Using Blockchain For Screen-Recording Data Preservation

近年來，營業秘密外洩司法案件頻傳，因此全球各產業企業日益重視資訊安全，開始檢討並加強內部資訊安全管理。為了防止企業內部資料外洩，依照不同的資料外洩情境，導入了相關的管控措施。為了能於發生資料外洩事件後，快速釐清事件主因，某些企業便希望藉由行為監控來掌握特權帳號所有的活動記錄，因此導入了特權帳戶側錄系統，藉由螢幕側錄的手法，將特權帳號所有系統操作畫面記錄，以數位化方式留存下來，做為資安事件事後舉證之證據。然而，即便導入了側錄系統保留了特權帳號所有系統操作畫面記錄，或許在資安事件發生時，可以藉由側錄記錄來舉證不法行為。但這些側錄記錄在收集的過程中，仍然有機會遭受到具有最高權限的系統管理者來進行竄改或刪除，因而在舉證過程中產生了證據力不足的問題。隨著科技的進步，區塊鏈技術的也在近兩年興起，從金融科技到資訊安全，帶動了各個領域技術應用被廣泛的討論。因此，為了避免側錄記錄遭受竄改，本研究希望藉由區塊鏈的概念與Hash技術，將其不可竄改和加密安全性的特性，延伸應用至螢幕側錄資料的保全，以便未來發生資訊外洩案件時，能夠有效舉證，證明螢幕側錄資料不曾遭受污染、刪除及竄改，證明企業無業務過失，進一步還原資訊安全犯罪事實。In order to be able to quickly clarify the main cause of the problem in the event of data leakage, some enterprises hope to grasp all the activity records of the privileged account through behavior monitoring, so the privileged account side recording system is introduced, and the screen recording method is adopted. All system operation screens of the privileged account are recorded and saved in a digital manner as evidence for the evidence of the incident after the security incident. However, even if the imported skimming system retains all system operation screen records of the privileged account, it may be possible to prove the wrongful behavior by recording the side record when the security incident occurs. However, in the process of collecting, these side records still have the opportunity to be subjected to tampering or deletion by the system administrator with the highest authority, thus causing insufficient evidence in the process of proof. With the advancement of technology, blockchain technology has also emerged in the past two years. From financial technology to information security, technology applications in various fields have been widely discussed. Therefore, in order to avoid tampering with the recording of the side record, this study hopes to extend the application of the non-tamperable and cryptographic security features to the preservation of the screen recording data by the concept of blockchain and Hash technology, so that information can be generated in the future. When the case is squandered, it can effectively prove that the screen-recording data has not been contaminated, deleted and falsified, which proves that the company has no business fault and further restores the information security crime facts.摘要 i Abstract ii 目錄 iii 表目錄 iv 圖目錄 v 第一章 緒論 1 1.1 研究背景 1 1.2 研究動機 3 1.3 研究目的 4 1.4 研究流程 4 1.5 論文架構 4 第二章 文獻探討 5 2.1 數位證據 5 2.2 證據能力及證據力 6 2.3 螢幕側錄系統 8 2.4 區塊鏈技術 12 2.5 區塊鏈應用 15 2.6 區塊鏈技術運作原理 17 第三章 系統設計 20 3.1 系統架構 20 3.2 側錄程序 24 第四章 系統實作 26 4.1 實作區塊鏈程式 26 4.2 執行結果 33 4.3 資料驗證比對 36 第五章 結論與未來建議 40 5.1 結論 40 5.2 未來建議 40 參考文獻 4