KR20170038340A - Data leakage prevention apparatus and method thereof - Google Patents
Data leakage prevention apparatus and method thereof Download PDFInfo
- Publication number
- KR20170038340A KR20170038340A KR1020150137597A KR20150137597A KR20170038340A KR 20170038340 A KR20170038340 A KR 20170038340A KR 1020150137597 A KR1020150137597 A KR 1020150137597A KR 20150137597 A KR20150137597 A KR 20150137597A KR 20170038340 A KR20170038340 A KR 20170038340A
- Authority
- KR
- South Korea
- Prior art keywords
- security
- data
- user
- target data
- password
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
Abstract
A security program is automatically executed at the time of booting of a terminal (for example, a computer), and the target file is encrypted and protected first when an error occurs in inputting a password. In accordance with the security setting preset by the user when accessing the Internet, The present invention relates to an apparatus and method for preventing leakage of data by processing an encrypted object file, and more particularly, to a data leakage prevention apparatus and method for preventing data leakage by executing a security program for preventing data leakage according to a security setting of a user, A user terminal for preventing or preventing data leakage by making or deleting the security target data in accordance with a processing command of the security target data; And an account of the executable security user is registered, and when the execution of the security function is notified from the user terminal, a command to delete the security target data is transmitted to the user terminal based on the registered user account, or communication with the user, And a security server for transmitting a processing command of the security target data to the user terminal according to the command to prevent leakage of the security target data, thereby implementing the data leakage prevention apparatus.
Description
In particular, the present invention relates to data leakage prevention, and more particularly to a data leakage prevention method and system, which can automatically execute a security program at the time of booting a terminal (for example, a computer) The present invention relates to a data leakage preventing apparatus and a data leakage prevention method for preventing a data leakage by processing a target file that is primarily encrypted according to a security setting set in advance.
BACKGROUND OF THE INVENTION [0002] Terminals such as computers have become widespread in everyday life, business, information and communication fields. Computers have a lot of data or information collected and stored in the system, much of the data being stored is very sensitive in nature. Therefore, if the data is leaked by a person who has an impure purpose, not only the damage due to personal information leakage but also the loss of competitiveness by the business operator can cause a great loss.
In order to prevent such data loss, various technologies for preventing data leakage from terminals such as a computer have been proposed.
On the other hand, conventional techniques for preventing data leakage and for file security are disclosed in Patent Documents 1 to 3 below.
Prior art disclosed in Patent Document 1 is a key lock provided on a motherboard so that an external input / output device including a floppy disk driver, a CD-ROM driver, and a ZIP driver can be set in a read-only mode before the operating system is loaded. board; A secure USB memory in which data to be stored is subjected to encryption / decryption processing and is a sole storage device capable of writing and reading data with the outside; A user computer that is operated after the hardware ID number of the key lock board and the secure USB memory are confirmed in an on-line state with the server having built-in secret data; It consists of a secure USB memory, a main server system that manages all IDs of the user's computer and MAC address (Media Access Control address) of the system.
With this configuration, if the profile of the secure USB memory is registered in the main server system and the connection of the secure USB memory registered on the network is detected, the user authentication is requested. If the authentication fails, the access to the data area is denied, Perform necessary actions, track the IP of the PC using the secure USB memory, and store it on the main server system to prevent illegal data leakage.
The conventional technology disclosed in Patent Document 2 includes the steps of setting and storing a password corresponding to a predetermined security program and a security program in a USB memory device; When the USB memory device is connected to the computer, loading the security program in the computer to execute the security function for the USB memory device; Requesting input of a password based on the security function when access to the USB memory device is attempted, comparing the password input from the user with the stored password; Disabling the security function to allow access to the USB memory device if the passwords match each other, and outputting an error message and restricting access to the USB memory device if the passwords do not match.
With this configuration, access to the USB memory device is controlled using a password to prevent leakage of data stored in the USB memory device, and the use of the computer can be restricted by using the USB memory device, so that the overall security function of the computer .
The prior art disclosed in Patent Document 3 includes a step of a user inputting a security ID and a password, a step of confirming a current security setting state by a user, and a step of setting a security by a user by setting a security option.
