KR20170038340A - Data leakage prevention apparatus and method thereof - Google Patents

Data leakage prevention apparatus and method thereof Download PDF

Info

Publication number
KR20170038340A
KR20170038340A KR1020150137597A KR20150137597A KR20170038340A KR 20170038340 A KR20170038340 A KR 20170038340A KR 1020150137597 A KR1020150137597 A KR 1020150137597A KR 20150137597 A KR20150137597 A KR 20150137597A KR 20170038340 A KR20170038340 A KR 20170038340A
Authority
KR
South Korea
Prior art keywords
security
data
user
target data
password
Prior art date
Application number
KR1020150137597A
Other languages
Korean (ko)
Other versions
KR101745390B1 (en
Inventor
이창훈
정종원
Original Assignee
(주)비엑스엠
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by (주)비엑스엠 filed Critical (주)비엑스엠
Priority to KR1020150137597A priority Critical patent/KR101745390B1/en
Publication of KR20170038340A publication Critical patent/KR20170038340A/en
Application granted granted Critical
Publication of KR101745390B1 publication Critical patent/KR101745390B1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

A security program is automatically executed at the time of booting of a terminal (for example, a computer), and the target file is encrypted and protected first when an error occurs in inputting a password. In accordance with the security setting preset by the user when accessing the Internet, The present invention relates to an apparatus and method for preventing leakage of data by processing an encrypted object file, and more particularly, to a data leakage prevention apparatus and method for preventing data leakage by executing a security program for preventing data leakage according to a security setting of a user, A user terminal for preventing or preventing data leakage by making or deleting the security target data in accordance with a processing command of the security target data; And an account of the executable security user is registered, and when the execution of the security function is notified from the user terminal, a command to delete the security target data is transmitted to the user terminal based on the registered user account, or communication with the user, And a security server for transmitting a processing command of the security target data to the user terminal according to the command to prevent leakage of the security target data, thereby implementing the data leakage prevention apparatus.

Description

[0001] The present invention relates to a data leakage prevention apparatus and method,

In particular, the present invention relates to data leakage prevention, and more particularly to a data leakage prevention method and system, which can automatically execute a security program at the time of booting a terminal (for example, a computer) The present invention relates to a data leakage preventing apparatus and a data leakage prevention method for preventing a data leakage by processing a target file that is primarily encrypted according to a security setting set in advance.

BACKGROUND OF THE INVENTION [0002] Terminals such as computers have become widespread in everyday life, business, information and communication fields. Computers have a lot of data or information collected and stored in the system, much of the data being stored is very sensitive in nature. Therefore, if the data is leaked by a person who has an impure purpose, not only the damage due to personal information leakage but also the loss of competitiveness by the business operator can cause a great loss.

In order to prevent such data loss, various technologies for preventing data leakage from terminals such as a computer have been proposed.

On the other hand, conventional techniques for preventing data leakage and for file security are disclosed in Patent Documents 1 to 3 below.

Prior art disclosed in Patent Document 1 is a key lock provided on a motherboard so that an external input / output device including a floppy disk driver, a CD-ROM driver, and a ZIP driver can be set in a read-only mode before the operating system is loaded. board; A secure USB memory in which data to be stored is subjected to encryption / decryption processing and is a sole storage device capable of writing and reading data with the outside; A user computer that is operated after the hardware ID number of the key lock board and the secure USB memory are confirmed in an on-line state with the server having built-in secret data; It consists of a secure USB memory, a main server system that manages all IDs of the user's computer and MAC address (Media Access Control address) of the system.

With this configuration, if the profile of the secure USB memory is registered in the main server system and the connection of the secure USB memory registered on the network is detected, the user authentication is requested. If the authentication fails, the access to the data area is denied, Perform necessary actions, track the IP of the PC using the secure USB memory, and store it on the main server system to prevent illegal data leakage.

The conventional technology disclosed in Patent Document 2 includes the steps of setting and storing a password corresponding to a predetermined security program and a security program in a USB memory device; When the USB memory device is connected to the computer, loading the security program in the computer to execute the security function for the USB memory device; Requesting input of a password based on the security function when access to the USB memory device is attempted, comparing the password input from the user with the stored password; Disabling the security function to allow access to the USB memory device if the passwords match each other, and outputting an error message and restricting access to the USB memory device if the passwords do not match.

