Data unauthorized reading detection method and device based on hard disk smart information

Abstract

The invention discloses a data unauthorized reading detection method and device based on hard disk smart information, and belongs to the technical field of information security and confidentiality traceability inspection evidence obtaining, and the device comprises an equipment information acquisition unit, a stand-alone processing unit and a center management unit which are respectively deployed in a client host and a control center server; wherein the clients are provided with the equipment information acquisition units, the control center server is provided with a center management unit, the equipment information acquired by the networked clients is directly reported to the center management server for processing through a network interface, and the equipment information acquired by the non-networked clients is processed and checked through the stand-alone processing unit. The method solves the problem that the detection means in the prior art is difficult to timely and effectively detect that the data of the hard disk is read without authorization, and particularly timely detection and discovery are carried out under the scenes that the hard disk of a computer with physical protection is physically removed and the data are read by powering up.

Description

Technical Field

[0001] The present invention relates to the technical field of information security and confidentiality traceability inspection and evidence collection, and more specifically, to a method and device for detecting unauthorized reading of data based on hard disk smart information. Background Art

[0002] For computers that store important information, enterprises usually adopt a variety of technical means to prevent unauthorized access to information, such as software-based file access control, physical protection based on seals or locks, etc. However, such methods are easy to bypass and cannot be detected and discovered in time. Typical scenarios include: breaking through physical protection by purchasing or forging the same seal, forging keys, or cracking the lock password, once the chassis is opened, the hard disk can be removed, and the software-based protection can be bypassed by powering on other devices, reading the hard disk data and then installing it back to the original device, achieving data theft, and cannot be actively detected and discovered in time. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method and device for detecting unauthorized data reading based on hard disk smart information, which solves the problem that the prior art detection means are difficult to timely and effectively detect unauthorized reading of data from the hard disk, especially when a computer with physical protection has its hard disk physically removed and powered on to steal data.

[0004] The object of the present invention is achieved through the following solutions:

[0005] A data unauthorized reading detection device based on hard disk smart information includes: a device information collection unit, a stand-alone processing unit and a central management unit, which are respectively deployed on a client host and a control center server;

[0006] Among them, the client is deployed with the device information collection unit, the control center server is deployed with a central management unit, the device information collected by the networked client is directly reported to the central management server for processing through the network interface, and the device information collected by the unconnected client is processed and the results are viewed through a single-machine processing unit.

[0007] Furthermore, the device information collection unit is used to execute the following process:

[0008] S1, the device information collection unit collects basic information of the device and hard disk;

[0009] S2, the device information collection unit determines whether it is the first time to run on the device. If it is the first time to run, jump to step S3, otherwise jump to step S4;

[0010] S3, register the device information collection unit as a system service and set it to start with the system, set the baseline mark of the collected information in step S1 and save it to the specified location of the registry, if there is a network, report the information with the baseline mark to the central management unit through the network, and jump to step S6;

[0011] S4, reads the baseline information in the registry, reads the operating system log, and reads the hard disk quantity and detailed information;

[0012] S5, comparing the changes in the number of hard disks and detailed information with the baseline information, counting the changes in the number of times the operating system is powered on since the baseline information was established, reporting the changes and the collected information to the central management unit through the network, and updating and saving the detection time in the registry;

[0013] S6, end.

[0014] Furthermore, the basic information of the device and hard disk includes: time, computer name, login user name, number of hard disks and detailed information when each hard disk is collected, as well as identification information corresponding to the device asset and the person using the asset.

[0015] Furthermore, the central management unit is used to execute the following process:

[0016] SS1, the central management unit loads the latest configuration information, monitors the designated port, and provides the device information collection unit with information collection services and result display services for management personnel through the monitoring port;

[0017] SS2, starts the information processing thread, cyclically parses the reported collection information and web page access requests, and processes the requests from the collection client and the customer access respectively;

[0018] SS3, receiving the information collected by the device information collection unit and storing it in a database;

[0019] SS4, starts the detection and analysis thread, cyclically analyzes the information of each client, and comprehensively determines whether the hard disk has changed and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated;

[0020] SS5, loops steps SS3 and SS4.

[0021] Furthermore, the stand-alone processing unit is used to execute the following process:

[0022] SSS1, the single-machine processing unit loads the latest configuration information, reads the information collected by the device information collection unit saved in the registry, parses it and stores it in the database;

[0023] SSS2 starts the detection and analysis thread, cyclically analyzes the client information, and comprehensively determines whether hard disk changes have occurred and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated.