With this configuration, after installing a security-dedicated program, the program is operated to select a file or a folder requiring security, and a predetermined security function option is set in the selected file or folder to secure the security of the computer file or folder Lt; / RTI >
However, the above conventional techniques have the following problems.
For example, the prior art disclosed in Patent Document 1 is a method of registering a profile of a secure USB memory in a main server system and requesting user authentication when a connection of a registered secure USB memory is detected on the network to prevent data leakage , If a security USB memory is not connected to the main server system and a computer which is a user terminal is lost, there is a disadvantage in that another person can check data of the user terminal.
In addition, since the conventional technique disclosed in Patent Document 2 is a method of controlling access to a USB memory device using a password, it is also disadvantageous in that if a computer as a user terminal is lost, And there is a drawback that security is poor.
In addition, since the conventional technology disclosed in Patent Document 3 is a method of implementing security of a file or a folder by using a security password and an ID and using read / write or read only, etc., It is not possible to prevent the data from being leaked and it is also impossible to interfere with the server to prevent data leakage from the remote side.
SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of the above problems occurring in the prior art, and it is an object of the present invention to provide a security system that automatically executes a security program when a terminal (e.g., A data leakage prevention device for protecting a file by encrypting and protecting a data file and for preventing data leakage by processing the firstly encrypted object file in accordance with a security setting preset by a user when accessing the Internet, have.
In order to achieve the above object, the data leakage prevention device according to the present invention executes a security program for preventing data leakage according to a security setting of a user, A user terminal for preventing or preventing leakage of data by making or deleting the security target data according to a processing command; The method includes the steps of: registering an account of a secure executable user through the user terminal; transmitting a deletion command of the secure object data to the user terminal based on the registered user account when the security function execution is notified from the user terminal; And a security server for transmitting a processing command of the security target data to the user terminal according to a security target data processing command of the user to prevent leakage of security target data.
In this case, the user terminal and the security server are connected by a network, and the user terminal encrypts or deletes the security target data or restores the encrypted security target data into original data.
The user terminal includes a security setting unit for receiving a security function setting signal and a security target data designation signal and receiving a password; A storage unit for storing security programs for data security and attribute information for data security; A security control unit for controlling the execution of the security program and the security of the security target data in accordance with a security setting request of the security setting unit; A security function is executed through a security program in cooperation with the security control unit, a password is requested when the security function is booted after execution of the security function, and when the inputted password is different from the registered password, And a security executing unit that performs a secondary security function by deleting the encrypted security target data in response to an instruction to delete the security target data transmitted from the security server.
If the password inputted after the password request is inconsistent with the registered password, the security enforcing unit requests re-input of the password by the number of times registered. If an error occurs in inputting the password more than the registered number, the security enforcing unit transmits an asymmetric public key key to encrypt the security-object data.
Wherein the user terminal comprises: a communication unit connected to the security server via a network and receiving a security object data delete command or a security object data restore command transmitted from the security server; And a data restoring unit for restoring the encrypted security target data to original data when a command for restoring the security target data is received by the communication unit.
The data restoring unit restores the security target data encrypted using the private key of the user account included in the security target data restoration command as original data.
The security server includes a communication unit for accessing a user terminal through a network or accessing a user registration terminal through an account; When the security function execution is notified from the user terminal through the communication unit, the control unit controls the user registration terminal to inform the user of the execution of the security function and notifies the user terminal of security function execution information according to the security function processing request information of the user or the registered security function processing information. And a security controller for transmitting a data processing command to prevent data leakage of the user.
In this case, the security server accesses the user registration terminal under the control of the security control unit to notify the security function execution state, and transmits a security function processing request information transmitted from the user registration terminal to the security control unit part; And an account registration unit for registering the user's account and the security function process information of the user.
