KR100874989B1 - Recording medium recording audit device, method and program for terminal - Google Patents

Abstract

Disclosed is a recording medium on which an auditing device, a method and a program for a terminal are recorded. The auditing apparatus includes a determination unit that determines whether to audit the client terminal with reference to the audit policy provided from the audit server; A search unit for searching a target file in the client terminal according to the audit policy; And a transmission unit for transmitting the retrieved target file to the audit server. According to the present invention, there is an advantage that an efficient audit is made for one or more terminals.

Description

Terminal auditing device, method and recorded medium having a program therefore}

1 is a diagram illustrating the overall configuration of an audit server and an audit device according to an embodiment of the present invention.

2 is a diagram illustrating a configuration of an audit server according to an embodiment of the present invention.

3 is a diagram illustrating a configuration of an auditing apparatus according to an embodiment of the present invention.

4 is a flow chart showing an example of the audit method according to an embodiment of the present invention.

5 to 8 are exemplary diagrams of the audit results that the audit server 110 can output in accordance with an embodiment of the present invention.

The present invention relates to a recording medium on which an auditing apparatus, method and program are recorded for a terminal, and more particularly, to a recording medium on which an apparatus, method and program for auditing information in a client terminal connected to an audit server are recorded. .

Most of the work processes of the recent work processors are computer work. The use of computers not only facilitates word processing, but also makes it easy to share files with each other over an in-house network or the Internet.

However, from the corporate management perspective, managing confidential documents that require security is becoming increasingly difficult. This is because confidential documents can be transmitted to other computers more easily through the corporate network. Therefore, management of confidential documents in an in-house computer terminal has become increasingly important.

In the prior art, there is a problem in that there is no efficient auditing device and method for an in-house terminal.

In order to solve the conventional problems as described above, the present invention proposes an efficient auditing apparatus and method.

In addition, the present invention proposes an auditing apparatus and method for retrieving a target file to be audited in advance from a client terminal and transmitting it to the auditing server.

Still other objects of the present invention will be readily understood through the following description of the embodiments.

In order to achieve the above object, according to an aspect of the present invention, in the apparatus for auditing the client terminal connected to the audit server (server), by referring to the audit policy provided from the audit server; Determination unit for determining whether to audit the client terminal; A search unit for searching a target file in the client terminal according to the audit policy; And a transmission unit for transmitting the retrieved target file to the audit server.

It may further include an update unit for receiving the audit policy provided from the audit server.

The auditing apparatus may further include an idle time monitoring unit for monitoring an idle time of the client terminal, wherein one or more of the update unit, the determination unit, and the search unit may be activated according to a monitoring result of the idle time monitoring unit. .

The idle time monitoring unit may determine whether the idle time is in consideration of one or more of the CPU usage rate, memory usage rate, input device operation and drive usage rate of the client terminal.

The audit policy may include one or more of update information, determination information, and target information.

The target information may include one or more of extension information, location information, and keyword information of a target file to be searched, and the searcher may search for the target file corresponding to the target information.

When the searcher searches for the target file corresponding to the keyword information, the searcher may extract the document content from the document file and perform the search using the keyword information.

The location information may include one or more information of a predetermined folder and a drive that the search unit does not search or search in the client terminal.

The update information may include one or more of an update cycle and an update event generation condition, and the update unit may receive the audit policy from the audit server in correspondence with the update information.

The determination information may include at least one of an audit period, IP (Internet Protocol) band information to which a client terminal to be audited, and an audit event generation condition, wherein the determination unit determines whether to audit the client terminal according to the determination information. can do.

When the IP band to which the client terminal to be audited is connected is not included in the IP band information, the determination unit may determine that the client terminal is not audited.

When there is more than one user of the client terminal, the searcher extracts user ID information corresponding to the searched target file, and the transmission unit may transmit the searched target file and the user ID information to the audit server. have.

According to another aspect of the present invention, in a method of auditing a client terminal connected to an audit server, (a) whether or not to audit the client terminal with reference to the audit policy provided from the audit server; Determining; (b) searching for a target file in the client terminal according to the audit policy when auditing the client terminal according to the audit policy; And (c) transmitting the retrieved target file to the audit server.

 (d) monitoring the idle time of the client terminal is performed before the step (a), and the steps (a) to (c) are performed only if the idle time of the client terminal continues for a predetermined time or more. Can be performed.

The idle time may be determined in consideration of one or more of the CPU usage rate, memory usage rate, input device operation rate, and drive usage rate of the client terminal.

