TECHNIQUES FOR DETECTING ENCRYPTED DATA

• US 20100287383A1
• Filed: 05/06/2009
• Published: 11/11/2010
• Est. Priority Date: 05/06/2009
• Status: Active Grant

• Current Assignee: Empire Technology Development LLC (Allied Inventors Management, LLC)
• Original Assignee: Empire Technology Development LLC (Allied Inventors Management, LLC)
• Inventors: Wolfe, Andrew, Conte, Thomas Martin
• Granted Patent: US 8,799,671 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

Techniques are described that generally relate to methods for detecting encryption status of a data file or data stream and selectively encrypting the data file or data stream based on the encryption status of the data file or data stream are generally disclosed. Example methods may include one or more of reading the data file or data stream from a data source, calculating a value of a property of the data file or data stream, comparing the calculated value with a threshold value to determine whether the file is encrypted or unencrypted, and encrypting files that are determined to be unencrypted.

Claims

1. A method for detecting an encryption status of a data file stored in a data source and selectively encrypting the data file based on the encryption status, the method comprising:

reading the data file from the data source;

calculating a value of a property of the data file read from the data source;

comparing the calculated value with a threshold value to determine whether the data file read from the data source is encrypted or unencrypted; and

encrypting the data file read from the data source when the data file read from the data source is determined to be unencrypted as a result of the comparison.

2. The method of claim 1, wherein

calculating the value of the property of the data file read from the data source comprises calculating frequencies of occurrence of a plurality of values in the data file read from the data source, and determining a measured uniformity by measuring uniformity of the calculated frequencies of occurrence;

and

wherein comparing the calculated value with the threshold value comprises comparing the measured uniformity to the threshold value.

3. The method of claim 2, further comprising calculating a Shannon entropy of the frequencies of occurrence, wherein the measured uniformity is measured by the Shannon entropy.

4. The method of claim 1, wherein

calculating the value of the property of the data file read from the data source comprises

calculating a distribution of frequencies of occurrence of a plurality of values in the data file read from the data source;

and

wherein comparing the calculated value with the threshold value comprises

comparing the distribution of frequencies of occurrence of the plurality of values in the data file to an average distribution of frequencies for a reference distribution to determine whether the distribution of frequencies of occurrence of the plurality of values in the data file differs significantly from the average distribution of frequencies for the reference distribution.

5. The method of claim 4, wherein the reference distribution is associated with a predetermined file type.

6. The method of claim 5, wherein the predetermined file type is a text file.

7. The method of claim 1, wherein reading the data file from the data source comprises:

determining file types of a plurality of data files within the data source;

selecting the data file from the plurality of data files within the data source based on the determined file types; and

reading the selected data file from the data source.

8. The method of claim 7, wherein

calculating the value of the property of the data file read from the data source comprises calculating frequencies of occurrence of a plurality of values in the data file read from the data source, and determining a measured uniformity by measuring uniformity of the calculated frequencies of occurrence;

wherein comparing the calculated value with the threshold value comprises comparing the measured uniformity to the threshold value; and

wherein selecting the data file from the plurality of data files within the data source based on the determined file types comprises;

comparing the determined file types of the plurality of data files to a set of preselected file types, wherein the preselected file types are chosen according to a likelihood that their encryption status is known; and

selecting the data file from among the plurality of data files having a file type different than the set of preselected file types.

9. The method of claim 1, wherein

calculating the value of the property of the data file read from the data source comprises calculating a measure of compressibility of the data file read from the data source;

and

comparing the calculated value with the threshold value comprises comparing the calculated measure of compressibility to a threshold compressibility value.

10. The method of claim 7, wherein

calculating the value of the property of the data file read from the data source comprises calculating a measure of compressibility of the data file read from the data source;

comparing the calculated value with the threshold value comprises comparing the calculated measure of compressibility to a threshold compressibility value; and

wherein selecting the data file from the plurality of data files within the data source based on the determined file types comprises;

comparing the determined file types of the plurality of data files to a set of preselected file types, wherein the preselected file types are chosen according to a likelihood that their compression status is known; and

selecting the data files from among the plurality of data files having a file type different than the preselected types.

