KR101709276B1 - Endpoint Security Server Management System - Google Patents

Abstract

The present invention relates to an endpoint security server management system, and more specifically, to a system for upgrading a security level of a file in a cloud computing environment. To this end, according to the system of a preferable embodiment of the present invention, especially, when a local agent enter a security mode during use of a cloud service by a user terminal in response to an event that the user terminal sets up the security on a generated file or downloads an encoded fragment file given thereon with a security identifier from a server, a security key is switched into a second en-decoded module through a mode switching unit for switching the security key from a first en-decoding module into the second en-decoding module. Through the second en-decoding module, a file received from the local agent is the encoded file is given with a security identifier, the file given with the security identifier is fragmented, and fragment algorithm information is generated, thus the security identifier and the fragment algorithm information are stored. Then, the file, which is given with the security identifier and encoded, is transmitted to the local agent, or the security identifier is received from the local agent through the second en-decoding module, the security identifier and the fragment algorithm information, and the encoded fragment files are combined, decoded and transmitted to the local agent.

Description

Endpoint Security Server Management System {Endpoint Security Server Management System}

The present invention relates to an endpoint security server management system, and more particularly, to a system capable of improving the security level of a file in a cloud computing environment.

Recently, cloud computing has been widely used for efficient distribution of IT resources and secure storage of data. The concept of cloud computing has already been advocated by American computing scholar John McCarthy in the 1960s. Recently, as the communication infrastructure is rapidly improving and the demand for efficiently distributing the resources of the computing environment is growing, the development and development speed of the cloud computing is increasing.

In the cloud computing environment, users do not need high-end handsets, thus reducing the investment cost of IT equipment at the client level and efficiently distributing IT resources according to the usage environment. In the cloud computing environment, there are security issues if users can use cloud resources anytime and anywhere.

An endpoint security solution is a security function that installs and provides a security solution at the end user's computer. It mainly includes information leakage prevention, media control (CDROM, USB, Ethernet), user management and the like. In the past, there is a separate server, and an agent program called a client program is installed in each user terminal to provide a security function. Recently, the concept of cloud-based endpoint security service that uses endpoint security solution in traditional server-client environment has been introduced in the cloud computing domain.

Korean Patent Laid-Open No. 10-2014-0110042 (Publication date: 2014.09.16)

An object of the present invention is to provide a system capable of improving the security level of a file in a cloud computing environment.

Other objects and advantages of the present invention will be described hereinafter and will be understood by the embodiments of the present invention. Further, the objects and advantages of the present invention can be realized by the means and the combination shown in the claims.

The above object of the present invention can be achieved by a cloud server that requires authentication procedures of a first authentication unit and a second authentication unit for providing a cloud service, A user terminal installed on the end point and having a local agent cooperating with the cloud server; And a security key having a first encryption / decryption module, a second encryption / decryption module, and a mode switching unit and connected to the user terminal.

Here, the security key may include a security key, when the local agent enters the security mode due to an event that the user terminal uploads a security-enabled file to the cloud server or downloads from the cloud server during use of the cloud service, The second encryption / decryption module may switch to the second encryption / decryption module through the mode switching unit that switches from the encryption / decryption module to the second encryption / decryption module, and may decrypt the secured file received from the local agent in the second encryption / decryption module.

Alternatively, when the security agent enters the security mode by the occurrence of an event that the user terminal establishes security for a file generated by the user terminal during the use of the cloud service, the first encryption decryption module transmits the security decryption key to the second encryption decryption module A second encryption / decryption module for converting the file received from the local agent through the second encryption / decryption module to a file obtained by encrypting and encrypting the file, , Generating fragmentation algorithm information, storing the security identifier and fragmentation algorithm information, and transmitting the encrypted fragmented file to the local agent, to which the security identifier is assigned.

In addition, when the user terminal enters a security mode in response to an occurrence of an event in which a security identifier is assigned while the user terminal is using a cloud service and an encrypted fragments file is downloaded from a cloud server, The second encryption / decryption module is switched to the second encryption / decryption module through the mode switching unit switching to the second encryption / decryption module, and the security identifier received from the local agent is given through the second encryption / decryption module, Combine and decrypt the fragmented file, and send it to the local agent.

The user terminal is first authenticated according to the authentication procedure of the first authentication unit of the cloud server and connected to the cloud server, and is used in the authentication procedure of the second authentication unit of the cloud server using the first encryption / decryption module And may be secondarily authenticated by decrypting the authentication ID to receive the cloud service.

In addition, the first and second encryption / decryption modules may be implemented with different encryption / decryption algorithms.

According to the present invention, in a cloud computing environment, a security level can be improved by decrypting an ID used in authentication using a security key, which is separate hardware.

