KR101977008B1 - Data hiding method using timestamp information capable of correcting time distortion - Google Patents

Abstract

The present invention relates to a data hiding method capable of safely storing data without distortion of time information when hiding the data in a portion representing a time less than one second in timestamp information of a file managed by a Windows NTFS file system. According to the present invention, the data hiding method comprises the steps of: (a) encoding data to be hidden; (b) extracting timestamp information from an arbitrary file; (c) removing lower section bits of the extracted timestamp information with a mask bit to set a data hiding area; (d) performing bit logical sum (OR) operation between the encoded data and the timestamp information having the data hiding area set thereto to store the data in the data hiding area; and (e) correcting information of the timestamp storing the data therein when the timestamp information storing the data therein in the step (d) is different from the timestamp information extracted in the step (b). Accordingly, a predetermined amount of data can be safely stored in timestamp data used in a Windows NTFS file system to be protected from external access or detection without distortion of time information.

Description

 [0001] The present invention relates to a data hiding method using timestamps capable of correcting time information distortion,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for hiding data in a file of a computer or a mobile terminal to prevent access and detection of security data by an external device, And more particularly to a data hiding method capable of safely storing data without distortion.

Data hiding technology has been attracting attention in recent years because of its focus on various applications. Data is hidden, for example, to prevent unauthorized external access or data modification or copying, such as serial code attached to audio, video, and image files, which is not identified by the naked eye.

There are various methods of hiding data in a computer. For example, there is a method of hiding data using an alternative data stream (ADS) instead of a normal storage location of a file in a Windows file system, and a method of encrypting a file There are programs such as TrueCrypt, Windows BitLocker that encrypts the entire disk, Camouflage, which is a steganography program that stores the information to be transferred in a file, and Openstego. .

Korean Patent Laid-Open Publication Nos. 2001-0044804 and 2006-0112682 propose a technique for hiding and restoring data in an image. Korean Patent Publication No. 10-0734940 and Publication No. 2006- 0062043 discloses an optional data hiding method in a mobile communication terminal that allows a user to set not to display data that he does not want to be exposed to others.

The inventor of the present invention has developed a method of hiding data using timestamp information in Korean Patent Laid-Open Publication No. 2018-0072158. The present invention relates to a method of hiding data in time stamp information of a file managed by a Windows NTFS file system. However, in the above-mentioned prior art, an error may occur in the process of allocating 2 bytes to data hiding, and will be described below.

The data structure of the Windows NTFS file system uses decimal 7 digits in millisecond and nano-second values mmm: nnnn for less than 1 second, which can be an integer value between 0,000,000 and 9,999,999 . That is, since the integer value 1 is 100 nanoseconds, 1 second is expressed as 10,000,000 nanoseconds, and when converting a 7-digit decimal integer value of less than 1 second to a hexadecimal value, the number is 0 to 0x98967F, . If 24 bits are used with three 8-byte codes in order to hide the data therein, since the overlapping part occurs in one bit of the upper one, in the prior art, data in 8 bytes and 2 data are used to securely hide the data in the time stamp Method.

However, since the number representing the time stamp is calculated in units of decimal integers and represents an integer value incremented by 1 every 100 nanoseconds, it represents a time of 1 second or more, and a significant bit value may be included in the lower 16 bits , The problem arises that the boundary of the bit unit is not completely divided.

In other words, if all values less than 1 second are all 0, then in the case of 2018-08-31 03:34:56 (UTC), 131,801,600,960,000,000 is represented as an integer value. If this is expressed in hexadecimal, it becomes 0x01D440DB960C7000. Since the lower 16 bits are indicated as "7000", if it is arbitrarily changed, 1 second fluctuation occurs at the beginning. Another example, 2018-04-28 10:35:58 (UTC), has this problem, which is expressed as 131,693,853,580,000,000 in decimal and 0x01D3DEDCB1BCFB00 in hexadecimal. To hide data in the lower 16 bits, all of them should be "0x0000", but in reality they have a meaningful value of "0xFB00" and an error of 1 second occurs from the original value.