The audit policy may include one or more of update information, determination information, and target information.

The target information may include at least one of extension information, location information, and keyword information of a target file to be searched, and the step (b) may be performed according to the target information.

When the step (b) is performed corresponding to the keyword information, the document content may be extracted from the document file to perform a search using the keyword information.

The location information may include information of one or more of a predetermined folder and a drive to be searched or not searched in the client terminal.

The update information includes one or more of an update period and an update event generation condition, and the step of receiving and updating the audit policy from the audit server according to the update information after step (a) and before step (b) It can be included in.

The determination information may include at least one of an audit period, IP (Internet Protocol) band information of the client terminal to be audited, and an audit event generation condition, and step (a) may be performed according to the determination information.

When the IP band to which the client terminal to be audited is connected is not included in the IP band information, it may be determined that auditing of the client terminal is not performed in step (a).

When there are two or more users of the client terminal, the searcher may extract user ID information corresponding to the searched target file, and the transmission unit may transmit the searched target file and the ID information of the user to the audit server.

According to another aspect of the present invention, a program of instructions that can be executed by an auditing device to perform a method of auditing a client terminal connected to an audit server is tangibly implemented. A recording medium recording a program that can be read by: (a) determining whether to audit the client terminal with reference to the audit policy provided from the audit server; (b) searching for a target file in the client terminal according to the audit policy when auditing the client terminal according to the audit policy; And (c) a recording medium on which a program for performing the step of transmitting the retrieved target file to the audit server is recorded.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, the same reference numerals will be used for the same means regardless of the reference numerals in order to facilitate the overall understanding.

1 is a diagram illustrating the overall configuration of an audit server and an audit device according to an embodiment of the present invention.

Referring to Figure 1, the audit method according to an embodiment of the present invention is performed in one or more auditing devices (121, 122, 123) connected to the audit server (110).

Here, the auditing device 120 may be an audit client module installed in the client terminal or a client terminal including the client module to perform the audit method according to an embodiment of the present invention.

For example, the first auditing apparatus 121 may have a program installed to perform the auditing method of the first client terminal 121-1 according to an embodiment of the present invention.

Hereinafter, in order to facilitate the understanding and explanation of the present invention, one or more auditing devices 121, 122, 123 will be described as an auditing device 120. However, it will be apparent to those skilled in the art that the auditing method according to the embodiment of the present invention is not limited thereto, and may be performed simultaneously on one or more auditing devices 121, 122, and 123 or in various preset time sequences.

It is apparent to those skilled in the art that the audit server 110 and the audit device 120 may be connected to the wired or wireless Internet, and may be connected to various networks such as a local area network (LAN).

So far we looked at the overall configuration of the audit method according to an embodiment of the present invention. Hereinafter, the audit server 110 will be described with reference to FIG. 2.

2 is a diagram illustrating a configuration of an audit server according to an embodiment of the present invention.

2, the audit server 110 according to an embodiment of the present invention may include an audit policy unit 210, a storage unit 220, and a transmission unit 230.

The audit policy unit 210 may include one or more audit policies for the audit method performed by the audit device 120.

An audit policy according to an embodiment of the present invention may include one or more of update information, determination information, and target information. The description thereof will be described later in detail with reference to FIG. 4.

The storage unit 220 may store the target file transmitted from the auditing device 120. Here, the target file is the result of performing the audit in the auditing device 120 in accordance with the audit policy according to an embodiment of the present invention. Description of the target file will be described later in detail with reference to FIG. 4.

Here, although FIG. 2 illustrates that the storage unit 220 is included in the audit server 110, it is apparent to those skilled in the art that the storage unit 220 may be provided as a separate external device.

The transmitter 230 may transmit the audit policy of the audit policy unit 210 to the audit device 120. In addition, the transmitter 230 may receive the target file from the auditing device 120. Operation of the transmitter 230 according to an embodiment of the present invention will be described later in detail with reference to FIG. 4.

So far it has been described with respect to the audit server 110 according to an embodiment of the present invention. Hereinafter, an auditing apparatus 120 according to an embodiment of the present invention will be described with reference to FIG. 3.

3 is a diagram illustrating a configuration of an auditing apparatus according to an embodiment of the present invention.

Referring to FIG. 3, the auditing device 120 according to an embodiment of the present invention includes an updater 310, a determiner 320, a searcher 340, an idle time monitor 350, and a transmitter 330. It may include.

Each component included in the auditing apparatus 120 of the present invention will be described later in detail with reference to FIG. 4.