In addition, according to the present invention, a file is divided into a plurality of file fragments and stored in a cloud server. When a plurality of stored file fragments are combined, a security identifier and engraving algorithm information are required. Therefore, even if a file stored in a cloud server is leaked, Otherwise, the file can not be combined or decrypted, thus enhancing security.

1 is a block diagram of an endpoint security server management system according to the present invention,
Figure 2 is a functional block diagram of the cloud server of Figure 1;
Figure 3 is a functional block diagram of the security key of Figure 1;
FIG. 4 through FIG. 7 illustrate information flow and processing in an endpoint security server management system according to the present invention; FIG.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

Accordingly, it is to be understood that the invention is capable of numerous changes, has various embodiments, and includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described more fully with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown.

The terms first, second, etc. may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may be referred to as a first component.

And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present invention, the terms "comprising" or "having ", and the like, specify that the presence of stated features, integers, steps, operations, elements, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be construed as meaning consistent with meaning in the context of the relevant art and are to be interpreted as ideal or overly formal in meaning unless explicitly defined in the present invention Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms and words used in the present specification and claims should not be construed as limited to ordinary or dictionary terms, and the inventor should appropriately interpret the concepts of the terms appropriately It should be interpreted in accordance with the meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined.

1 is a schematic diagram of an endpoint security server management system (hereinafter, referred to as 'management system') according to the present invention.

The management system includes a cloud server 100, a user terminal (end point) 200, a smart phone 400, and an authentication number management server 500 that communicate with each other via a network. The management system includes a user terminal 200 (Not shown). Here, the user terminal 200 refers to an end point in the network topology.

The cloud server 100 may provide a cloud service interface function, an authentication function, a software as a service (SaaS), a platform as a service (PaaS), a hardware as a service (Haas), and an infrastructure as a service . The cloud server 100 may include a primary authentication unit 110, a local agent providing unit 120, a secondary authentication unit 130, and a cloud service providing unit 140. The primary authentication unit 110 may perform the primary authentication for the user through the ID / password input on the user terminal 200. [ The local agent providing unit 120 may transmit the local agent to the user terminal 200 in response to the completion of the primary authentication. The second authentication unit 130 may provide the encrypted second authentication ID to the user terminal 200 if there is a second authentication request from the local agent executed in the user terminal. The secondary authentication ID may be information that the user first registers through the local agent when accessing the cloud server 100. [ Here, the secondary authentication ID provided by the cloud server 100 may be an encrypted ID, and may be an ID encrypted by the security key 300 when the cloud service is initially accessed. When the secondary authentication unit 130 receives the secondary authentication ID that has been decoded by the security key from the local agent, the secondary authentication unit 130 can perform the secondary authentication on the user. When the secondary authentication is completed, the cloud service provider 140 can provide the cloud service to the user terminal.

The user terminal 200 may be an endpoint on a network topology. And may belong to the user terminal of the present invention as long as they have a communication function through a network. When the cloud service is to be used, the user terminal 200 can receive the local agent from the cloud server 100 and install / execute the local agent. The local agent may be an agent dedicated to the cloud service described later. The user terminal 200 has a USB port through which the security key 300 can be connected. In response to the connection of the security key 300, the local agent may request secondary authentication to the cloud server 100. At this time, the cloud server 100 may provide the secondary authentication ID to the user terminal 200. Here, the secondary authentication ID provided by the cloud server 100 may be an encrypted ID, and may be an ID encrypted by the security key 300 when the cloud service is initially accessed. When the local agent receives the secondary authentication ID from the cloud server 100, the local agent can provide it to the security key 300. At this time, the security key 300 may decrypt the secondary authentication ID on the first encryption / decryption module 310 and provide the decrypted secondary authentication ID to the local agent. At this time, the local agent can provide the decrypted ID to the cloud server 100, and the cloud server 100 can perform the secondary authentication using the decrypted secondary authentication ID. When the secondary authentication is completed, the user can receive the cloud service from the cloud server 100 through the local agent. When using the cloud service, the local agent can enter the security mode if the user requests the cloud server 100 with a file having a security setting. The local agent can enter the security mode if a security identifier is detected on the file name requested by the user. If the security setting is performed when the user uploads the file to the cloud server 100 after the file operation, the second encryption / decryption module 330 on the security key 300 can encrypt the file and stipulate the security identifier in the file name. The local agent can upload a file having the file name having the security identifier to the cloud server 100. In this background, the local agent enters the security mode when a security identifier is detected on the file name requested by the user. Upon entering the security mode, the local agent can request the authentication number to the authentication number management server 500. In response, the authentication number management server 500 can transmit the authentication number to the smartphone 400 having the preset number. Here, the smartphone 400 may be a smartphone 400 owned by a holder of a valid security key 300. At this time, if the user inputs an authentication number on the user terminal 200, the local agent can provide the authentication number to the security key 300. [ In this case, when the authentication number stored on the security key 300 and the authentication number provided by the local agent are the same, the mode switching unit 320 on the security key transmits the encryption / decryption module interlocked with the user terminal 200 to the first encryption / Module 310 to the second encryption / decryption module 330. At this time, the file having the security identifier provided by the cloud server 100 can be decrypted on the second encryption / decryption module 330 at the request of the local agent. When the user operates the decrypted file using the second encryption / decryption module 330 and requests upload via the local agent, the local agent can request encryption to the second encryption / decryption module 330. Upon request, the encryption target file may be provided to the second encryption / decryption module 330. At this time, the second encryption / decryption module 330 encrypts the file to be encrypted and concatenates the security identifier with the file name. When the encryption is completed, the local agent can upload the encrypted file having the file name with the security identifier to the cloud server 100. When the upload is completed, the security mode of the local agent can be terminated.