[0024] Furthermore, the device information collection unit is arranged on the networked client and the non-networked client.

[0025] Furthermore, the central processing unit is arranged in the control center server.

[0026] Furthermore, the stand-alone processing unit is arranged on a client that is not connected to the Internet.

[0027] A method for detecting unauthorized reading of data based on hard disk smart information is provided. The method includes installing a software detection device on a computer device to be protected, collecting the hard disk information of the protected device as an initial baseline when the device is first run, and comparing the hard disk information changes and the changes between the device usage records and the initial baseline each time the device is powered on, so as to realize timely detection of unauthorized power-on and information reading of the hard disk. The method specifically includes the following sub-steps:

[0028] First, deploy a central processing unit on the control center server, deploy a device information collection unit on the networked client, and deploy an information collection unit and a stand-alone processing unit on the non-networked device;

[0029] Then, the client host chassis with the information collection unit installed is opened, the hard disk is removed and installed on the host simulating the attacker, the system is powered on and the information on the copied hard disk is read, then the system is shut down, the hard disk is removed and restored to the original host;

[0030] Finally, the connected clients and the non-connected clients are turned on respectively. For the connected clients, the administrator uses the web management client to view the alarm information that the hard disk of the connected client has been powered on and read on other machines; for the non-connected clients, the administrator uses the single-machine processing unit to view the alarm information that the host hard disk has been powered on and read on other machines.

[0031] Furthermore, the alarm information details are used to trace the size and time of data stolen from the host hard disk.

[0032] The beneficial effects of the present invention include:

[0033] (1) The present invention installs a software detection device on a computer device that needs to be protected. When it is run for the first time, the hard disk information of the protected device is collected as an initial baseline. Each time the device is turned on, the hard disk information changes and the device usage records are compared with the initial baseline, thereby achieving timely detection of unauthorized power-on and information reading of the hard disk. The present invention is suitable for detecting unauthorized reading of hard disk information of important devices.

[0034] (2) The present invention can be widely used and deployed on computers that store important information in an enterprise, forming a timely detection capability after unauthorized reading of data, thereby improving the security of enterprise data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0036] Figure 1 A schematic diagram of application deployment according to an embodiment of the present invention;

[0037] Figure 2 The figure is a flow chart of the method steps of an embodiment of the present invention. DETAILED DESCRIPTION

[0038] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0039] In the device embodiment of the present invention, a small local area network is provided, which includes 4 hosts (1 networked client simulating user use, 1 non-networked client simulating user use, 1 web management client simulating system administrator use, 1 host simulating attacker use), 1 control center server, and network devices. Figure 2 As shown, the method of the embodiment of the present invention is used to detect and warn hard disk information theft, which specifically includes the following steps:

[0040] First, a central processing unit is deployed on the control center server, a device information collection unit is deployed on the networked client, and an information collection unit and a stand-alone processing unit are deployed on the non-networked device.

[0041] Then, the client host chassis with the information collection unit installed is opened, the hard disk is removed and installed on the host simulating the attacker, the system is powered on and the information on the copied hard disk is read and then shut down, the hard disk is removed and restored to the original host.

[0042] Finally, the connected client and the unconnected client are powered on separately. For the connected client, the administrator uses the web management client to view the alarm information that the hard disk of the connected client has been powered on and read on other machines. For the unconnected client, the administrator uses the stand-alone processing unit to view the alarm information that the host hard disk has been powered on and read on other machines. Furthermore, through the alarm information details, combined with other information, the size of the data stolen from the host hard disk and the time of the theft can be traced.

[0043] Figure 1 The networked and unnetworked clients indicate that there are computers in the network whose hard disks need to be protected. Both need to deploy device information collection units. Unnetworked clients also need to deploy stand-alone processing units. The web management client indicates the computer used by the management personnel to view the hard disk inspection result information and alarm information of the protected computers in the entire network. The control center server indicates the server deployed with the central processing unit, which is used to centrally collect, process and respond to requests from the clients.

[0044] It should be noted that within the scope of protection defined in the claims of the present invention, the following embodiments can be combined and / or expanded or replaced in any logical way from the above specific implementation methods, such as disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0045] Example 1

[0046] A data unauthorized reading detection device based on hard disk smart information includes: a device information collection unit, a stand-alone processing unit and a central management unit, which are respectively deployed on a client host and a control center server;

[0047] Among them, the client is deployed with the device information collection unit, the control center server is deployed with a central management unit, the device information collected by the networked client is directly reported to the central management server for processing through the network interface, and the device information collected by the unconnected client is processed and the results are viewed through a single-machine processing unit.