According to an aspect of the present invention, there is provided a data leakage prevention method comprising: (a) setting a security function for preventing leakage of security target data from a user terminal; (b) requesting a password input when the user terminal is booted after step (a); (c) comparing the password input from the user terminal with the pre-registered password, and executing the primary security function by encrypting the security target data if the password does not match; (d) automatically accessing the security server when an Internet connection occurs after the security function is executed in the user terminal, and notifying the security function execution state; (e) extracting the user registration terminal information through the user account registered in the security server, and informing the user registration terminal of the security function execution state based on the extracted user registration terminal information; (f) retrieving security function process information previously registered in the security server or security function process request information transmitted from the user registration terminal; (g) generating a data delete command and transmitting the data delete command to the user terminal when the secure server deletes the secured object data as a result of the searching in the step (f); (h) performing additional authentication through the user registration terminal when the search result of the step (f) is for restoring the security target data, and if the authentication is normally performed, generating a data restoration command and transmitting the data restoration command to the user terminal; (i) if the command received from the user terminal is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted and restored to original data And a control unit.
In the step (c), when the password inputted after the password request is inconsistent with the registered password, the password re-input is requested by the registered number. If an error occurs in inputting the password more than the registered number, And the step (i) recovers the security target data encrypted using the private key of the user account included in the secure target data restoration command into the original data .
According to the present invention, when a terminal (for example, a computer) is booted, a security program is automatically executed, a target file is encrypted and protected first when a password is input, and a security setting Accordingly, there is an advantage that security of data can be improved by securing the first-encrypted object file secondarily.
1 is a configuration diagram of a data leakage prevention apparatus according to the present invention;
FIG. 2 is a block diagram of an embodiment of the user terminal of FIG.
FIG. 3 is a block diagram of an embodiment of the security server of FIG.
4 is a flowchart illustrating a data leakage prevention method according to the present invention.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and method for preventing data leakage according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.
1 is a configuration diagram of a data leakage prevention apparatus according to a preferred embodiment of the present invention.
The data leakage prevention device according to the present invention includes a
The
The
2, the
The
In addition, the
In addition, the
In addition, the
Here, if the password inputted after the password request is inconsistent with the registered password, the
The
In addition, the
The
The
The
The
The
Also, the security function
In addition, the
4 is a flowchart illustrating a method for preventing data leakage according to the present invention. The method includes (a) setting a security function for preventing leakage of security target data from the user terminal 100 (S101 to S102); (b) requesting a password input when the user terminal 100 is booted after step (a) (steps S103 to S104); (c) comparing the password inputted from the user terminal 100 with the pre-registered password, and if not, executing the primary security function by encrypting the security target data (SS105 to S108); (d) a step (S109 to S110) of automatically accessing the security server 200 and notifying the security function execution state when an Internet connection occurs after the security function is executed in the user terminal 100; (e) extracting the user registration terminal information through the user account registered in the security server 200 and informing the user registration terminal of the security function execution status based on the extracted user registration terminal information (S112); (f) searching security function process information previously registered in the security server 200 or security function process request information transmitted from the user registration terminal (S113); (g) generating (S114) a data delete command and transmitting the data delete command to the user terminal (100) when the secure server (200) deletes the security target data as a result of the searching in the step (f); (h) Performing additional authentication through the user registration terminal in the case of restoring the security object data as a result of the search in the step (f), generating a data restoration command when authentication is normally performed, and transmitting the data restoration command to the user terminal 100 (S115 to S118); (i) if the command received from the user terminal 100 is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted, And restoring (S115, S119).
In the step (c), when the password inputted after the password request is inconsistent with the registered password, the password re-input is requested by the registered number. If an error occurs in inputting the password more than the registered number, , And the step (i) recovers the security target data encrypted using the private key of the user account included in the secure target data restoration command into original data.
The data leakage prevention apparatus and method according to the preferred embodiment of the present invention will be described in detail as follows.
First, a user who owns the
For example, a security function setting signal and a security target data designation signal are inputted through the
When the security function is set, the
Then, the
When the user is booted by the power supply of the user in the state where the user account is registered in the
When the password is inputted through the input device, the inputted password is compared with the pre-registered password, and it is confirmed whether or not they match with each other (S105). If the inputted password matches the pre-registered password as a result of the check, the system switches to the normal use state of the personal computer without performing the security function.
