Office document leakage tracing method and system based on implicit information

Abstract

The invention discloses an implicit information-based office document leakage traceability processing method, which comprises the following steps of: when a decryption request from a user is received, decrypting a to-be-decrypted document to obtain a decrypted document, and judging whether the decrypted document is an office document or not; if yes, acquiring environment feature information of the current client, formatting the environment feature information to obtain formatted environment feature information, encrypting the formatted environment feature information to obtain encrypted environment feature information, and using the encrypted environment feature information as a user-defined attribute value, and generating a user-defined attribute for the decrypted document to obtain an updated document. The technical problems that an existing tracing method based on log records can only record operation behaviors, a decrypted document copy cannot be directly associated with a specific operation event, and direct evidence is difficult to provide after external leakage occurs can be solved.

Description

Technical Field

[0001] This invention relates to the field of computer information security technology, and more specifically, to a method and system for tracing the source of leaked office documents based on implicit information. Background Technology

[0002] In current enterprise information security environments, sensitive data is typically stored and transmitted as encrypted documents; authorized users can access the document content only after obtaining a decryption key or authorization verification. However, once the document is decrypted, it leaves the original security environment and enters a state of "uncontrolled decryption".

[0003] Therefore, document owners need a mechanism that can "implicitly monitor" the circulation of documents after they have been decrypted, so that when unauthorized dissemination occurs, the person responsible for the initial decryption can be accurately located through the document itself, thereby achieving effective source tracing and accountability for leaks.

[0004] Currently, there are various technical means to trace the source of leaked documents, mainly including the following: 1. A log-based tracing method that records user operations such as decryption and access to documents on the server side, and identifies potential perpetrators of the leak by analyzing the log information; 2. The source tracing method based on visible watermarks, which achieves source tracing of leakage behavior by embedding visible watermark information (such as user identifier, timestamp, etc.) in the document; 3. The source tracing method based on Office Open XML (OOXML) format utilizes the document structure features supported by Microsoft Office 2007 and later versions to embed source tracing information within the document, thereby enabling the tracing of the leak.

[0005] However, the aforementioned existing methods for tracing document leaks all have some significant drawbacks: First, the log-based tracing method can only record operational behavior and cannot directly associate the decrypted document copy with specific operational events, making it difficult to provide direct evidence after external leakage occurs. Secondly, the source tracing method based on explicit watermarks is easily noticed by users and affects the reading experience. Furthermore, the watermarks can be destroyed or removed through various means, leading to the failure of source tracing. Third, while the OOXML-based source tracing method offers some concealment, its applicability is limited. It only supports Microsoft Office 2007 and later document formats, and is incompatible with Microsoft Office 2003 and earlier document formats (such as .doc, .xls, .ppt). It is also unsuitable for WPS documents (such as .wps, .et, .dps) and PDF documents. Furthermore, users can easily remove the source tracing marks by simply saving the document in an earlier format, making it relatively difficult to resist removal. Summary of the Invention

[0006] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a method and system for tracing and processing leaked office documents based on implicit information. Its purpose is to solve the technical problems of existing log-based tracing methods, which can only record operational behaviors and cannot directly associate decrypted document copies with specific operational events, making it difficult to provide direct evidence after external leaks occur; the technical problems of existing watermark-based tracing methods, where watermarks are easily noticed by users and affect the reading experience, and can be destroyed or removed through various means, leading to tracing failure; and the technical problems of existing OOXML-based tracing methods, which have limited applicability and poor resistance to removal.

[0007] To achieve the above objectives, according to one aspect of the present invention, a method for tracing and processing leaked office documents based on implicit information is provided, comprising the following steps: (1) When a decryption request is received from a user, the document to be decrypted is decrypted to obtain the decrypted document, and it is determined whether the decrypted document is an office document. If it is, proceed to step (2); otherwise, the process ends. (2) Obtain the current client's environmental characteristics information; (3) The environmental feature information obtained in step (2) is formatted to obtain formatted environmental feature information; (4) Encrypt the formatted environmental feature information obtained in step (3) to obtain the encrypted environmental feature information; (5) Use the encrypted environmental feature information obtained in step (4) as the custom attribute value to generate custom attributes for the decrypted document obtained in step (1) in order to obtain the updated document; (6) When it is discovered that the updated document obtained in step (5) has been leaked, the document is processed by custom attribute extraction, decoding, decryption and graphical display in sequence to obtain the source tracing results of the document.