Korean Patent Laid-Open Publication No. 2001-0044804 (entitled " Method for Hiding and Restoring Secret Data in Picture Files " Korean Unexamined Patent Application Publication No. 2006-0112682 (entitled " System and method for performing robust reversible data hiding and data restoration in a spatial domain, 2006.11.01) Korean Patent Registration No. 10-0734940 (Title of the Invention: Method of setting data hiding function of a mobile communication terminal and its device. 2007.07.06) Korean Patent Laid-Open Publication No. 2006-0062043 (Title: Method for hiding optional data in a mobile communication terminal 2006.06.12) Korean Patent Laid-Open Publication No. 2018-0072158 entitled " Method for hiding data using time stamp information. &Quot;

It is therefore an object of the present invention to provide a method and apparatus for storing and hiding content in only 16 bits in time stamp information of a file managed by a Windows NTFS file system, The present invention also provides a data hiding method capable of safely storing data without distorting time information while extending the technology to 24 bits.

The method includes the steps of: (a) encoding data to be hidden; (b) extracting time stamp information from an arbitrary file; (c) assigning a least significant bit of the extracted time stamp information to a mask (D) storing data in a data-hidden area by performing an OR operation on the encoded data and the timestamp information set in the data-hidden area, and (e) and correcting information of the time stamp in which the data is stored if the time stamp information stored in the step (d) differs from the time stamp information extracted in the step (b), using a time stamp capable of correcting the time information distortion Provides a way to hide data.

In the present invention, the step (e) may perform an addition / subtraction operation on the most significant bit value of the data hidden area and / or the most significant bit value in the data hidden area to correct the information of the time stamp on which the data is stored.

In the present invention, the acceleration / deceleration calculation may be +1 second or -1 second.

In the present invention, the data-hidden area is lower-order 16 bits, and the lower seventeenth bit is added and subtracted.

In the present invention, the data hidden area is lower 24 bits, and the lower 24th and / or lower 25th bits are added / subtracted.

According to the present invention, in displaying the time stamp data (year, month, day, hour, minute, second) used in the Windows NTFS file system, many The amount of data can be hidden and safely stored without being accessed or detected by the outside and without distorting the time information.

FIG. 1 is a flowchart illustrating a data hiding method using time stamps capable of correcting time information distortion according to the present invention.
FIGS. 2 to 4 are screens for explaining each step of the first embodiment of the present invention in which character string data is hidden in the lower 16 bits of the time stamp of the target file.
5 to 7 are screens for explaining each step of the second embodiment of the present invention in which the character string data is hidden in the lower 24 bits of the timestamp of the target file.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the following description of the embodiment, when it is determined that technical characteristics of the present invention may be unnecessarily obscured by those skilled in the art such as well-known functions and configurations well known in the art, It will be omitted.

FIG. 1 is a flowchart illustrating a data hiding method using time stamps capable of correcting time information distortion according to the present invention. Referring to FIG. 1, a data hiding method according to the present invention includes encoding (S10) data to be hidden, extracting time stamp information from an arbitrary file (S20), extracting the lowest- (Step S30) of setting a data-hidden area by removing a bit in the data-hidden area by performing a bit-OR operation on the encoded data and the timestamp information set in the data-hidden area, In step S40, if the time stamp information stored in step S40 is different from the time stamp information extracted in step S20, the information on the time stamp on which the data is stored is corrected (step S50).

The data to be hidden in step S10 of encoding the data to be hidden may be applied to various data types, such as ASCII codes encoded with 8 bits per character or Unicode encoded with 16 bits per character if the data is characters .

The step S20 of extracting the time stamp information from an arbitrary file selects any file to store data from a mobile terminal such as a terminal, a computer or a smart phone for storing data. The selected file can be selected regardless of the file type, if it is a file operated by the Windows NTFS file system. If the amount of data to be hidden is large, a plurality of files can be selected. If a plurality of files are selected, the file order in which data is stored is stored as separate data. When the file is selected, the time stamp information of the file is extracted. The time stamp is divided into the attribute group Si and the name group Fn as information on the file creation time Tc, the modification time Tm, the MFT entry modification time Te, and the read time Ta. That is, the four pieces of information Tc, Tm (Tc, Tm, Tm), which are attribute times of the four pieces of information (Tc, Tm, Te, Ta) and the file names ($ FILE_NAME, Fn) , Te, and Ta, respectively.

A step S30 of removing the lower-order section bits of the extracted time stamp information with mask bits to set a data-hidden area includes a lower-order section bit of the 64-bit time stamp information, that is, lower 16 bits or lower 24 bits To " 0 " so that the encoded data can be stored. To do this, perform an AND operation with mask bits of 0xFFFFFFFFFFFF0000 (when storing in the lowermost 16 bits) or 0xFFFFFFFFFF000000 (when storing in the lowermost 24 bits). If the data is stored in 24 bits, more data can be stored. However, since the data overflows or shrinks at 24 bits, there is a time distortion problem due to 1 second increase or 1 second decrease. And / or the value of the 25 < th > bit.