So far, the configuration of the audit server 110 and the audit device 120 according to an embodiment of the present invention has been described. Hereinafter, an auditing method performed by the auditing apparatus 120 according to an exemplary embodiment of the present invention will be described with reference to FIG. 4.

4 is a flowchart showing an example of an auditing method according to an embodiment of the present invention. Hereinafter, for the convenience of understanding and explanation of the present invention, the same will be described with reference to FIG. 3.

Referring to FIG. 4, in operation S401, the determination unit 320 of the auditing apparatus 120 determines whether to audit the client terminal. Here, the audit device 120 is a client terminal is installed a program for performing the audit method according to an embodiment of the present invention.

For example, the first auditing device 121 is a program for performing the auditing method according to an embodiment of the present invention for the first client terminal 121-1.

The audit policy may include decision information, as described with reference to FIG. 2. The determination unit 320 of the auditing device 120 determines whether to audit the client terminal according to the determination information.

For example, the determination information may include an audit cycle. In this case, the determination unit 320 may determine that the client terminal is to be audited when it corresponds to the audit period.

For example, the determination information may include an audit event occurrence condition. The audit event generating condition may be a case where an audit command is received from the audit server 110. In this case, the determination unit 320 may determine to audit the client terminal when the audit command is received from the audit server 110.

For example, the determination information may include an audit period and IP (Internet Protocol) band information to which the client terminal to be audited is connected. In this case, when the audit period 320 corresponds to the audit period, the determination unit 320 may determine that only the client terminal connected to the IP band is audited.

For example, the determination information may include a media access control address of the client terminal to be audited and / or a user ID. In this case, the determination unit 320 may determine that the client terminal corresponding to the MAC address and / or the user ID of the client terminal to be audited. In more detail, the operating system of the client terminal may include ID information of the user currently logged in. In addition, the determination unit 320 may extract user ID information from the operating system. Therefore, the determination unit 320 may determine whether to audit the client terminal according to whether the extracted user ID information is included in the determination information.

Subsequently, in step S402, the update unit 310 of the audit apparatus 120 may receive and update the audit policy from the server policy unit 210 of the audit server 110.

The audit policy may include update information and target information as described with reference to FIG. 2. The target information will be described later in detail in step S403. The update information may include an update cycle and / or an update event occurrence condition.

For example, the update information may include an update event occurrence condition. The update event generation condition may be a case where the determination unit 320 of the auditing device 120 determines that the client terminal is to be audited. In this case, after the determination unit 320 determines to audit the client terminal in step S401 as described above, the update unit 210 receives the audit policy from the audit policy unit 210 of the audit server 110. Can be updated.

For example, the update information may include a predetermined update period. In this case, irrespective of the above-described step S401, the updater 310 may receive and update the audit policy from the audit policy unit 210 of the audit server 110 in a case where it corresponds to a predetermined period.

Subsequently, in step S403, the searching unit 340 of the auditing device 120 searches for the target file among the information in the client terminal according to the target information.

For example, the target information may include information on a predetermined extension file (eg, hwp, gul, doc, txt). In this case, the search unit 340 of the auditing device 120 may search for a file having a predetermined specific extension among the information in the client terminal.

For example, the target information may include one or more keyword information. The search unit 340 may search for a target file to be searched by using a keyword in the extracted text, if the document content, such as a word processor or an email document file, may be extracted in text form. In the case of other images, audio files, and the like, the file names can be searched using keywords.

At this time, one or more keywords may be bound through an OR / AND operator. For example, one or more keywords may be "confidential + accounting." At this time, "+" represents an OR operator. In this case, in the case of a word processor or an email document file, the content of the document may be extracted in a text form, and the target file may be searched by searching whether the extracted text includes the keyword "confidential" or "accounting".

For example, the target information may be a predetermined extension and / or a predetermined period. In this case, the search unit 340 may search for a target file by searching for a file having a specific extension generated within a predetermined period.

For example, the target information may include a predefined folder name to be included or not included in the audit target. In this case, the search unit 340 may or may not search for a file in a predetermined folder corresponding to the target information. This point will be described below in more detail.

In general, an application or a program installed in the client terminal is stored in the "WINDOWS" directory of the "C drive" of the system folder of the client terminal. That is, in general, an application or a program is often stored in a "WINDOWS" directory rather than a file operated by a user of the client terminal. Therefore, in order for the auditing apparatus 120 to audit the client terminal, it is inefficient for the searching unit 340 to search for the target file in the "WINDOWS" directory.