[0008] Preferably, in step (1), the determination of whether the decrypted document is an office document is made by checking the file extension of the document. If the file extension of the document is .doc, .docx, .xls, .xlsx, .ppt, .pptx, .wps, .wpt, .et, .ett, .dps, .dpt, or .pdf, then the document is an office document.

[0009] Preferably, the client's environmental characteristics information includes user identity information, client identifier, client network information, and client time information; The user identity information of the client is the operating system login name of the operating system on which the client is located; The client's identifier includes the client's MAC address and computer name; The client's network information is its IP address; The client's time information is the precise time displayed on the client.

[0010] Preferably, step (3) involves converting the environmental feature information obtained in step (2) into environmental feature information in JSON or XML format; Preferably, step (4) includes the following sub-steps: (4-1) Use the UTF8 encoding method to perform binary encoding processing on the formatted environmental feature information obtained in step (3) to obtain a byte stream; (4-2) Use a symmetric encryption algorithm to encrypt the byte stream obtained in step (4-1) to obtain the encrypted byte stream; (4-3) Convert the encrypted byte stream obtained in step (4-2) from binary to text to obtain pure ASCII text as encrypted environmental feature information.

[0011] Preferably, the symmetric encryption algorithm used in step (4-2) is the domestic commercial encryption algorithm SM4, in which the encryption mode is Cipher Block Chaining (CBC) mode, and the key and initial vector required for encryption are dynamically obtained from the key server through a network security protocol.

[0012] The binary-to-text conversion performed in step (4-3) uses Base64 encoding.

[0013] Preferably, step (5) includes the following sub-steps: (5-1) Create a custom attribute name; (5-2) Use the application programming interface (API) to obtain the list of custom attributes of the decrypted document obtained in step (1); (5-3) Determine whether the custom attribute name created in step (5-1) exists in the list of custom attributes obtained in step (5-2). If it exists, proceed to step (5-4); otherwise, proceed to step (5-5). (5-4) Modify the custom attribute name created in step (5-1) to obtain a new custom attribute name, and return to step (5-3). (5-5) Use the full path of the decrypted document obtained in step (1) as the file name fileName, use the custom attribute name obtained in step (5-3) as the attribute name propName, use the encrypted environment feature information obtained in step (4) as the custom attribute value propValue, and call the SetCustomProperties function in the API method to generate custom attributes for the decrypted document obtained in step (1), and add the custom attributes to the document to obtain the updated document.

[0014] Preferably, step (6) includes the following sub-steps: (6-1) Extract custom attributes from the updated document obtained in step (5) to obtain the custom attribute values; (6-2) Decode the custom attribute value obtained in step (6-1) using Base64 to obtain the decoded custom attribute value; (6-3) Use a symmetric decryption algorithm to decrypt the Base64 decoded custom attribute value obtained in step (6-2) to obtain the decrypted custom attribute value; (6-4) Format the decrypted custom attribute value obtained in step (6-3) to obtain the final custom attribute value; (6-5) Use a graphical method to display the final custom attribute value obtained in step (6-4) as the tracing result.

[0015] Preferably, in step (5-4), modifying the custom attribute name involves incrementing the version number in the custom attribute name. The process of extracting custom attributes from the updated document obtained in step (5) in step (6-1) is achieved by calling the GetCustomProperties function in the API method; The Base64 decoding in step (6-2) corresponds to the Base64 encoding in step (4-3); The symmetric decryption algorithm in step (6-3) corresponds to the symmetric encryption algorithm in step (4-2); The formatting process in step (6-4) corresponds to the formatting process in step (3).

[0016] According to another aspect of the present invention, an office document leakage tracing and processing system based on implicit information is provided, comprising: The first module is used to decrypt the document to be decrypted when a decryption request is received from the user, to obtain the decrypted document, and to determine whether the decrypted document is an office document. If it is, the process proceeds to the second module; otherwise, the process ends. The second module is used to obtain the current client's environmental characteristics information; The third module is used to format the environmental feature information obtained by the second module to obtain formatted environmental feature information. The fourth module is used to encrypt the formatted environmental feature information obtained from the third module in order to obtain the encrypted environmental feature information. The fifth module is used to generate custom attributes for the decrypted document obtained by the first module by using the encrypted environmental feature information obtained by the fourth module as custom attribute values, so as to obtain the updated document. The sixth module is used to extract, decode, decrypt, and graphically display custom attributes of a document when a leak is discovered in the updated document obtained from the fifth module, in order to obtain the source tracing results of the document.