With this configuration, access to the USB memory device is controlled using a password to prevent leakage of data stored in the USB memory device, and the use of the computer can be restricted by using the USB memory device, so that the overall security function of the computer .

The prior art disclosed in Patent Document 3 includes a step of a user inputting a security ID and a password, a step of confirming a current security setting state by a user, and a step of setting a security by a user by setting a security option.

With this configuration, after installing a security-dedicated program, the program is operated to select a file or a folder requiring security, and a predetermined security function option is set in the selected file or folder to secure the security of the computer file or folder Lt; / RTI >

Korean Registered Patent No. 10-0847659 (Registered on July 15, 2008) (Name of the invention: Method for preventing data leakage using ID verification method of key lock board and secure USB memory and apparatus thereof) Korean Unexamined Patent Application Publication No. 2003-0084037 (published on November 11, 2003) (Security method of USB memory device and method of restricting use of computer using the same) Korean Patent Laid-Open No. 2000-0072001 (published on December 25, 2000) (Name of invention: security method of computer file)

However, the above conventional techniques have the following problems.

For example, the prior art disclosed in Patent Document 1 is a method of registering a profile of a secure USB memory in a main server system and requesting user authentication when a connection of a registered secure USB memory is detected on the network to prevent data leakage , If a security USB memory is not connected to the main server system and a computer which is a user terminal is lost, there is a disadvantage in that another person can check data of the user terminal.

In addition, since the conventional technique disclosed in Patent Document 2 is a method of controlling access to a USB memory device using a password, it is also disadvantageous in that if a computer as a user terminal is lost, And there is a drawback that security is poor.

In addition, since the conventional technology disclosed in Patent Document 3 is a method of implementing security of a file or a folder by using a security password and an ID and using read / write or read only, etc., It is not possible to prevent the data from being leaked and it is also impossible to interfere with the server to prevent data leakage from the remote side.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of the above problems occurring in the prior art, and it is an object of the present invention to provide a security system that automatically executes a security program when a terminal (e.g., A data leakage prevention device for protecting a file by encrypting and protecting a data file and for preventing data leakage by processing the firstly encrypted object file in accordance with a security setting preset by a user when accessing the Internet, have.

In order to achieve the above object, the data leakage prevention device according to the present invention executes a security program for preventing data leakage according to a security setting of a user, A user terminal for preventing or preventing leakage of data by making or deleting the security target data according to a processing command; The method includes the steps of: registering an account of a secure executable user through the user terminal; transmitting a deletion command of the secure object data to the user terminal based on the registered user account when the security function execution is notified from the user terminal; And a security server for transmitting a processing command of the security target data to the user terminal according to a security target data processing command of the user to prevent leakage of security target data.

In this case, the user terminal and the security server are connected by a network, and the user terminal encrypts or deletes the security target data or restores the encrypted security target data into original data.

The user terminal includes a security setting unit for receiving a security function setting signal and a security target data designation signal and receiving a password; A storage unit for storing security programs for data security and attribute information for data security; A security control unit for controlling the execution of the security program and the security of the security target data in accordance with a security setting request of the security setting unit; A security function is executed through a security program in cooperation with the security control unit, a password is requested when the security function is booted after execution of the security function, and when the inputted password is different from the registered password, And a security executing unit that performs a secondary security function by deleting the encrypted security target data in response to an instruction to delete the security target data transmitted from the security server.

If the password inputted after the password request is inconsistent with the registered password, the security enforcing unit requests re-input of the password by the number of times registered. If an error occurs in inputting the password more than the registered number, the security enforcing unit transmits an asymmetric public key key to encrypt the security-object data.

Wherein the user terminal comprises: a communication unit connected to the security server via a network and receiving a security object data delete command or a security object data restore command transmitted from the security server; And a data restoring unit for restoring the encrypted security target data to original data when a command for restoring the security target data is received by the communication unit.

The data restoring unit restores the security target data encrypted using the private key of the user account included in the security target data restoration command as original data.

The security server includes a communication unit for accessing a user terminal through a network or accessing a user registration terminal through an account; When the security function execution is notified from the user terminal through the communication unit, the control unit controls the user registration terminal to inform the user of the execution of the security function and notifies the user terminal of security function execution information according to the security function processing request information of the user or the registered security function processing information. And a security controller for transmitting a data processing command to prevent data leakage of the user.