If the input password and the pre-registered password do not coincide with each other, the input number of times of password comparison is incremented by one and it is checked whether the increased number is the set number. If the input number is less than the preset number, the password input is requested again S106 to S107). If the password input after the password request is inconsistent with the registered password, if the increased number is greater than the set number, the
By performing the primary security function as described above, it is possible to prevent a user who has learned the user terminal as well as the user from using the security target data designated to the user terminal.
If the user or another person attempts to access the Internet in the state where the primary security function is executed in step S109, the
The
The security function
A user who carries the user registration terminal recognizes that the
After the user accesses the
The
For example, if the security function processing information or the security function processing request information is deleted and the security target processing data is deleted, the data deletion command is generated and transmitted to the user terminal 100 (S113 to S114).
Upon receiving the data delete command, the
If it is determined that the security function processing information or the security function processing request information is restored (S116), additional authentication is performed (S117). When the user inputs the authentication information to the user registration terminal, the registered authentication information is compared with the inputted authentication information, Process final authentication. At this time, if the input authentication information differs from the registered authentication information, the input signal is ignored. Otherwise, if the input authentication information and the registered authentication information are the same, a data restoration command for restoring the encrypted security target data is generated To the user terminal 100 (S118). Here, the data restoration command preferably provides the private key of the user account for data restoration. That is, an asymmetric private key is assigned to each user account, and when the user desires to restore encrypted security target data, it is used.
Upon receiving the data restoration command, the
Therefore, when the user finds the lost user terminal again in the future, the user can restore the encrypted security function data to the original data and use it again.
Although the present invention has been described in detail with reference to the above embodiments, it is needless to say that the present invention is not limited to the above-described embodiments, and various modifications may be made without departing from the spirit of the present invention.
The present invention is applied to a technique for preventing leakage of a specific data file stored in a terminal such as a computer.
100: User terminal
110: security setting unit
120:
130:
140:
150: Security execution unit
160:
200: Security server
220:
230: security function execution notification unit
240: Account Register
300: Network (Internet)
Claims (10)
According to the security setting of the user, the security program for preventing the data leakage is executed, and the security target data is made into the security state or deleted according to the password input state and the processing command of the security target data transmitted from the security server, A user terminal; And
The method includes the steps of: registering an account of a secure executable user through the user terminal; transmitting a deletion command of the secure object data to the user terminal based on the registered user account when the security function execution is notified from the user terminal; And a security server for transmitting a processing command of the security target data to the user terminal according to a security target data processing command of the user to prevent leakage of security target data.
(a) setting a security function for preventing leakage of security target data from a user terminal;
(b) requesting a password input when the user terminal is booted after step (a);
(c) comparing the password input from the user terminal with the pre-registered password, and executing the primary security function by encrypting the security target data if the password does not match;
(d) automatically accessing the security server when an Internet connection occurs after the security function is executed in the user terminal, and notifying the security function execution state;
(e) extracting the user registration terminal information through the user account registered in the security server, and informing the user registration terminal of the security function execution state based on the extracted user registration terminal information;
(f) retrieving security function process information previously registered in the security server or security function process request information transmitted from the user registration terminal;
(g) generating a data delete command and transmitting the data delete command to the user terminal when the secure server deletes the secured object data as a result of the searching in the step (f);
(h) performing additional authentication through the user registration terminal when the search result of the step (f) is for restoring the security target data, and if the authentication is normally performed, generating a data restoration command and transmitting the data restoration command to the user terminal; And
