Content Filtering Before Data Encryption via API Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional information leak prevention technologies are inadequate in conducting real-time content analysis on encrypted or compressed data traffic, allowing malicious software to bypass security filters and fail to detect intrusions due to the lack of processes to check encrypted data, resulting in false positives and high decryption costs.
Innovation Solution
A system that performs deep content analysis on encrypted data by capturing raw data before encryption using a code injection mechanism, such as API hooking, to extract and analyze the data prior to encryption, allowing for real-time analysis and protection using predefined security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted before passing through security filters, then data confidentiality is improved, but security detection capability deteriorates because conventional filters cannot analyze encrypted content
Solution Approach 1:
The patent applies preliminary action by extracting and analyzing the encryption key before the encryption process occurs. The security filter intercepts the encryption operation, extracts the key using API hooking techniques, and performs content analysis on the plaintext data before it is encrypted. This allows security detection to occur in advance, maintaining detection capability while preserving data confidentiality during transmission.
Solution Approach 2:
The patent introduces an intermediary security filter that sits between the application and the encryption process. This filter uses API hooking to intercept encryption calls, extract keys, and perform content analysis without disrupting the normal encryption flow. The intermediary enables security inspection of encrypted data while maintaining the confidentiality benefits of encryption.
2Measurement precision
If brute force decryption is used to analyze encrypted data, then security detection capability is improved, but computational cost and time consumption increase significantly
Solution Approach 1:
The patent applies the extraction principle by removing the encryption key from the encrypted data stream and providing it separately to the security filter. Instead of attempting to decrypt data through computationally expensive brute force methods, the system extracts the key using API hooking techniques and uses it to decrypt only the portions of data needed for security analysis, dramatically reducing computational cost.
Solution Approach 2:
The patent creates a copy of the encryption key and provides it to the security filter through API hooking. This copy allows the filter to decrypt and analyze data content without requiring brute force decryption of the entire encrypted stream, significantly reducing the computational energy required for security detection.
3Ease of operation
If only behavior-based analysis is performed on encrypted data, then ease of operation is improved, but false positives increase due to inability to verify actual content
Solution Approach 1:
The patent performs preliminary content analysis by extracting and examining the actual data content before encryption occurs. The security filter intercepts the plaintext data, analyzes its content using predefined security policies, and only then allows encryption to proceed. This preliminary verification eliminates false positives by accurately identifying malicious content before it is encrypted, while maintaining ease of operation through automated API hooking.
Data Source
AI summary
A system (and a method) evaluates raw data from an application prior to modification of the raw data. The system inserts injection code into an application. The injection code is configured to hook an application. The application is configured to allow modification of the raw data. Modification includes encryption and/or compression. The system analyzes the raw data in a context of a predefined policy in response to the executing application reaching the injected code during execution. The system instructs the application to cease operating on the raw data in response to the predefined policy prohibiting further processing of the raw data or instructs the application to bypass the injection code in response to the predefined policy no prohibiting processing of the raw data.