The object information according to the embodiment of the present invention may exclude the "WINDOWS" directory from the object to be audited. In this case, the search unit 340 may not search for files in the "WINDOWS" directory according to the target information. Therefore, the auditing method according to the embodiment of the present invention can perform more efficient auditing by including or excluding a predetermined folder in the client terminal.

Subsequently, in operation S404, the transmitter 330 may transmit one or more target files searched and extracted by the searcher 340 to the storage 220 of the audit server 110. At this time, it will be apparent to those skilled in the art that the information on the client terminal (eg, the MAC address of the client terminal and / or the user ID information, etc.) may be transmitted together with the searched target file.

Here, it is apparent to those skilled in the art that step S404 may be performed before the user logs out of the client terminal or before the client terminal shuts down.

Here, a plurality of users can use the client terminal. In this case, in step S403, the search unit 340 extracts a user ID for generating each searched target file, and transmits a user ID and an audit time of the searched target file to the audit server 110 in step S404. It will be apparent to those skilled in the art. In addition, according to various environments to which the present invention is applied, various information for identifying each target file to be searched may additionally be extracted in step S403 and transmitted to the audit server 110 in step S404. Self-explanatory

Here, although not shown in Figure 4, the audit server 110 according to an embodiment of the present invention may store the content received from the audit device 120 in step S404 based on the user ID or audit time, etc. . The description thereof will be described later in detail with reference to FIG. 8. It is apparent to those skilled in the art that the audit server 110 may be classified and stored according to various criteria according to various environments to which the present invention is applied.

Furthermore, the audit server 110 according to an embodiment of the present invention is the audit result stored in the audit server 110 according to the information (for example, authority information or position information, etc.) of the user accessing the audit server 110. Can output (or display) a limited amount. More specifically, information about a hierarchical structure of a user who can access the audit server 110 may be stored in advance in the audit server 110. Then, the audit server 110 extracts the information of the user accessing the audit server 110, and extracts the authority in the above-described hierarchical structure. The audit server 110 may output (or display) the audit result in a limited way according to the extracted authority.

For example, the hierarchical structure of the group to which the audit method according to the embodiment of the present invention is applied may be a representative director, a manager group, a manager group, or an ordinary employee group in the direction of the lower group from the upper group if the audit method is applied. have. Here, the upper group may be set to have the authority to query the audit results for the lower group in the audit server (110). That is, for example, the manager group may have the authority to query the audit results for the client terminal of the manager group and the plain employee group. Of course, it is obvious that the authority to inquire about the subgroup may be limited to the scope of having a business or audit relationship with the parent group.

In addition, it will be apparent to those skilled in the art that a user of a higher group according to the above-described hierarchical structure may have a right to modify and change an audit policy for a lower group.

In addition, it will be apparent to those skilled in the art that the information on the hierarchical structure described above may be variously modified and changed according to the environment to which the present invention is applied.

Although not shown in Figure 4, the audit method according to an embodiment of the present invention may further include the step of monitoring the idle time (idel time) of the idle time monitoring unit 350.

In this case, the idle time means a time when the utilization rate or occupancy rate of the client terminal by the user or another application is equal to or less than a predetermined level. In other words, the idle time is the time when the client terminal is not used for other tasks.

In some embodiments, the idle time may be determined in consideration of a central processing unit (CPU) utilization, input device operation, and drive utilization. In other words, the idle time is less than the set percentage of the central processing unit and memory, and the user input to the input device such as keyboard or mouse does not occur and the data input / output through the hard disk or the network is below a predetermined level. Can be determined.

If the audit method according to an embodiment of the present invention further comprises the step of monitoring the idle time, it will be apparent to those skilled in the art that any one or more of the steps S401 to S403 may be performed in the idle time.

So far, the audit method according to the embodiment of the present invention has been described with reference to FIG. 4. Hereinafter, another embodiment of the present invention will be described with reference to FIG. 4. However, in order to clarify the gist of the present invention, a description overlapping with the above description will be omitted.

According to another embodiment of the present invention, the determination information in step S401 may be a case in which a file having an extension specified in advance as an audit event occurrence condition is generated. In this case, when a file having a predetermined extension is generated in step S401, the determination unit 320 may determine that the client terminal is to be audited.

For example, the determination information may include a case where a file having a hwp extension is generated in the client terminal as a condition for generating an audit event. In addition, a file having a hwp extension may be generated by a user of the client terminal. In this case, the determination unit 320 of the auditing device 120 may recognize that the file having the hwp extension is generated and determine that the client terminal is audited.