[0017] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: 1. The present invention adopts step (2), which obtains the user and environment feature information of the current client. Therefore, it can solve the technical problem that the existing log-based tracing method cannot directly associate the decrypted document copy with the specific operation event and is difficult to provide direct evidence after external leakage. 2. The present invention adopts step (5), which uses environmental feature information as a custom attribute value to generate the decrypted document without changing the document content. It is invisible to the user and difficult to remove. Therefore, it can solve the technical problems of existing watermark-based source tracing methods being easily detected, easily removed, and affecting the reading experience. 3. The present invention adopts step (5), which generates custom attributes in the document. It not only supports common office documents such as Microsoft Office, WPS Office, and PDF, but also theoretically supports all document formats that support custom attributes. Therefore, it can solve the technical problem that the existing tracing method based on OOXML format only supports Microsoft Office 2007 document format. 4. Because the present invention employs step (1), it is automatically triggered when decrypting documents, and can be completed automatically without the user's active participation; 5. Because the present invention employs steps (4-1) to (4-3), it encrypts environmental feature information, thus possessing strong resistance to tampering and removal. 6. By employing step (5-1), this invention creates a custom attribute name without obvious meaning, enhancing the disguise and deception effect, and further improving the document's concealment. Attached Figure Description

[0018] Figure 1 This is a flowchart of the office document leakage tracing and processing method based on implicit information according to the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0020] The core concept of this invention lies in the fact that, at the moment of decrypting an office document, the system automatically and covertly collects, formats, and encrypts the decryptor's identity information and the environmental characteristics of the client used. This encrypted information is then written into the document as a hidden, custom attribute. This process requires no user intervention and does not alter the document's visible content, thus achieving "unobtrusive marking." When a leak occurs, the source of the leak can be accurately located by extracting and decrypting this hidden attribute, effectively solving the problems of security loss of control after document decryption and the susceptibility of traditional watermarks to damage.

[0021] like Figure 1 As shown, this invention provides a method for tracing and handling leaked office documents based on implicit information, including the following steps: (1) When a decryption request is received from a user, the document to be decrypted is decrypted to obtain the decrypted document, and it is determined whether the decrypted document is an office document. If it is, proceed to step (2); otherwise, the process ends. Specifically, in this step, we determine whether the decrypted document is an office document by checking its file extension. If the file extension is, for example, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .wps, .wpt, .et, .ett, .dps, .dpt, .pdf, etc., then the document is an office document.

[0022] (2) Obtain the current client's environmental characteristics information; Specifically, the client of this invention is a desktop computer or a laptop computer.

[0023] The client's environmental characteristics include user identity information, client identifier (ID), client network information, and client time information. Among them, the client's user identity information is the operating system login name of the operating system on which the client is located, the client identifier includes the client's MAC address, computer name, etc., the client's network information is the client's IP address, and the client's time information is the precise time displayed on the client (accurate to the second).

[0024] The advantage of this step (2) is that it obtains information including user identity information, client identifier (ID), client network information, and client time information, providing comprehensive and direct traceability results for step (6).

[0025] (3) The environmental feature information obtained in step (2) is formatted to obtain formatted environmental feature information; Specifically, this step involves converting the environmental feature information obtained in step (2) into environmental feature information in JSON or XML format.

[0026] (4) Encrypt the formatted environmental feature information obtained in step (3) to obtain the encrypted environmental feature information; This step includes the following sub-steps: (4-1) Use the UTF8 encoding method to perform binary encoding processing on the formatted environmental feature information obtained in step (3) to obtain a byte stream; (4-2) Use a symmetric encryption algorithm to encrypt the byte stream obtained in step (4-1) to obtain the encrypted byte stream; Specifically, the symmetric encryption algorithm used in this step is the domestic commercial encryption algorithm SM4, which uses Cipher-blockchaining (CBC) mode. The key and initialization vector (IV) required for encryption are not stored on the client, but are dynamically obtained from a designated key server through network security protocols (such as HTTPS).

[0027] (4-3) Convert the encrypted byte stream obtained in step (4-2) from binary to text to obtain pure ASCII text as encrypted environmental feature information; Specifically, the binary-to-text conversion performed in this step uses Base64 encoding.

[0028] The advantage of steps (4-1) to (4-3) above is that by performing binary encoding, encryption, and text conversion on the environmental feature information, not only can the plaintext of the environmental feature information be hidden, but malicious tampering can also be prevented.