In this case, the security server accesses the user registration terminal under the control of the security control unit to notify the security function execution state, and transmits a security function processing request information transmitted from the user registration terminal to the security control unit part; And an account registration unit for registering the user's account and the security function process information of the user.

According to an aspect of the present invention, there is provided a data leakage prevention method comprising: (a) setting a security function for preventing leakage of security target data from a user terminal; (b) requesting a password input when the user terminal is booted after step (a); (c) comparing the password input from the user terminal with the pre-registered password, and executing the primary security function by encrypting the security target data if the password does not match; (d) automatically accessing the security server when an Internet connection occurs after the security function is executed in the user terminal, and notifying the security function execution state; (e) extracting the user registration terminal information through the user account registered in the security server, and informing the user registration terminal of the security function execution state based on the extracted user registration terminal information; (f) retrieving security function process information previously registered in the security server or security function process request information transmitted from the user registration terminal; (g) generating a data delete command and transmitting the data delete command to the user terminal when the secure server deletes the secured object data as a result of the searching in the step (f); (h) performing additional authentication through the user registration terminal when the search result of the step (f) is for restoring the security target data, and if the authentication is normally performed, generating a data restoration command and transmitting the data restoration command to the user terminal; (i) if the command received from the user terminal is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted and restored to original data And a control unit.

In the step (c), when the password inputted after the password request is inconsistent with the registered password, the password re-input is requested by the registered number. If an error occurs in inputting the password more than the registered number, And the step (i) recovers the security target data encrypted using the private key of the user account included in the secure target data restoration command into the original data .

According to the present invention, when a terminal (for example, a computer) is booted, a security program is automatically executed, a target file is encrypted and protected first when a password is input, and a security setting Accordingly, there is an advantage that security of data can be improved by securing the first-encrypted object file secondarily.

1 is a configuration diagram of a data leakage prevention apparatus according to the present invention;
FIG. 2 is a block diagram of an embodiment of the user terminal of FIG.
FIG. 3 is a block diagram of an embodiment of the security server of FIG.
4 is a flowchart illustrating a data leakage prevention method according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and method for preventing data leakage according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a data leakage prevention apparatus according to a preferred embodiment of the present invention.

The data leakage prevention device according to the present invention includes a user terminal 100, the Internet 300, and a security server 200.

The user terminal 100 is a system used by a user who wants to prevent data leakage, and means a normal personal computer (PC). In addition to such a personal computer, it is also possible to use a terminal that performs booting upon power supply and stores a data file therein.

The user terminal 100 executes a security program for preventing data leakage according to the security setting of the user and controls the secure terminal 200 to secure the security target data according to the password input state and the processing command of the security target data transmitted from the security server 200 State or deletion to prevent data leakage.

2, the user terminal 100 includes a security setting unit 110, a security control unit 120, a communication unit 130, a storage unit 140, a security executing unit 150, and a data restoring unit 160).

The security setting unit 110 receives a security function setting signal and a security target data designation signal according to an operation of a user and receives a password. The security setting unit 110 may be implemented as a conventional input device such as a keyboard and a mouse as an input device.

In addition, the storage unit 140 stores a security program for data security and attribute information for data security. Here, the attribute information for data security may include information such as a password and a password comparison count.

In addition, the security control unit 120 controls the execution of the security program and the security of the security target data in accordance with the security setting request of the security setting unit 110.

In addition, the security enforcing unit 150 executes the security function through the security program in cooperation with the security control unit 120. When the security function is booted after executing the security function, the security enforcing unit 150 requests the password, And performs the secondary security function by deleting the encrypted security target data according to the deletion command of the security target data transmitted from the security server 200 .

Here, if the password inputted after the password request is inconsistent with the registered password, the security enforcing unit 150 requests re-input of the password for the number of times registered. If an error occurs in inputting the password more than the registered number, It is preferable to encrypt the security target data using a public key.

The communication unit 130 is connected to the security server 200 through the network 300 and receives a security target data delete command or a security target data restore command transmitted from the security server 200. [

In addition, the data restoring unit 160 restores the encrypted security target data to original data when the communication unit 130 receives the restoration command of the security target data. The data restoring unit 160 restores the security target data encrypted using the private key of the user account included in the secure target data restoration command into the original data.