[0048] Example 2

[0049] Based on Example 1, the device information collection unit is used to perform the following process:

[0050] S1, the device information collection unit collects basic information of the device and hard disk;

[0051] S2, the device information collection unit determines whether it is the first time to run on the device. If it is the first time to run, jump to step S3, otherwise jump to step S4;

[0052] S3, register the device information collection unit as a system service and set it to start with the system, set the baseline mark of the collected information in step S1 and save it to the specified location of the registry, if there is a network, report the information with the baseline mark to the central management unit through the network, and jump to step S6;

[0053] S4, reads the baseline information in the registry, reads the operating system log, and reads the hard disk quantity and detailed information;

[0054] S5, comparing the changes in the number of hard disks and detailed information with the baseline information, counting the changes in the number of times the operating system is powered on since the baseline information was established, reporting the changes and the collected information to the central management unit through the network, and updating and saving the detection time in the registry;

[0055] S6, end.

[0056] Example 3

[0057] Based on Example 2, the basic information of the device and hard disk includes: time, computer name, login user name, number of hard disks and detailed information when each hard disk is collected, as well as identification information corresponding to the device asset and the person using the asset.

[0058] Example 4

[0059] Based on Example 1, the central management unit is used to execute the following process:

[0060] SS1, the central management unit loads the latest configuration information, monitors the designated port, and provides the device information collection unit with information collection services and result display services for management personnel through the monitoring port;

[0061] SS2, starts the information processing thread, cyclically parses the reported collection information and web page access requests, and processes the requests from the collection client and the customer access respectively;

[0062] SS3, receiving the information collected by the device information collection unit and storing it in a database;

[0063] SS4, starts the detection and analysis thread, cyclically analyzes the information of each client, and comprehensively determines whether the hard disk has changed and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated;

[0064] SS5, loops steps SS3 and SS4.

[0065] Example 5

[0066] Based on Example 1, the stand-alone processing unit is used to execute the following process:

[0067] SSS1, the single-machine processing unit loads the latest configuration information, reads the information collected by the device information collection unit saved in the registry, parses it and stores it in the database;

[0068] SSS2 starts the detection and analysis thread, cyclically analyzes the client information, and comprehensively determines whether hard disk changes have occurred and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated.

[0069] Example 6

[0070] Based on the embodiment 1, the device information collection unit is arranged on the networked client and the non-networked client.

[0071] Example 7

[0072] Based on Example 1, the central processing unit is set in the control center server.

[0073] Example 8

[0074] Based on Embodiment 1, the stand-alone processing unit is arranged on a client that is not connected to the Internet.

[0075] Example 9

[0076] A method for detecting unauthorized reading of data based on hard disk smart information is provided. The method includes installing a software detection device on a computer device to be protected, collecting the hard disk information of the protected device as an initial baseline when the device is first run, and comparing the hard disk information changes and the changes between the device usage records and the initial baseline each time the device is powered on, so as to realize timely detection of unauthorized power-on and information reading of the hard disk. The method specifically includes the following sub-steps:

[0077] First, deploy a central processing unit on the control center server, deploy a device information collection unit on the networked client, and deploy an information collection unit and a stand-alone processing unit on the non-networked device;

[0078] Then, the client host chassis with the information collection unit installed is opened, the hard disk is removed and installed on the host simulating the attacker, the system is powered on and the information on the copied hard disk is read, then the system is shut down, the hard disk is removed and restored to the original host;

[0079] Finally, the connected clients and the non-connected clients are turned on respectively. For the connected clients, the administrator uses the web management client to view the alarm information that the hard disk of the connected client has been powered on and read on other machines; for the non-connected clients, the administrator uses the single-machine processing unit to view the alarm information that the host hard disk has been powered on and read on other machines.

[0080] Example 10

[0081] Based on Example 9, the size and time of data stolen from the host hard disk are traced back using the details of the alarm information.

[0082] The units involved in the embodiments of the present invention may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, limit the units themselves.

[0083] According to one aspect of an embodiment of the present invention, a computer program product or a computer program is provided, the computer program product or the computer program includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above various optional implementations.