[0029] (5) Use the encrypted environmental feature information obtained in step (4) as a custom attribute value to generate a custom attribute for the decrypted document obtained in step (1) in order to obtain the updated document (which has leaked traceability information). Specifically, this step includes the following sub-steps: (5-1) Create a custom attribute name; For example, this step creates a custom attribute name that includes a version number, such as sys_v1 or KSOProductBuildVer1, which respectively contain the version numbers v1 and Ver1; The advantage of this step (5-1) is that by using meaningless names such as sys_v1 or KSOProductBuildVer1 as custom attribute names, the disguise and deception effects are enhanced, further improving the document's concealment.

[0030] (5-2) Use the Application Programming Interface (API) to obtain the list of custom attributes of the decrypted document obtained in step (1); (5-3) Determine whether the custom attribute name created in step (5-1) exists in the list of custom attributes obtained in step (5-2). If it exists, proceed to step (5-4); otherwise, proceed to step (5-5). Specifically, checking whether the custom attribute name exists in this step is to prevent duplicate custom attribute names.

[0031] (5-4) Modify the custom attribute name created in step (5-1) to obtain a new custom attribute name, and return to step (5-3). Specifically, in this step, the custom attribute name is modified by incrementing the version number in the custom attribute name (for example, changing sys_v1 to sys_v2). This process ensures that the written custom attribute name is unique and avoids overwriting existing attributes.

[0032] (5-5) Use the full path of the decrypted document obtained in step (1) as the file name (FileName, i.e., fileName), use the custom attribute name obtained in step (5-3) as the attribute name (PropertyName, i.e. propName), use the encrypted environment feature information obtained in step (4) as the custom attribute value (PropertyValue, i.e. propValue), and call the SetCustomProperties function in the API method to generate custom attributes for the decrypted document obtained in step (1), and add the custom attributes to the document to obtain the updated document; Specifically, the detailed function definition of the SetCustomProperties API is: SetCustomProperties(string fileName, string propName, string propValue).

[0033] (6) When it is discovered that the updated document obtained in step (5) has been leaked, the document is processed by custom attribute extraction, decoding, decryption and graphical display in sequence to obtain the source tracing results of the document; Specifically, this step includes the following sub-steps: (6-1) Extract custom attributes from the updated document obtained in step (5) to obtain the custom attribute values; Specifically, the process of extracting custom attributes from the updated document obtained in step (5) in this step is achieved by calling the GetCustomProperties function in the API method. This step corresponds to step (5-5) and is its reverse operation.

[0034] (6-2) Decode the custom attribute value obtained in step (6-1) using Base64 to obtain the decoded custom attribute value; Specifically, the Base64 decoding in this step corresponds to the Base64 encoding in step (4-3).

[0035] (6-3) Use a symmetric decryption algorithm to decrypt the Base64 decoded custom attribute value obtained in step (6-2) to obtain the decrypted custom attribute value; Specifically, the symmetric decryption algorithm in this step corresponds to the symmetric encryption algorithm in step (4-2).

[0036] (6-4) Format the decrypted custom attribute value obtained in step (6-3) to obtain the final custom attribute value; Specifically, the formatting process in this step corresponds to the formatting process in step (3).

[0037] (6-5) Use a graphical method to display the final custom attribute value obtained in step (6-4) as the tracing result.

[0038] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for tracing and handling the leakage of office documents based on implicit information, characterized in that, Includes the following steps: (1) When a decryption request is received from a user, the document to be decrypted is decrypted to obtain the decrypted document, and it is determined whether the decrypted document is an office document. If it is, proceed to step (2); otherwise, the process ends. (2) Obtain the current client's environmental characteristics information; (3) The environmental feature information obtained in step (2) is formatted to obtain formatted environmental feature information; (4) Encrypt the formatted environmental feature information obtained in step (3) to obtain the encrypted environmental feature information; (5) Use the encrypted environmental feature information obtained in step (4) as the custom attribute value to generate custom attributes for the decrypted document obtained in step (1) in order to obtain the updated document; (6) When it is discovered that the updated document obtained in step (5) has been leaked, the document is processed by custom attribute extraction, decoding, decryption and graphical display in sequence to obtain the source tracing results of the document.

2. The method for tracing and processing leaked office documents based on implicit information according to claim 1, characterized in that, In step (1), it is determined whether the decrypted document is an office document by checking its file extension. If the file extension is .doc, .docx, .xls, .xlsx, .ppt, .pptx, .wps, .wpt, .et, .ett, .dps, .dpt, or .pdf, then the document is an office document.