(i) if the command received from the user terminal is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted and restored to original data The data leakage prevention method comprising:
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
KR1020150137597A KR101745390B1 (en) | 2015-09-30 | 2015-09-30 | Data leakage prevention apparatus and method thereof |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
KR1020150137597A KR101745390B1 (en) | 2015-09-30 | 2015-09-30 | Data leakage prevention apparatus and method thereof |
Publications (2)
Publication Number | Publication Date |
---|---|
KR20170038340A true KR20170038340A (en) | 2017-04-07 |
KR101745390B1 KR101745390B1 (en) | 2017-06-12 |
Family
ID=58583733
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
KR1020150137597A KR101745390B1 (en) | 2015-09-30 | 2015-09-30 | Data leakage prevention apparatus and method thereof |
Country Status (1)
Country | Link |
---|---|
KR (1) | KR101745390B1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110768990A (en) * | 2019-10-29 | 2020-02-07 | 深信服科技股份有限公司 | Data transmission method, system, equipment and computer readable storage medium |
KR20210157230A (en) * | 2020-06-19 | 2021-12-28 | 주식회사 비엠캠프 | Method and system for serving hidden message imoticon |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR20000072001A (en) | 2000-06-15 | 2000-12-05 | 윤상권 | Method for securing computer file |
KR20030084037A (en) | 2002-04-24 | 2003-11-01 | 주식회사 아이오셀 | Method for securing a usb memory device and method for restricting use of a computer using the device |
KR100847659B1 (en) | 2007-10-02 | 2008-07-21 | 김홍균 | Method and device for data leakage prevention using ID verification method of key lock board and security USB memory |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR100705380B1 (en) | 2005-10-19 | 2007-04-10 | (주)이월리서치 | The preventing method of information drain using secure computer system |
KR101308703B1 (en) * | 2013-04-24 | 2013-09-13 | (주)누리아이엔에스 | Security system for electronic commerce and method thereof |
-
2015
- 2015-09-30 KR KR1020150137597A patent/KR101745390B1/en active IP Right Grant
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR20000072001A (en) | 2000-06-15 | 2000-12-05 | 윤상권 | Method for securing computer file |
KR20030084037A (en) | 2002-04-24 | 2003-11-01 | 주식회사 아이오셀 | Method for securing a usb memory device and method for restricting use of a computer using the device |
KR100847659B1 (en) | 2007-10-02 | 2008-07-21 | 김홍균 | Method and device for data leakage prevention using ID verification method of key lock board and security USB memory |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110768990A (en) * | 2019-10-29 | 2020-02-07 | 深信服科技股份有限公司 | Data transmission method, system, equipment and computer readable storage medium |
KR20210157230A (en) * | 2020-06-19 | 2021-12-28 | 주식회사 비엠캠프 | Method and system for serving hidden message imoticon |
Also Published As
Publication number | Publication date |
---|---|
KR101745390B1 (en) | 2017-06-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7802112B2 (en) | Information processing apparatus with security module | |
US8918633B2 (en) | Information processing device, information processing system, and program | |
CN105279449B (en) | Data access control method, system and mobile equipment based on context | |
CN112513857A (en) | Personalized cryptographic security access control in a trusted execution environment | |
KR101522445B1 (en) | Client computer for protecting confidential file, server computer therefor, method therefor, and computer program | |
CN107103245B (en) | File authority management method and device | |
JP2016531508A (en) | Data secure storage | |
JP2008047085A (en) | Data security system, apparatus and method using usb device | |
JP2012009938A (en) | Information processing device and program | |
US20170201528A1 (en) | Method for providing trusted service based on secure area and apparatus using the same | |
KR20180016937A (en) | System and method for anti-fishing or anti-ransomware application | |
WO2017166362A1 (en) | Esim number writing method, security system, esim number server, and terminal | |
JP4931543B2 (en) | Information device and computer program | |
JP7105495B2 (en) | Segmented key authenticator | |
EP3787219A1 (en) | Key processing method and device | |
JP4947562B2 (en) | Key information management device | |
KR101745390B1 (en) | Data leakage prevention apparatus and method thereof | |
JP2011248474A (en) | Storage medium, information processor and computer program | |
JP2019054363A (en) | Server device, secret dispersion management system and secret dispersion management device | |
US20220311601A1 (en) | Method for pushing key, method for operating file, storage medium, and computer device | |
KR20210029967A (en) | Management system and method for data security for storage device using security device | |
EP3764264B1 (en) | Methods and devices for automatically encrypting files | |
WO2016193176A1 (en) | A remotely protected electronic device | |
KR101495766B1 (en) | System and method for remote security management | |
JP4899196B2 (en) | Data management system, terminal computer, management computer, data management method and program thereof |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
A201 | Request for examination | ||
E902 | Notification of reason for refusal | ||
E90F | Notification of reason for final refusal | ||
E701 | Decision to grant or registration of patent right | ||
GRNT | Written decision to grant |