The security key 300 may include a first encryption module 310, a mode switching unit 320, and a second encryption module 330. The security key 300 is hardware separate from the user terminal 200 and can be manufactured as a USB type. The security key 300 may be connected to the user terminal 200 via the USB.

The first encryption / decryption module 310 may decrypt the secondary authentication ID at the request of the local agent during the secondary authentication described above. The first encryption module 310 can encrypt the secondary authentication ID when using the first cloud service. At this time, the local agent can register the encrypted secondary authentication ID in the cloud server 100. When the mode switching unit 320 receives the mode change request including the authentication number from the local agent, the mode switching unit 320 may switch the privacy guard module interlocked with the user terminal 200 from the first amblyopia call module to the second amblyopia module. The second encryption module 330 can decrypt a file having a security identifier received through the local agent. On the other hand, if the user requests upload of a file that is operated on the user terminal, the second encryption module 330 encrypts the file At the same time, a security identifier can be included in the file name.

Meanwhile, when the security agent 300 enters the security mode in response to the occurrence of an event for security setting of a file generated by the user terminal 200 during the use of the cloud service by the user terminal 200, The second encryption / decryption module 330 may be switched to the second encryption / decryption module 330 through the mode switching unit 320 that switches from the encryption / decryption module 310 to the second encryption / decryption module 330. At this time, the second encryption / decryption module 330 encrypts the file received from the local agent, assigns a security identifier to the encrypted file, decomposes the file to which the security identifier is given into several fragments, The security identifier and fragmentation algorithm information may be stored, the security identifier may be assigned, and the encrypted fragments may be transmitted to the local agent.

In addition, the security key 300 is generated when an event occurs in which the security terminal is downloaded and the encrypted fragment file is downloaded from the cloud server 100 while the user terminal 200 is using the cloud service, The second encryption / decryption module 330 can be switched to the second encryption / decryption module 330 through the mode switching unit 320 which switches from the first encryption / decryption module 310 to the second encryption / decryption module 330. At this time, the encryption / decryption module 330 combines and decrypts the scrambled file having the security identifier received from the local agent through the security identifier and the fragmentation algorithm information, and transmits the fragmented file to the local agent.

The fragmentation algorithm information may include identification information of the file, size information of the file, size information of each file fragment, location information of each file fragment in the file, and order information of the file fragment in the file.

The first and second encryption / decryption modules may be implemented with different encryption / decryption algorithms.

Hereinafter, the operation process of the security system will be described. The configuration of the security system can be made more clear by the following description.

<Primary certification process>

The user terminal 200 can access the cloud server 100 by a user operation and (1) the cloud server 100 can perform the primary authentication through the ID / password input on the user terminal 200. [ If the authentication fails, the session between the user terminal and the cloud server may be terminated. In response to completing the primary authentication, the cloud server 100 may send the local agent to the user terminal 200 (see FIG. 4). At this time, a local agent may be installed on the user terminal 200 and executed. The local agent may be an agent for using the cloud service through the cloud server 100. [

<Secondary certification process>

(1) The security key 300 may be connected to the user terminal 200. The security key 300 is manufactured as a USB type, and the security key 300 can be connected to the user terminal 200 through the USB port.

(2) In response to the connection of the security key 300, the local agent can request the secondary authentication to the cloud server 100. (3) At this time, the cloud server 100 may provide the secondary authentication ID to the user terminal 200. [ Here, the secondary authentication ID provided by the cloud server 100 may be an encrypted ID, and may be an ID encrypted by the security key 300 when the cloud service is initially accessed. When the local agent receives the secondary authentication ID from the cloud server 100, it can provide it to the security key. (4) At this time, the security key 300 may decrypt the secondary authentication ID on the first encryption / decryption module 310 and provide the decrypted secondary authentication ID to the local agent. The local agent can provide the decrypted ID to the cloud server 100 and the cloud server 100 can perform the secondary authentication using the decrypted secondary authentication ID.

