In order to achieve the above object, an embodiment of the present invention provides a method for tracing the source file of an encrypted compressed package, comprising:

[0006] Use file filter driver to monitor compression software and obtain the source file path read by the compression software and the compression package path created;

[0007] Send the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database;

[0008] When it is necessary to trace the source file of the encrypted compressed package, the corresponding source file path is queried from the database according to the md5 value of the encrypted compressed package to trace the source file of the encrypted compressed package.

[0009] Optionally, a file filter driver is used to monitor the compression software and obtain the source file path read by the compression software and the compression package path created, including:

[0010] The file filter driver sets the callback function ProcCallback for the process start and exit events by calling the PsSetCreateProcessNofifyRoutine function; and registers the OnPreCreate callback function for the file open event by calling FltRegisterFilter;

[0011] When the software is started, the ProcCallback function is triggered to determine the software type and create a memory linked list to store the read and write file paths;

[0012] When a software opens a file, the OnPreCreate function is triggered to determine the software type, so as to cache the file path opened or created this time into the corresponding memory linked list;

[0013] When the software exits, the ProcCallback function is triggered to notify the service program to enter the working state according to the software type.

[0014] Optionally, when software startup occurs, the ProcCallback function is triggered to determine the software type to create a memory linked list for storing read and write file paths, including:

[0015] When the software is started, the ProcCallback function is triggered to make a judgment based on the name of the started software. If it is compression software, the service program is notified to create a memory linked list for storing read and write file paths for the software, and then exit the callback function; if it is not compression software, the callback function is exited directly.

[0016] Optionally, when a software opens a file, the OnPreCreate function is triggered to determine the software type, so as to cache the file path opened or created this time into a corresponding memory linked list, including:

[0017] When the software opens a file, the OnPreCreate function is triggered. If the software is compression software, the OnPreCreate function sends the file path opened or created this time to the service program to cache it in the corresponding memory linked list, and then exits the callback function; if it is not compression software, the callback function is exited directly.

[0018] Optionally, the source file path read by the compression software and the created compression package path are sent to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database, including:

[0019] The service program queries the memory linked list created for the current compression software and performs binary format analysis on the created compressed package file;

[0020] Identify whether it is an encrypted compressed package from the characteristic flag in the file header. If it is not an encrypted compressed package, clear the data in the linked list; if it is an encrypted compressed package, use its md5 value as the primary key and store it in the database ZipFileMap table together with the md5 value of the source file; and store all file paths and corresponding md5 in the database FileInfo table.

[0021] Optionally, when the encrypted compressed package source file needs to be traced, the corresponding source file path is queried from the database according to the md5 value of the encrypted compressed package to trace the encrypted compressed package source file, including:

[0022] Use the encrypted compressed package md5 value as the query condition to query the md5 of the corresponding source file from the database ZipFileMap table;

[0023] According to the md5 value of the source file, the corresponding file path is queried from the FileInfo table in the database to query the source file in the encrypted compressed package.

[0024] Optionally, the calculation process of the md5 value includes:

[0025] The service program opens the file in binary data reading mode, reads all binary data in the file, and calls the md5 calculation function in the boost library for calculation; after the file is read, the md5 value is obtained.

[0026] On the other hand, the present invention also provides a source tracing system for encrypted compressed package source files, comprising:

[0027] A monitoring unit, used to monitor the compression software using a file filter driver, and obtain the source file path read by the compression software and the compression package path created;

[0028] A sending unit, used for sending the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database;

[0029] The tracing unit is used to query the corresponding source file path from the database according to the md5 value of the encrypted compressed package when it is necessary to trace the source file of the encrypted compressed package, so as to trace the source file of the encrypted compressed package.

[0030] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned method for tracing the source file of the encrypted compressed package when executing the program.

[0031] On the other hand, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for tracing the source file of the encrypted compressed package described above are implemented.

[0032] Through the above technical solution, all compression software running on the system is monitored by filtering drivers and service programs, and the paths of the created encrypted compressed packages and the paths of the source files read are saved. When it is necessary to trace the source of the encrypted compressed package, the source file path information can be quickly and accurately located, which helps to analyze the value of the data in the encrypted compressed package, and ultimately provides technical support for data protection and data leakage risk prevention and control.