Subsequently, steps S402 and S403 may be omitted, and in step S404, the transmission unit 330 may check a file having a predetermined extension (for example, a file having the above-described hwp extension) in the audit server 110. Can be sent to. At this time, the ID of the user who created the file having the predetermined extension, information about the client terminal (for example, the MAC address of the client terminal, the IP address connected to the client terminal, etc.) together to the audit server 110. It will be apparent to those skilled in the art that it can be transmitted.

In addition, the transmission unit 330 may perform a process in which the client terminal shuts down the system or the user logs out the file having the above-specified extension (for example, the file having the above-described hwp extension). It will be apparent to those skilled in the art that the data may be transmitted to the audit server 110 immediately before the system shutdown.

So far, the audit method according to the embodiment of the present invention has been described with reference to FIG. 4. Hereinafter, the results of the audit method according to an embodiment of the present invention will be described with reference to FIGS. 5 to 8.

5 to 8 are examples of the audit results that the audit server 110 can output in accordance with an embodiment of the present invention. Hereinafter, descriptions overlapping those described with reference to FIGS. 1 to 4 will be omitted. In order to clarify the gist of the present invention, the description of the general menu is omitted from the output screen of the computer terminal, and the description will be mainly focused on the part related to the result of the audit method according to the embodiment of the present invention.

In addition, the audit results outputted (or displayed) by the audit server 110 according to the embodiment of the present invention illustrated in FIGS. 5 to 8 are merely for the purpose of describing the present invention, but are not limited thereto. It is obvious to those skilled in the art.

In addition, hereinafter, a user connected to the audit server 110 for convenience of understanding and explanation of the present invention will be described on the assumption that a representative director included in the top group is connected in the above-described hierarchical structure. . In this case, the CEO has the authority to modify and change the audit policy, and the audit results for the entire subgroups can be inquired with reference to FIG. 4.

Referring to FIG. 5, the audit server 110 according to an embodiment of the present invention may output (or display) the current audit policy to the representative director of the top group (see 510 of FIG. 5). For example, the audit period 511 and the target information 512 of the audit policy may be provided together. However, it is apparent to those skilled in the art that the present invention is not limited thereto, and that one or more of update information, judgment information, and target information included in the audit policy may be variously output (or displayed) to the representative director.

6 and 7, the audit server 110 according to an embodiment of the present invention may provide an interface for modifying and changing the current audit policy to the representative director of the top group (see 610 of FIG. 6). ).

For example, an interface 611 for modifying or changing a folder to be included or not included in an object to be audited among the target information, an interface 612 for modifying and changing an extension of a target file to be searched among target information, and determination information. An interface 613 (see FIG. 7) for modifying and changing an audit period of the audit period and an interface 614 for modifying and changing IP band information connected to a client terminal to be audited may be provided. However, it will be apparent to those skilled in the art that the present invention is not limited thereto, and that the representative director can provide various interfaces for modifying or changing one or more of update information, judgment information, and target information included in the audit policy.

Referring to FIG. 8, the audit server 110 according to an embodiment of the present invention may provide an interface 810 for querying an audit result. Here, the audit server 110 may classify based on the user ID and the audit time of the target file to output the audit results (display) (see 811).

For example, in the audit result, the user of the client terminal is selected by Jumong 815, and the audit time is selected on November 19, 2006 14:36 (820), and the location of the drive and folder is D drive 821. Project folder 822 may be selected. At this time, the audit server 110 according to an embodiment of the present invention can output (or display) the audit results according to the selection of the representative in detail (823), and download a specific file or folder to the terminal of the representative director An interface 824 may be provided. However, the present invention is not limited thereto, and it will be apparent to those skilled in the art that the audit results may be variously modified and / or changed to be output (or displayed) in the audit server 110.

Up to now, with reference to Figures 5 to 8, the audit server 110 according to an embodiment of the present invention to provide an interface that can query, modify and / or change the audit policy to the user connected to the audit server 110 It can be explained. In addition, it was described that the audit result according to an embodiment of the present invention can be efficiently provided to the user connected to the audit server 110.

An auditing method for a client terminal according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like.

The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Hardware devices specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The above-described embodiments of the present invention are disclosed for the purpose of illustration, and those skilled in the art may make various modifications, changes, and additions within the spirit and scope of the present invention. Should be considered to be within the scope of the following claims.

As described above, the auditing apparatus and method according to the present invention has an advantage of performing efficient auditing.