Next, a step (S40) of performing bitwise OR (OR) operation between the encoded data and the time stamp information set in the data-hidden area to store the data in the data-hidden area is performed in a step S40, And storing the data. If the length of the encoded data is less than or equal to the data-hidden area (for example, the encoded data is 16 bits or 8 bits and the data-hidden area is 16 bits), the encoded data and the time- OR), and the data is stored in the data-hidden area of any extracted time stamp information. If the length of the encoded data is larger than the data-hidden area (for example, if the encoded data is 192 bits and the data-hidden area is 24 bits) Tm, Te, Ta) from the standard information and the file name of the corresponding file, which are extracted by the number of divided data files (8 pieces) (Eight time stamp information in total) and the divided data are sequentially subjected to OR operation, thereby sequentially storing the data in a plurality of time stamp information.

Next, if there is a difference between the time stamp information in which the data is stored and the time stamp information extracted before the data storage, step S50 is performed to correct information of the time stamp in which the data is stored. In this step, the time stamp information is changed according to the data storage to determine whether the time information is distorted. If the time information is distorted, the step is performed so as to be equal to the time stamp information before data storage through bit correction calculation. More specifically, when the time stamp before the data hiding is based on the time stamp, the time stamp is decreased by the increased time and when the time is decreased by the decreased time. Since the area used is less than 1 second, the maximum value of the increase and decrease in time is 1 second each. If the least significant 16 bits of the time stamp are set to the data-hidden area, the distortion of the time information can be corrected by adding / subtracting the lowermost seventeenth bit, which is the upper bit of the data-hidden area, If it is set as a hidden area, the distortion of the time information can be corrected by adding / subtracting the least significant 25th bit, which is the upper bit of the data hidden area, and / or the 24th most significant bit of the data hidden area, An example will be described in detail. On the other hand, for the integrity of the time information, whether or not the time stamp is time-distorted should be performed for every file in which data is stored.

Hereinafter, a data hiding method according to the present invention will be described in detail. The experimental environment of the embodiment is as follows.

<< Experimental environment >>

- Operating System: Windows 10 Pro (Ver 10.0.17134.165)

- Disk format: NTFS v3.1

- Storage drive: 2,5 "HDD SCSI

- Storage space: 100GB partition (total 931GB drive)

- Disk allocation cluster size: 4,096 bytes

- Disk editing program: WinHex Ver. 18.4

- Timestamp manipulation program: timestomp.exe. SetMace.exe

&Lt; Example 1 &gt;

In the first embodiment, the following experiment was performed to hide the character string "DataHidingMethod" in the lower 16 bits of the time stamp of the target file "d: \ SetMace.exe". A screenshot for explaining each step is shown in Figs. 2 to 4. Fig.

The timestamp of the target file is shown in FIG. 2, where the position of the rectangular box is 2 bytes (least significant 16 bits) to hide the data, and the data here is stored in Little Endian, The value is stored first. Then, the character string "DataHidingMethod" which is data to be hidden is encoded into ASCII code. The encoded data is then stored in the least significant 16 bits of the timestamp of the target file, and the timestamp in which the data is stored is shown in FIG. Referring to FIG. 3, the time information is distorted by "15 61 74" of the $ SI attribute and "15 65 4D" of the $ FN attribute, and a bit correction operation is applied. In other words, it was changed to '14' yieoteuna 15 'After correction Before correction "on the 10th November 2014 01:13: 12" but then hide the original data: Become a "1:13 11." rolling on the 17th bit And corrected to the original time. 4, in the property window of the " SetMace.exe " file after performing the data hiding, it can be confirmed that there is no difference in the time information before and after the data hiding.

 &Lt; Example 2 >

In the second embodiment, the following experiment was performed to hide the string data "Steganographic data hiding in timestamps" in the lower 24 bits of the timestamp of the target file "d: \ dataHiding \ targetFile.txt". A screenshot to illustrate each step is shown in Figures 5-8.