[0033] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0035] Figure 1 It is an implementation flow chart of a method for tracing the source file of an encrypted compressed package provided by an embodiment of the present invention;

[0036] Figure 2 It is a process diagram of a monitoring compression software provided by an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of a source file traceability implementation process provided by an embodiment of the present invention;

[0038] Figure 4 It is a structural schematic diagram of a source tracing system for an encrypted compressed package source file provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to better understand the technical solution of this application, the professional terms involved in this application are now explained:

[0040] MiniFlter file filter driver is a very mature file operation monitoring driver framework provided by Windows system. By registering the callback processing function of the program's read and write operations on the file with the system, it can timely monitor the program's startup and exit events, as well as the program's read and write operations on the file. When the above events occur, the driver's callback processing function can be entered for business processing.

[0041] Win32 service program refers to an application that runs as a background service on the Windows system.

[0042] Message-Digest Algorithm 5 (MD5) is a widely used cryptographic hash function that produces a 128-bit hash value to ensure the integrity and consistency of information transmission.

[0043] Callback function is a widely used technique in programming, especially in asynchronous programming, event-driven programming and functional programming. A callback function is essentially a function passed as a parameter to another function. When the external function is executed, the callback function will be called to complete certain operations. This mechanism allows programmers to "register" certain code to be executed after an event or operation is completed, thereby achieving code decoupling and higher modularity.

[0044] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0045] See also Figure 1 As shown, it is a flowchart of an implementation method of tracing the source file of an encrypted compressed package provided by an embodiment of the present invention, including the following execution steps:

[0046] Step 100: Use a file filter driver to monitor the compression software, and obtain the source file path read by the compression software and the compression package path created.

[0047] Preferably, the file filter driver adopts MiniFilter file driver.

[0048] Specifically, when executing step 100, the following steps may be specifically performed:

[0049] S1000: The file filter driver sets the callback function ProcCallback for the process start and exit events by calling the PsSetCreateProcessNofifyRoutine function; and registers the OnPreCreate callback function for the file open event by calling FltRegisterFilter.

[0050] S1001: When software startup occurs, the ProcCallback function is triggered to determine the software type to create a memory linked list for storing read and write file paths.

[0051] Specifically, when executing step S1001, the following steps can be specifically performed: when the software is started, the ProcCallback function is triggered to make a judgment based on the name of the started software. If it is a compression software, the service program is notified to create a memory linked list for storing the read and write file paths for the software, and then the callback function is exited; if it is not a compression software, the callback function is exited directly.

[0052] For example, compression software such as 7z, winrar, etc., the service program is preferably a Win32 service program.

[0053] S1002: When a software opens a file, the OnPreCreate function is triggered to determine the software type, so as to cache the file path opened or created this time into a corresponding memory linked list.

[0054] Specifically, when executing step S1002, the following steps can be specifically performed: when the software opens a file, the OnPreCreate function is triggered. If the software is a compression software, the OnPreCreate function sends the file path opened or created this time to the service program to cache it in the corresponding memory linked list, and then exits the callback function; if it is not a compression software, exit the callback function directly.

[0055] S1003: When software exit occurs, the ProcCallback function is triggered to notify the service program to enter the working state according to the software type.

[0056] Step 101: Send the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into a database.

[0057] Specifically, when executing step 101, the following steps may be specifically performed:

[0058] S1010: The service program queries the memory linked list created for the current compression software, and performs binary format analysis on the created compression package file.

[0059] For example, a compressed file is a file in zip format.

[0060] S1011: Identify whether it is an encrypted compressed package from the feature flag in the file header. If it is not an encrypted compressed package, clear the data in the linked list; if it is an encrypted compressed package, use its md5 value as the primary key and store it together with the md5 value of the source file in the database ZipFileMap table; and store all file paths and corresponding md5 in the FileInfo table in the database.

[0061] In some embodiments, see Figure 2As shown, it is a schematic diagram of a process of monitoring compression software provided by an embodiment of the present invention, including: the driver calls the PsSetCreateProcessNofifyRoutine function to set the callback function ProcCallback of the process start and exit event; by calling FltRegisterFilter to register the OnPreCreate callback function of the file open event, the compression software start and exit event is monitored to notify the Win32 service program, and the compression software file read and write path is monitored to notify the Win32 service program, so that the Win32 service program creates a memory linked list when the software starts and reads and writes files to the memory linked list. When the software exits, a binary analysis is performed to determine whether it is encrypted. If so, the file md5 value is calculated and stored in the database together with the md5 value of the source file. If not, the data in the memory linked list is cleared.