[0084] As another aspect, an embodiment of the present invention further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

Claims

1. A data unauthorized reading detection device based on hard disk smart information, characterized in that: include: Equipment information collection unit, stand-alone processing unit and central management unit, which are deployed on the client host and control center server respectively; Among them, the client is deployed with the device information collection unit, the control center server is deployed with a central management unit, the device information collected by the networked client is directly reported to the central management server for processing through the network interface, and the device information collected by the unconnected client is processed and the results are viewed through a single-machine processing unit.

2. The device for detecting unauthorized reading of data based on hard disk smart information according to claim 1, characterized in that: The device information collection unit is used to execute the following process: S1, the device information collection unit collects basic information of the device and hard disk; S2, the device information collection unit determines whether it is the first time to run on the device. If it is the first time to run, jump to step S3, otherwise jump to step S4; S3, register the device information collection unit as a system service and set it to start with the system, set the baseline mark of the collected information in step S1 and save it to the specified location of the registry, if there is a network, report the information with the baseline mark to the central management unit through the network, and jump to step S6; S4, reads the baseline information in the registry, reads the operating system log, and reads the hard disk quantity and detailed information; S5, comparing the changes in the number of hard disks and detailed information with the baseline information, counting the changes in the number of times the operating system is powered on since the baseline information was established, reporting the changes and the collected information to the central management unit through the network, and updating and saving the detection time in the registry; S6, end.

3. The data unauthorized reading detection device based on hard disk smart information according to claim 2 is characterized in that: The basic information of the device and hard disk includes: time, computer name, login user name, number of hard disks and detailed information of each hard disk when it is collected, as well as identification information corresponding to the device asset and the person who uses the asset.

4. The data unauthorized reading detection device based on hard disk smart information according to claim 1 is characterized in that: The central management unit is used to execute the following process: SS1, the central management unit loads the latest configuration information, monitors the designated port, and provides the device information collection unit with information collection services and result display services for management personnel through the monitoring port; SS2, starts the information processing thread, cyclically parses the reported collection information and web page access requests, and processes the requests from the collection client and the customer access respectively; SS3, receiving the information collected by the device information collection unit and storing it in a database; SS4, starts the detection and analysis thread, cyclically analyzes the information of each client, and comprehensively determines whether the hard disk has changed and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated; SS5, loops steps SS3 and SS4.

5. The data unauthorized reading detection device based on hard disk smart information according to claim 1 is characterized in that: The stand-alone processing unit is used to execute the following process: SSS1, the single-machine processing unit loads the latest configuration information, reads the information collected by the device information collection unit saved in the registry, parses it and stores it in the database; SSS2 starts the detection and analysis thread, cyclically analyzes the client information, and comprehensively determines whether hard disk changes have occurred and whether the hard disk change information is normal based on historical information, and generates detection result information. For abnormal information, additional alarm information is generated.

6. The device for detecting unauthorized reading of data based on hard disk smart information according to claim 1, characterized in that: The device information collection unit is arranged on a networked client and a non-networked client.

7. The device for detecting unauthorized reading of data based on hard disk smart information according to claim 1, characterized in that: The central processing unit is arranged in the control center server.

8. The device for detecting unauthorized reading of data based on hard disk smart information according to claim 1, characterized in that: The stand-alone processing unit is arranged on a client that is not connected to the Internet.

9. A method for detecting unauthorized data reading based on hard disk smart information, characterized in that: By installing a software detection device on the computer device that needs to be protected, the hard disk information of the protected device is collected as the initial baseline when it is first run. Each time the device is turned on, the hard disk information changes and the changes between the device usage records and the initial baseline are compared to achieve timely detection of unauthorized power-on and information reading of the hard disk. The specific sub-steps include: First, deploy a central processing unit on the control center server, deploy a device information collection unit on the networked client, and deploy an information collection unit and a stand-alone processing unit on the non-networked device; Then, the client host chassis with the information collection unit installed is opened, the hard disk is removed and installed on the host simulating the attacker, the system is powered on and the information on the copied hard disk is read, then the system is shut down, the hard disk is removed and restored to the original host; Finally, the connected clients and the non-connected clients are turned on respectively. For the connected clients, the administrator uses the web management client to view the alarm information that the hard disk of the connected client has been powered on and read on other machines; for the non-connected clients, the administrator uses the single-machine processing unit to view the alarm information that the host hard disk has been powered on and read on other machines.

10. The device for detecting unauthorized reading of data based on hard disk smart information according to claim 9, characterized in that: Use the alarm information details to trace the size and time of data stolen from the host hard disk.

Images