In addition, the auditing apparatus and method according to the present invention has an advantage that the client can search for a predetermined target file to be audited in the client terminal and transmit the audited file to the audit server.

Claims (24)

In the device connected to the audit server (auditor) to audit the client (client) terminal, A determination unit determining whether to audit the client terminal by referring to an audit policy provided from the audit server; A search unit for searching a target file in the client terminal according to the audit policy; And Includes a transmission unit for transmitting the retrieved target file to the audit server, The audit policy includes one or more of update information, judgment information, and target information. And the target information includes at least one of a predetermined folder and a drive that the search unit searches in the client terminal or does not search. The method of claim 1, And an updater for receiving an audit policy provided from the audit server. The method of claim 1, The audit device further includes an idle time monitoring unit for monitoring an idle time of the client terminal, At least one of the update unit, the determination unit, and the search unit is activated according to a monitoring result of the idle time monitoring unit. The method of claim 3, wherein The idle time monitoring unit And determining whether the idle time is in consideration of one or more of the CPU usage rate, memory usage rate, input device operation rate, and drive usage rate of the client terminal. delete The method of claim 1, The target information includes one or more of extension information, location information, and keyword information of a target file to be searched. And the search unit searches for a target file corresponding to the target information. The method of claim 6, When the search unit searches for a target file corresponding to the keyword information, And extracting document content from a document file to perform a search using the keyword information. delete The method of claim 1, The update information includes one or more of an update cycle and an update event occurrence condition, And the update unit receives the audit policy from the audit server corresponding to the update information. The method of claim 1, The determination information includes at least one of an audit period, IP (Internet Protocol) band information connected to a client terminal to be audited, and an audit event generation condition. And the determination unit determines whether to audit the client terminal according to the determination information. The method of claim 10, When the IP band to which the client terminal to be audited is connected is not included in the IP band information, And the determination unit determines not to audit the client terminal. The method of claim 1, If there is more than one user of the client terminal, The search unit extracts ID information of the user corresponding to the searched target file, And the transmission unit transmits the searched target file and the user ID information to the audit server. In the method of auditing a client terminal connected to an audit server, (a) determining whether to audit the client terminal by referring to an audit policy provided from the audit server; (b) searching for the target file in the client terminal according to the audit policy when auditing the client terminal according to the audit policy; And (c) transmitting the retrieved target file to the audit server, The audit policy includes one or more of update information, judgment information, and target information. And the target information includes one or more of a predetermined folder and a drive to be searched or not searched in the client terminal. The method of claim 13, (d) monitoring the idle time of the client terminal is performed before step (a); The audit method, characterized in that the steps (a) to (c) is performed only when the idle time of the client terminal continues for more than a predetermined time. The method of claim 14, And determining whether the idle time is in consideration of one or more of CPU usage, memory usage, input device operation, and drive usage of the client terminal. delete The method of claim 13, The target information includes one or more of extension information, location information, and keyword information of a target file to be searched. The audit method, characterized in that step (b) is performed corresponding to the target information. The method of claim 17, When step (b) is performed corresponding to the keyword information, And extracting document content from a document file to perform a search using the keyword information. delete The method of claim 13, The update information includes one or more of an update cycle and an update event occurrence condition; And receiving and updating the audit policy from the audit server in correspondence with the update information, after step (a) and before step (b). The method of claim 13, The determination information includes one or more of an audit period, IP (Internet Protocol) band information of the client terminal to be audited, and an audit event generation condition. The audit method, characterized in that the step (a) is performed corresponding to the determination information. The method of claim 21, When the IP band to which the client terminal to be audited is connected is not included in the IP band information, In step (a), the audit method characterized in that it is determined not to audit the client terminal. The method of claim 13, If there is more than one user of the client terminal, The step (b) further includes extracting user ID information corresponding to the searched target file, The step (c) further comprises the step of transmitting the user's ID information to the audit server. In order to perform a method of auditing a client terminal connected to an audit server, a program of instructions that can be executed by an audit device is tangibly implemented, and a program that can be read by the audit device is recorded. In the recording medium, (a) determining whether to audit the client terminal by referring to an audit policy provided from the audit server; (b) searching for a target file in the client terminal according to the audit policy when auditing the client terminal with reference to the audit policy; And (c) performing a step of transmitting the retrieved target file to the audit server; The audit policy includes one or more of update information, judgment information, and target information. And the target information includes information of at least one of a predetermined folder and a drive not to be searched or searched in the client terminal.

Images