[0062] Step 102: When it is necessary to trace the source file of the encrypted compressed package, the corresponding source file path is queried from the database according to the md5 value of the encrypted compressed package to trace the source file of the encrypted compressed package.

[0063] Specifically, when executing step 102, the following steps may be specifically performed:

[0064] S1020: Using the encrypted compressed package md5 value as a query condition, query the md5 of the corresponding source file from the ZipFileMap table in the database.

[0065] S1021: According to the md5 value of the source file, the corresponding file path is queried from the FileInfo table of the database to query the source file in the encrypted compressed package.

[0066] In some implementations, the calculation process of the md5 value includes: the service program opens the file in a binary data reading mode, reads all binary data of the file, and calls the md5 calculation function in the boost library for calculation; after the file is read, the md5 value is obtained.

[0067] In some embodiments, taking a zip file as an example, the binary analysis of whether a zip file is encrypted is implemented as follows: a compressed file in zip format is composed of three major data areas: a data area, a directory area, and a directory tail area. The data area is composed of one or more local file records, and each file record is composed of a file header, file data, and a file description. The 6th and 7th bytes in the file header structure are flags indicating whether it is encrypted. If both bytes are 0, it means it is not encrypted. The directory area is composed of one or more directory records. The 8th and 9th bytes in the directory record structure are flags indicating whether it is encrypted. If both bytes are 0, it means it is not encrypted. Therefore, to determine whether it is an encrypted zip file, it is necessary to traverse the file header structure of all data areas and the directory record structure of the directory area in turn, and determine whether the corresponding two bytes are both 0 to make a judgment. The implementation steps are as follows: 1) The Win32 program opens the zip file in a binary data reading mode. 2) Read the file header of each file record in the data area. If the 6th and 7th bytes in a file header are not 0, it means it is an encrypted zip file; 3) Read each directory record structure in the directory area. If the 8th and 9th bytes in a directory structure are not 0, it means it is an encrypted zip file; 4) If the above conditions are not met, it means it is not an encrypted zip file.

[0068] In some implementations, the file filter driver implementation process is as follows: 1) Install VS2008 development tools and WDK 7600 version driver development library on a 64-bit Windows 7 system. 2) Use VS2008 to write the MiniFilter driver zipfilter.c code file, and use the compilation tool in WDK to compile the zipfilter.sys driver. 3) In the zipfilter.c file, the DriverEntry function, FilerUnload function, ProcCallback function, and OnPreCreate function are mainly implemented. 4) In the DriverEntry function, global variable initialization is implemented; the callback processing function ProcCallback for registering the process start and exit events is implemented by calling PsSetCreateProcessNofifyRoutine; the file opening behavior preprocessing function OnPreCreate is implemented by calling FltRegisterFilter; 5) In the FilterUnload function, when the driver is uninstalled, the FltUnregisterFilter function is called to uninstall the filter preprocessing function. 6) In the ProcCallback function, when the process starts and exits, the path name of the process is obtained and notified to the Win32 service program. 7) In the OnPreCreate function, when the process opens a file, the path name of the process and the path of the opened file, as well as the opening parameters, are obtained and notified to the Win32 service program.

[0069] In some embodiments, see Figure 3 As shown, it is a schematic diagram of a source file traceability implementation process provided by an embodiment of the present invention, including a Win32 service program calculating the md5 value of an encrypted compressed package, taking the md5 value of the encrypted compressed package as a query condition, querying the md5 of the corresponding source file from the database, querying the corresponding file path from the database according to the md5 value of the source file, and outputting the encrypted compressed package source file path.

[0070] Through the MiniFilter file filtering driver and Win32 service program, all compression software running on the system can be monitored, and the paths of the created encrypted compressed packages and the paths of the source files read can be saved. When it is necessary to trace the source files of the encrypted compressed packages, the source file path information can be quickly and accurately located, which helps to analyze the value of the data in the encrypted compressed packages, and ultimately provides technical support for data protection and data leakage risk prevention and control.

[0071] See also Figure 4 FIG. 1 is a schematic diagram of a structure of a source tracing system for an encrypted compressed package source file provided by an embodiment of the present invention, including:

[0072] The monitoring unit 400 is used to monitor the compression software using a file filter driver and obtain the source file path read by the compression software and the compression package path created;

[0073] The sending unit 401 is used to send the source file path read by the compression software and the created compressed package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database;

[0074] The tracing unit 402 is used to query the corresponding source file path from the database according to the md5 value of the encrypted compressed package when it is necessary to trace the source file of the encrypted compressed package, so as to trace the source file of the encrypted compressed package.