The network 300 serves to interface data between the user terminal 100 and the security server 200, and is preferably implemented by a normal Internet.

The security server 200 registers an account of a security enabling user through the user terminal 100 and deletes the security target data based on the registered user account when the security function execution is notified from the user terminal 100 Transmits the command to the user terminal 100 or communicates with the user and transmits a processing command of the security target data to the user terminal 100 according to the security target data processing command of the user to prevent leakage of the security target data It plays a role.

The security server 200 includes a communication unit 210, a security control unit 220, a security function execution alarm unit 230, and an account registration unit 240, as shown in FIG.

The communication unit 210 connects with the user terminal 100 through the network 300 or accesses the user registration terminal through an account. Here, the user registration terminal may be the same terminal as the smart phone registered by the user.

The security control unit 220 controls the user registration terminal to notify the user terminal of the execution of the security function when the security function execution is notified from the user terminal 100 through the communication unit 210, And transmits a processing command of the security object data to the user terminal 100 according to the registered security function processing information to prevent data leakage of the user.

Also, the security function execution notification unit 230 notifies the security function execution state by accessing the user registration terminal under the control of the security control unit 220, and transmits the security function process request information transmitted from the user registration terminal, To the security control unit 220. Here, as a method for transmitting the security function execution status information to the user registration terminal, e-mail, text message, or the like can be used.

In addition, the account registration unit 240 registers the user's account and the security function process information of the user.

4 is a flowchart illustrating a method for preventing data leakage according to the present invention. The method includes (a) setting a security function for preventing leakage of security target data from the user terminal 100 (S101 to S102); (b) requesting a password input when the user terminal 100 is booted after step (a) (steps S103 to S104); (c) comparing the password inputted from the user terminal 100 with the pre-registered password, and if not, executing the primary security function by encrypting the security target data (SS105 to S108); (d) a step (S109 to S110) of automatically accessing the security server 200 and notifying the security function execution state when an Internet connection occurs after the security function is executed in the user terminal 100; (e) extracting the user registration terminal information through the user account registered in the security server 200 and informing the user registration terminal of the security function execution status based on the extracted user registration terminal information (S112); (f) searching security function process information previously registered in the security server 200 or security function process request information transmitted from the user registration terminal (S113); (g) generating (S114) a data delete command and transmitting the data delete command to the user terminal (100) when the secure server (200) deletes the security target data as a result of the searching in the step (f); (h) Performing additional authentication through the user registration terminal in the case of restoring the security object data as a result of the search in the step (f), generating a data restoration command when authentication is normally performed, and transmitting the data restoration command to the user terminal 100 (S115 to S118); (i) if the command received from the user terminal 100 is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted, And restoring (S115, S119).

In the step (c), when the password inputted after the password request is inconsistent with the registered password, the password re-input is requested by the registered number. If an error occurs in inputting the password more than the registered number, , And the step (i) recovers the security target data encrypted using the private key of the user account included in the secure target data restoration command into original data.

The data leakage prevention apparatus and method according to the preferred embodiment of the present invention will be described in detail as follows.

First, a user who owns the user terminal 100 sets a security function through the security setting unit 110 in order to prevent leakage of data (including files) stored in the user terminal 100 (S101).

For example, a security function setting signal and a security target data designation signal are inputted through the security setting unit 110 which is an input device, and the security function is set by inputting attribute information to be used in the security function. Here, the attribute information may include information such as a password and a number of password comparisons.

When the security function is set, the security control unit 120 fetches a security program for preventing data leakage from the storage unit 140 and executes the security program according to the security setting of the user. Then, the security target data designated by the user is registered in the storage unit 140. The user can designate the data file to be protected as the security target data.

Then, the security server 200 and the Internet 300 are connected to register a user account (S102). The user account may include an e-mail address, a user registration terminal telephone number, authentication information (e.g., ID) for user authentication, and the like.

When the user is booted by the power supply of the user in the state where the user account is registered in the security server 200 or when a person who has mastered the user terminal 100 supplies power and attempts booting in step S103, ) Requests a password input via a display unit (e.g., a monitor) (S104).