11. A computing system arranged to detect an encryption status of a data file and selectively encrypt the data file based on the encryption status, the computing system comprising:

a data source including the data file stored therein; and

a data processor configured to;

retrieve the data file from the data source;

calculate a value of a property of the retrieved data file;

compare the calculated value with a threshold value to determine whether the retrieved data file is encrypted or unencrypted; and

encrypt the retrieved data file when the data file is determined as being unencrypted.

12. The computing system of claim 11, wherein

to calculate the value of the property of the retrieved data file, the data processor is configured to:

calculate frequencies of occurrence of a plurality of values in the data file retrieved from the data source, and

measure uniformity of the calculated frequencies of occurrence; and

to compare the calculated value with the threshold value, the data processor is configured to;

compare the measured uniformity against the threshold value.

13. The computing system of claim 11, wherein:

to calculate the value of a property of the retrieved data file, the data processor is configured to;

calculate a distribution of frequencies of occurrence of a plurality of data values in the data file retrieved from the data source, and

to compare the calculated value with the threshold value, the data processor is configured to;

compare the distribution of frequencies of occurrence of the plurality of data values in the data file to an average distribution of frequencies for a reference distribution to determine whether the distribution of frequencies of occurrence of the plurality of data values differs significantly from the average distribution of frequencies for the reference distribution.

14. The computing system of claim 13, wherein the reference distribution is associated with a predetermined file type.

15. The computing system of claim 11,

wherein to retrieve the data file from the data source, the data processor is configured to:

determine file types of a plurality of data files within the data source, and

select a subset of data files from the plurality of data files based on the determined file types;

wherein to calculate the value of the property of the retrieved data file, the data processor is configured to calculate the values of the properties for each of the data files from the subset of data files; and

wherein to compare the calculated value with the threshold value, the data processor is configured to compare the calculated values of the properties for each of the data files from the subset of data files to the threshold value to determine whether each retrieved data file is encrypted or unencrypted.

16. The computing system of claim 15, wherein to select the subset of data files from the plurality of data files based on the determined file types, the data processor is configured to

compare the determined file types of the plurality of data files to a set of preselected file types, wherein the set of preselected file types are chosen according to a likelihood that the encryption status of the file type is known;

and

select the subset of data files from the plurality of data files having file types different than the set of preselected file types.

17. The computing system of claim 11,

wherein to calculate the value of the property of the retrieved data file, the data processor is configured to calculate a measure of compressibility of the retrieved data file, and

wherein to compare the calculated value with the threshold value, the data processor is configured to compare the calculated measure of compressibility against a threshold compressibility value.

18. A computer accessible medium having stored thereon computer executable instructions for detecting an encryption status of a data file stored in a data source and selectively encrypting the data file based on the encryption status, when the computer executable instructions are executed by a processing unit the processing unit is configured to perform a procedure comprising:

reading the data file from the data source;

calculating a value of a property of the data file read from the data source;

comparing the calculated value with a threshold value to determine whether the data file read from the data source is encrypted or unencrypted; and

encrypting the data file read from the data source when the data file read from the data source is determined to be unencrypted as a result of the comparison.

19. The computer accessible medium of claim 18,

wherein calculating the value of the property of the data file read from the data source comprises calculating frequencies of occurrence of a plurality of values in the data file read from the data source, and determining a measured uniformity by measuring uniformity of the calculated frequencies of occurrence;

and

wherein comparing the calculated value with the threshold value comprises comparing the measured uniformity to the threshold value.

20. The computer accessible medium of claim 18,

wherein calculating the value of the property of the data file read from the data source comprises calculating a measure of compressibility of the data file read from the data source;

and

wherein comparing the calculated value with the threshold value comprises comparing the calculated measure of compressibility to a threshold compressibility value.