[0075] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for tracing the source file of the encrypted compressed package described in any one of the above embodiments are implemented.

[0076] On the other hand, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for tracing the source file of the encrypted compressed package described in any of the above embodiments are implemented.

[0077] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0078] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0079] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0080] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0081] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0082] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0083] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0084] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0085] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for tracing the source of an encrypted compressed package source file, characterized in that: include: Use file filter driver to monitor compression software and obtain the source file path read by the compression software and the compression package path created; Send the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database; When the encrypted compressed package source file needs to be traced, the corresponding source file path is queried from the database according to the md5 value of the encrypted compressed package to trace the encrypted compressed package source file; Among them, the file filter driver is used to monitor the compression software, and obtain the source file path read by the compression software and the compression package path created, including: The file filter driver sets the callback function ProcCallback for the process start and exit events by calling the PsSetCreateProcessNofifyRoutine function; and registers the OnPreCreate callback function for the file open event by calling FltRegisterFilter; When the software is started, the ProcCallback function is triggered to determine the software type and create a memory linked list to store the read and write file paths; When a software opens a file, the OnPreCreate function is triggered to determine the software type, so as to cache the file path opened or created this time into the corresponding memory linked list; When the software exits, the ProcCallback function is triggered to notify the service program to enter the working state according to the software type.

2. The method for tracing the source of an encrypted compressed package source file according to claim 1, characterized in that: When the software is started, the ProcCallback function is triggered to determine the software type and create a memory linked list for storing read and write file paths, including: When the software is started, the ProcCallback function is triggered to make a judgment based on the name of the started software. If it is compression software, the service program is notified to create a memory linked list for storing read and write file paths for the software, and then exit the callback function; if it is not compression software, the callback function is exited directly.

3. The method for tracing the source of an encrypted compressed package source file according to claim 1, characterized in that: When a software opens a file, the OnPreCreate function is triggered to determine the software type, so as to cache the file path opened or created this time into the corresponding memory linked list, including: When the software opens a file, the OnPreCreate function is triggered. If the software is compression software, the OnPreCreate function sends the file path opened or created this time to the service program to cache it in the corresponding memory linked list, and then exits the callback function; if it is not compression software, the callback function is exited directly.

4. The method for tracing the source of an encrypted compressed package source file according to claim 1, characterized in that: Send the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database, including: The service program queries the memory linked list created for the current compression software and performs binary format analysis on the created compressed package file; Identify whether it is an encrypted compressed package from the characteristic flag in the file header. If it is not an encrypted compressed package, clear the data in the linked list; if it is an encrypted compressed package, use its md5 value as the primary key and store it in the database ZipFileMap table together with the md5 value of the source file; and store all file paths and corresponding md5 in the database FileInfo table.

5. The method for tracing the source of an encrypted compressed package source file according to claim 4, characterized in that: When the encrypted compressed package source file needs to be traced, the corresponding source file path is queried from the database according to the md5 value of the encrypted compressed package to trace the encrypted compressed package source file, including: Use the encrypted compressed package md5 value as the query condition to query the md5 of the corresponding source file from the database ZipFileMap table; According to the md5 value of the source file, the corresponding file path is queried from the FileInfo table in the database to query the source file in the encrypted compressed package.

6. The method for tracing the source of an encrypted compressed package source file according to claim 1, characterized in that: The calculation process of the md5 value includes: The service program opens the file in binary data reading mode, reads all binary data in the file, and calls the md5 calculation function in the boost library for calculation; after the file is read, the md5 value is obtained.

7. A system for tracing the source file of an encrypted compressed package applied to the method for tracing the source file of an encrypted compressed package according to any one of claims 1 to 6, characterized in that: include: A monitoring unit, used to monitor the compression software using a file filter driver, and obtain the source file path read by the compression software and the compression package path created; A sending unit, used for sending the source file path read by the compression software and the created compression package path to the service program, so that the service program saves the source file path and the md5 value corresponding to the source file into the database; The tracing unit is used to query the corresponding source file path from the database according to the md5 value of the encrypted compressed package when it is necessary to trace the source file of the encrypted compressed package, so as to trace the source file of the encrypted compressed package.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method for tracing the source file of the encrypted compressed package as described in any one of claims 1-6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for tracing the source file of an encrypted compressed package as described in any one of claims 1 to 6 are implemented.

Images