When the password is inputted through the input device, the inputted password is compared with the pre-registered password, and it is confirmed whether or not they match with each other (S105). If the inputted password matches the pre-registered password as a result of the check, the system switches to the normal use state of the personal computer without performing the security function.

If the input password and the pre-registered password do not coincide with each other, the input number of times of password comparison is incremented by one and it is checked whether the increased number is the set number. If the input number is less than the preset number, the password input is requested again S106 to S107). If the password input after the password request is inconsistent with the registered password, if the increased number is greater than the set number, the security enforcer 150 encrypts the security target data set by the user using the asymmetric public key , And performs a primary security function (S108). For example, when a user terminal is requested to input a password every time the user terminal is booted, the security function is automatically executed when the input error of the input password is greater than the set number of times, and the security target data is encrypted with an asymmetric public key to prevent data leakage do.

By performing the primary security function as described above, it is possible to prevent a user who has learned the user terminal as well as the user from using the security target data designated to the user terminal.

If the user or another person attempts to access the Internet in the state where the primary security function is executed in step S109, the security control unit 120 automatically accesses the security server 200 through the communication unit 130, It is notified that the primary security function has been executed (S110). Here, since the security target data is already encrypted even if the user or the other person does not access the Internet, the primary data leakage can be prevented.

The security control unit 220 of the security server 200 receiving the notification that the user terminal 100 is in the primary security function state extracts the user account registered in the account registration unit 240 in step S111, 230). Here, the user account may include an e-mail address, a telephone number of the user registration terminal, and the like.

The security function execution notification unit 230 accesses the user registration terminal under the control of the security control unit 220 and notifies the security function execution state based on the transmitted user account. Here, as a method for transmitting the security function execution status information to the user registration terminal, it is preferable to use e-mail, text message or the like (S112).

A user who carries the user registration terminal recognizes that the user terminal 100 of the user terminal 100 is in a state in which the primary security function is executed by using e-mail or text using the user registration terminal.

After the user accesses the security server 200 via the web using the user registration terminal, the user transmits the security function processing request information for processing the encrypted security target data to the security server 200. [ Here, the security function processing request information is used to determine the disposition of the security target data by the user. In addition to this method, the security function processing information is registered in advance in registering the user account, and the security function processing information is automatically Security functions can be handled.

The security control unit 220 generates a command for processing the security target data according to the previously registered security function processing information or the security function processing request information input by the user via the web and transmits the generated command to the user terminal 100, Perform secondary security.

For example, if the security function processing information or the security function processing request information is deleted and the security target processing data is deleted, the data deletion command is generated and transmitted to the user terminal 100 (S113 to S114).

Upon receiving the data delete command, the user terminal 100 deletes the security target data encrypted by the security enforcer 150 and executes a secondary security function (S115). For example, in a state where the security target data is primarily encrypted, the encrypted security target data is deleted, thereby improving the security. Here, the user terminal 100 that executes the security function polls the security server 200 every time the Internet is connected, and waits for a command from the security server 200. [

If it is determined that the security function processing information or the security function processing request information is restored (S116), additional authentication is performed (S117). When the user inputs the authentication information to the user registration terminal, the registered authentication information is compared with the inputted authentication information, Process final authentication. At this time, if the input authentication information differs from the registered authentication information, the input signal is ignored. Otherwise, if the input authentication information and the registered authentication information are the same, a data restoration command for restoring the encrypted security target data is generated To the user terminal 100 (S118). Here, the data restoration command preferably provides the private key of the user account for data restoration. That is, an asymmetric private key is assigned to each user account, and when the user desires to restore encrypted security target data, it is used.

Upon receiving the data restoration command, the data restoring unit 160 of the user terminal 100 extracts the asymmetric private key included in the data restoration command and restores the encrypted security subject data to original data using the extracted asymmetric private key (S119 ).

Therefore, when the user finds the lost user terminal again in the future, the user can restore the encrypted security function data to the original data and use it again.

Although the present invention has been described in detail with reference to the above embodiments, it is needless to say that the present invention is not limited to the above-described embodiments, and various modifications may be made without departing from the spirit of the present invention.

The present invention is applied to a technique for preventing leakage of a specific data file stored in a terminal such as a computer.