The timestamp of the target file is shown in Fig. 5, where the position of the square box is 3 bytes (the lowest 24 bits) to hide the data. Then, the string "Steganographic data hiding in timestamps", which is the data to be hidden, is encoded into ASCII code. The encoded data is then stored in the lowest 24 bits of the timestamp of the target file, and the timestamp in which the data is stored is shown in FIG. Referring to FIG. 6, time information of a time stamp in which data is stored is distorted, and a bit correction operation is applied. That is, when the modification time of $ SI attribute is changed from "01 D4 23 F1 E6 1D 92 F2 " → "01 D4 23 F1 E6 6E 61 67 " → "01 D4 23 F1 E5 EE 61 67 " / 07/25 08:31:35 "→" 08:31:36 ", the 25th bit was changed from 0 → 1 to" E6 "→" E 5 ". At this time, it changes to "08:31:34". Since it differs from the original time, the upper bit (24th bit) of " 6E " is changed from 0 → 1 to " 6E " → " EE " : 31: 35 &quot;.

Then, the MFT entry modification time of the $ SI attribute was changed from "01 D4 2F 42 AA E5 37 9B " to "01 D4 2F 42 AA 72 67 6F " → "01 D4 2F 42 AA F2 67 6F ". After hiding the data, time distortion occurs from "2018/08/08 18:07:27" → "18:07:28", and the upper bit of "72" is changed to 1 to change it to "F2" 18:07:28 " to " 18: 07: 27 &quot;, in which case only the 24th bit needs to be changed to 1 and no correction for the 25th bit is needed.

The modification time of the MFT entry of $ FN (short) was changed from "01 D4 23 F1 E6 1D 92 F2 " → "01 D4 23 F1 E6 64 69 68 " → "01 D4 23 F1 E5 E4 69 68 ". After hiding the data, the time is changed from "2018/07/25 08:31:35" → "08:31:36". To correct this, change the 25th bit from 1 → 0 to "E6" → "E 5 " . At this time, it changes to "08:31:34". If you change the upper bit (24th bit) of " 64 " from 0 → 1, it changes from " 64 " → " E4 " to the original "08:31:35" .

The modification time of $ FN (long) was changed from "01 D4 23 F1 E6 1D 92 F2 " to "01 D4 23 F1 E6 65 6D 69 " → "01 D4 23 F1 E 5 E5 6D 69 ". After hiding the data, the time changes from "2018/07/25 08:31:35" → "08:31:36". To correct this, change the 25th bit from 1 → 0 to "E6" → "E 5 " . At this time, it changes to "08:31:34". If you change the upper bit (24th bit) of "65" from 0 → 1, it changes from " 64 " → " E4 " to the original "08:31:35" . Fig. 7 shows that the time stamp information of the target file before and after the data hiding is not changed, and the time information remains unchanged.

As described above, according to the present invention, when 2-byte data is hidden in a time stamp space used for displaying a time of less than 1 second, a time-distortion problem is solved through bit operation when a time of 1 second is displayed incorrectly. By storing more data in the lower 24 bits, it is possible to store data securely without time distortion through bit operation.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. It is therefore intended that such variations and modifications fall within the scope of the appended claims.

S10: encoding the data
S20: Extracting file stamp information from an arbitrary file
S30: Set the lower bit section of the file stamp as a data-hidden area
S40: storing the encoded data in the data-hidden area
S50: Correction of the information of the time stamp in which the data is stored if there is a difference between the time stamp information before and after the data storage

Claims (6)

A method for hiding data without distorting time information in a portion of a Windows NTFS file system that displays time information of less than one second in a file's time stamp,
(a) encoding data to be hidden;
(b) extracting time stamp information from an arbitrary file;
(c) setting a data-hidden area by removing lower-order bits of the extracted time stamp information with mask bits;
(d) storing data in a data-hidden area by performing an OR operation on the encoded data and time stamp information set in the data-hidden area; And
(e) If the time stamp information stored in step (d) is different from the time stamp information extracted in step (b), the lower 24th and / or 25th bits of the lower 24 bits And correcting the information of the time stamp in which the data is stored by performing an addition / subtraction operation on the time stamp. A method for hiding data without distorting time information in a portion of a Windows NTFS file system that displays time information of less than one second in a file's time stamp,
(a) encoding data to be hidden;
(b) extracting time stamp information from an arbitrary file;
(c) setting a data-hidden area by removing lower-order bits of the extracted time stamp information with mask bits;
(d) storing data in a data-hidden area by performing an OR operation on the encoded data and time stamp information set in the data-hidden area; And
(e) If the time stamp information storing the data in step (d) is different from the time stamp information extracted in step (b), the least significant 17th bit of the lower 16 bits, which is the data hidden area, And correcting the information of the time stamp based on the time stamp information. 3. The method according to claim 1 or 2,
Wherein the data is encoded as ASCII code or Unicode as a character. delete delete delete

Images