3. The method for tracing and processing leaked office documents based on implicit information according to claim 1 or 2, characterized in that, The client's environmental characteristics include user identity information, client identifier, client network information, and client time information; The user identity information of the client is the operating system login name of the operating system on which the client is located; The client's identifier includes the client's MAC address and computer name; The client's network information is its IP address; The client's time information is the precise time displayed on the client.

4. The method for tracing and processing leaked office documents based on implicit information according to any one of claims 1 to 3, characterized in that, Step (3) is to convert the environmental feature information obtained in step (2) into environmental feature information in JSON or XML format; The method for tracing and processing leaked office documents based on implicit information according to claim 4 is characterized in that step (4) includes the following sub-steps: (4-1) Use the UTF8 encoding method to perform binary encoding processing on the formatted environmental feature information obtained in step (3) to obtain a byte stream; (4-2) Use a symmetric encryption algorithm to encrypt the byte stream obtained in step (4-1) to obtain the encrypted byte stream; (4-3) Convert the encrypted byte stream obtained in step (4-2) from binary to text to obtain pure ASCII text as encrypted environmental feature information.

5. The method for tracing and processing leaked office documents based on implicit information according to claim 5, characterized in that, The symmetric encryption algorithm used in step (4-2) is the domestic commercial encryption algorithm SM4, and the encryption mode is Cipher Block Chaining (CBC) mode. The key and initialization vector required for encryption are dynamically obtained from the key server through network security protocols.

6. In step (4-3), the binary-to-text conversion is performed using Base64 encoding.

7. The method for tracing and processing leaked office documents based on implicit information according to claim 6, characterized in that, Step (5) includes the following sub-steps: (5-1) Create a custom attribute name; (5-2) Use the application programming interface (API) to obtain the list of custom attributes of the decrypted document obtained in step (1); (5-3) Determine whether the custom attribute name created in step (5-1) exists in the list of custom attributes obtained in step (5-2). If it exists, proceed to step (5-4); otherwise, proceed to step (5-5). (5-4) Modify the custom attribute name created in step (5-1) to obtain a new custom attribute name, and return to step (5-3). (5-5) Use the full path of the decrypted document obtained in step (1) as the file name fileName, use the custom attribute name obtained in step (5-3) as the attribute name propName, use the encrypted environment feature information obtained in step (4) as the custom attribute value propValue, and call the SetCustomProperties function in the API method to generate custom attributes for the decrypted document obtained in step (1), and add the custom attributes to the document to obtain the updated document.

8. The method for tracing and processing leaked office documents based on implicit information according to claim 7, characterized in that, Step (6) includes the following sub-steps: (6-1) Extract custom attributes from the updated document obtained in step (5) to obtain the custom attribute values; (6-2) Decode the custom attribute value obtained in step (6-1) using Base64 to obtain the decoded custom attribute value; (6-3) Use a symmetric decryption algorithm to decrypt the Base64 decoded custom attribute value obtained in step (6-2) to obtain the decrypted custom attribute value; (6-4) Format the decrypted custom attribute value obtained in step (6-3) to obtain the final custom attribute value; (6-5) Use a graphical method to display the final custom attribute value obtained in step (6-4) as the tracing result.

9. The method for tracing and processing leaked office documents based on implicit information according to claim 8, characterized in that, In step (5-4), the custom attribute name is modified by incrementing the version number in the custom attribute name; The process of extracting custom attributes from the updated document obtained in step (5) in step (6-1) is achieved by calling the GetCustomProperties function in the API method; The Base64 decoding in step (6-2) corresponds to the Base64 encoding in step (4-3); The symmetric decryption algorithm in step (6-3) corresponds to the symmetric encryption algorithm in step (4-2); The formatting process in step (6-4) corresponds to the formatting process in step (3).

10. A system for tracing and processing leaked office documents based on implicit information, characterized in that, include: The first module is used to decrypt the document to be decrypted when a decryption request is received from the user, to obtain the decrypted document, and to determine whether the decrypted document is an office document. If it is, the process proceeds to the second module; otherwise, the process ends. The second module is used to obtain the current client's environmental characteristics information; The third module is used to format the environmental feature information obtained by the second module to obtain formatted environmental feature information. The fourth module is used to encrypt the formatted environmental feature information obtained from the third module in order to obtain the encrypted environmental feature information. The fifth module is used to generate custom attributes for the decrypted document obtained by the first module by using the encrypted environmental feature information obtained by the fourth module as custom attribute values, so as to obtain the updated document. The sixth module is used to extract, decode, decrypt, and graphically display custom attributes of a document when a leak is discovered in the updated document obtained from the fifth module, in order to obtain the source tracing results of the document.

Images