100: User terminal
110: security setting unit
120:
130:
140:
150: Security execution unit
160:
200: Security server
220:
230: security function execution notification unit
240: Account Register
300: Network (Internet)

Claims (10)

An apparatus for preventing data leakage,
According to the security setting of the user, the security program for preventing the data leakage is executed, and the security target data is made into the security state or deleted according to the password input state and the processing command of the security target data transmitted from the security server, A user terminal; And
The method includes the steps of: registering an account of a secure executable user through the user terminal; transmitting a deletion command of the secure object data to the user terminal based on the registered user account when the security function execution is notified from the user terminal; And a security server for transmitting a processing command of the security target data to the user terminal according to a security target data processing command of the user to prevent leakage of security target data.
The apparatus according to claim 1, wherein the user terminal and the security server are connected via a network, and the user terminal encrypts or deletes the security target data or restores the encrypted security target data into original data.
The system of claim 1, wherein the user terminal comprises: a security setting unit that receives a security function setting signal and a security target data designation signal and receives a password; A storage unit for storing security programs for data security and attribute information for data security; A security control unit for controlling the execution of the security program and the security of the security target data in accordance with a security setting request of the security setting unit; A security function is executed through a security program in cooperation with the security control unit, a password is requested when the security function is booted after execution of the security function, and when the inputted password is different from the registered password, And a security executing unit for performing a secondary security function by deleting the encrypted security target data according to a deletion command of security target data transmitted from the security server.
The security enforcing unit may request re-input of the password by the number of times registered when the password inputted after the password request is inconsistent with the registered password, and if an error occurs in inputting the password more than the registered number, And encrypts the secured object data using a public key.
The user terminal may further include a communication unit connected to the security server via a network and receiving a security target data deletion command or a security target data recovery command transmitted from the security server; And a data restoring unit for restoring the encrypted security target data to original data when a command for restoring the security target data is received by the communication unit.
The data leakage prevention device of claim 5, wherein the data restoration unit restores the security target data encrypted using the private key of the user account included in the security target data restoration command, to the original data.
The security server may further include a communication unit for accessing a user terminal through a network or accessing a user registration terminal through an account; When the security function execution is notified from the user terminal through the communication unit, the control unit controls the user registration terminal to inform the user of the execution of the security function and notifies the user terminal of security function execution information according to the security function processing request information of the user or the registered security function processing information. And a security control unit for transmitting a data processing command to prevent data leakage of the user.
The security server according to claim 7, wherein the security server is connected to the user registration terminal under the control of the security controller, notifies the security function execution state, and transmits security function processing request information transmitted from the user registration terminal to the security controller A function execution notification unit; Further comprising an account registration unit for registering the user's account and the security function processing information of the user.
As a method for preventing data leakage,
(a) setting a security function for preventing leakage of security target data from a user terminal;
(b) requesting a password input when the user terminal is booted after step (a);
(c) comparing the password input from the user terminal with the pre-registered password, and executing the primary security function by encrypting the security target data if the password does not match;
(d) automatically accessing the security server when an Internet connection occurs after the security function is executed in the user terminal, and notifying the security function execution state;
(e) extracting the user registration terminal information through the user account registered in the security server, and informing the user registration terminal of the security function execution state based on the extracted user registration terminal information;
(f) retrieving security function process information previously registered in the security server or security function process request information transmitted from the user registration terminal;
(g) generating a data delete command and transmitting the data delete command to the user terminal when the secure server deletes the secured object data as a result of the searching in the step (f);
(h) performing additional authentication through the user registration terminal when the search result of the step (f) is for restoring the security target data, and if the authentication is normally performed, generating a data restoration command and transmitting the data restoration command to the user terminal; And
(i) if the command received from the user terminal is a data deletion command, the encrypted security target data is deleted to execute the secondary security function, and if the command is a data restoration command, the encrypted security target data is decrypted and restored to original data The data leakage prevention method comprising:
The method as claimed in claim 9, wherein, in the step (c), when the password inputted after the password request is inconsistent with the registered password, the password re-input is requested by the registered number, and when an error occurs in inputting the password more than the registered number, Encrypts the security target data using the public key of the user account, and the step (i) restores the security target data encrypted using the private key of the user account included in the secure target data restoration command to the original data A method for preventing data leakage.



KR1020150137597A 2015-09-30 2015-09-30 Data leakage prevention apparatus and method thereof KR101745390B1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
KR1020150137597A KR101745390B1 (en) 2015-09-30 2015-09-30 Data leakage prevention apparatus and method thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
KR1020150137597A KR101745390B1 (en) 2015-09-30 2015-09-30 Data leakage prevention apparatus and method thereof

Publications (2)

Publication Number Publication Date
KR20170038340A true KR20170038340A (en) 2017-04-07
KR101745390B1 KR101745390B1 (en) 2017-06-12

Family

ID=58583733

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020150137597A KR101745390B1 (en) 2015-09-30 2015-09-30 Data leakage prevention apparatus and method thereof

Country Status (1)

Country Link
KR (1) KR101745390B1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768990A (en) * 2019-10-29 2020-02-07 深信服科技股份有限公司 Data transmission method, system, equipment and computer readable storage medium
KR20210157230A (en) * 2020-06-19 2021-12-28 주식회사 비엠캠프 Method and system for serving hidden message imoticon

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20000072001A (en) 2000-06-15 2000-12-05 윤상권 Method for securing computer file
KR20030084037A (en) 2002-04-24 2003-11-01 주식회사 아이오셀 Method for securing a usb memory device and method for restricting use of a computer using the device
KR100847659B1 (en) 2007-10-02 2008-07-21 김홍균 Method and device for data leakage prevention using ID verification method of key lock board and security USB memory

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100705380B1 (en) 2005-10-19 2007-04-10 (주)이월리서치 The preventing method of information drain using secure computer system
KR101308703B1 (en) * 2013-04-24 2013-09-13 (주)누리아이엔에스 Security system for electronic commerce and method thereof

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20000072001A (en) 2000-06-15 2000-12-05 윤상권 Method for securing computer file
KR20030084037A (en) 2002-04-24 2003-11-01 주식회사 아이오셀 Method for securing a usb memory device and method for restricting use of a computer using the device
KR100847659B1 (en) 2007-10-02 2008-07-21 김홍균 Method and device for data leakage prevention using ID verification method of key lock board and security USB memory

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768990A (en) * 2019-10-29 2020-02-07 深信服科技股份有限公司 Data transmission method, system, equipment and computer readable storage medium
KR20210157230A (en) * 2020-06-19 2021-12-28 주식회사 비엠캠프 Method and system for serving hidden message imoticon

Also Published As

Publication number Publication date
KR101745390B1 (en) 2017-06-12

Similar Documents

Publication Publication Date Title
US7802112B2 (en) Information processing apparatus with security module
US8918633B2 (en) Information processing device, information processing system, and program
CN105279449B (en) Data access control method, system and mobile equipment based on context
CN112513857A (en) Personalized cryptographic security access control in a trusted execution environment
KR101522445B1 (en) Client computer for protecting confidential file, server computer therefor, method therefor, and computer program
CN107103245B (en) File authority management method and device
JP2016531508A (en) Data secure storage
JP2008047085A (en) Data security system, apparatus and method using usb device
JP2012009938A (en) Information processing device and program
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
KR20180016937A (en) System and method for anti-fishing or anti-ransomware application
WO2017166362A1 (en) Esim number writing method, security system, esim number server, and terminal
JP4931543B2 (en) Information device and computer program
JP7105495B2 (en) Segmented key authenticator
EP3787219A1 (en) Key processing method and device
JP4947562B2 (en) Key information management device
KR101745390B1 (en) Data leakage prevention apparatus and method thereof
JP2011248474A (en) Storage medium, information processor and computer program
JP2019054363A (en) Server device, secret dispersion management system and secret dispersion management device
US20220311601A1 (en) Method for pushing key, method for operating file, storage medium, and computer device
KR20210029967A (en) Management system and method for data security for storage device using security device
EP3764264B1 (en) Methods and devices for automatically encrypting files
WO2016193176A1 (en) A remotely protected electronic device
KR101495766B1 (en) System and method for remote security management
JP4899196B2 (en) Data management system, terminal computer, management computer, data management method and program thereof

Legal Events

Date Code Title Description
A201 Request for examination
E902 Notification of reason for refusal
E90F Notification of reason for final refusal
E701 Decision to grant or registration of patent right
GRNT Written decision to grant