(5) When the secondary authentication is completed, the cloud server 100 can provide the cloud service to the user terminal. At this time, the local agent can perform a user interface function to use the cloud service. Here, the cloud service provided by the cloud server 100 includes all known Software as a Service (SaaS), Platform as a Service (PaaS), Hardware as a Service (Haas), and Infrastructure as a service . If the secondary authentication fails, the session between the local agent and the cloud server 100 may be terminated.

<File security process 1>

In the case where the local agent requests the cloud server 100 to use a file having a security setting while the cloud service is in use (S110), the local agent can enter the security mode. The local agent may enter the security mode if a security identifier is detected on the file name requested by the user (S120, S130)). When the user sets security when uploading to the cloud server 100 after the file operation, the second encryption / decryption module 330 on the security key 300 can encrypt the file and stipulate the security identifier in the file name ( S140). Then, the local agent can upload a file having the file name having the security identifier to the cloud server 100 (S150). In this background, when the security identifier is detected on the file name requested by the user, the local agent enters the security mode (S110, S120).

Upon entering the security mode, the local agent can request the authentication number to the authentication number management server 500. In response, the authentication number management server 500 can transmit the authentication number to the smartphone 400 having the preset number. Here, the smartphone 400 may be a smartphone 400 owned by a holder of a valid security key 300.

At this time, if the user inputs an authentication number on the user terminal 200, the local agent can provide a mode change request including the authentication number to the security key 300. [ In this case, when the authentication number stored on the security key 300 and the authentication number provided by the local agent are the same, the mode switching unit 320 on the security key decrypts the encryption / decryption module linked with the user terminal 200 as the first encryption / Module 310 to the second encryption / decryption module 330 (S130). If the authentication fails, the mode switching unit 320 may provide a message to the local agent not to switch the mode.

At this time, the file having the security identifier provided by the cloud server 100 may be decrypted on the second encryption / decryption module 330 at the request of the local agent (S150). When the user operates the decrypted file using the second encryption / decryption module 330 and requests upload via the local agent, the local agent can request encryption to the second encryption / decryption module 330. Upon request, the encryption target file may be provided to the second encryption / decryption module 330. At this time, the second encryption / decryption module 330 encrypts the encryption object file and concatenates the security identifier into the file name (S140). When the encryption is completed, the local agent can upload the encrypted file having the file name of the security identifier to the cloud server 100 (S150). When the upload is completed, the security mode of the local agent can be terminated.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It will be understood that various modifications and changes may be made without departing from the scope of the appended claims.

100: Cloud server
200: User terminal (end point)
300: Security Key
400: Smartphone
500: Authentication number management server

Claims (5)

A cloud server (100) requesting an authentication procedure of the first authentication unit (110) and the second authentication unit (130) for providing a cloud service;
A user terminal 200 installed on an end point and having a local agent interworking with the cloud server 100; And
And a security key 300 having a first encryption / decryption module 310, a second encryption / decryption module 330, and a mode switching unit 320 and connected to the user terminal 200,
The security key 300 receives the encrypted authentication ID from the cloud server 100 through the local agent so that the user terminal 200 can receive the cloud service, decrypts the authentication ID, and transmits the encrypted authentication ID to the cloud server 100 And the authentication process of the secondary authentication unit 130 is performed in a series of processes.
The method according to claim 1,
The security key (300)
If the local agent enters the security mode due to an event that the user terminal 200 uploads a security-enabled file to the cloud server 100 or downloads from the cloud server 100 during the use of the cloud service, the user terminal 200 Is switched to the second encryption / decryption module 330 through the mode switching unit 320 which switches from the first encryption / decryption module 310 coupled to the second encryption / decryption module 330 to the second encryption / decryption module 330, And the second encryption / decryption module 330 encrypts and decrypts the set file.
The method according to claim 1,
The security key (300)
If the local agent enters the security mode due to the occurrence of an event for security setting of the file generated by the user terminal 200 during the use of the cloud service by the user terminal 200,
The second encryption / decryption module 330 is switched to the second encryption / decryption module 330 through the mode switching unit 320 for switching from the first encryption / decryption module 310 to the second encryption / decryption module 330,
The second encryption / decryption module 330 encrypts and encrypts the file received from the local agent, assigns a security identifier to the encrypted file, carries out fragmentation of the file to which the security identifier is assigned,
Wherein the security identifier and fragmentation algorithm information are stored, and a security identifier is assigned, and the encrypted fragment file is transmitted to the local agent.
The method of claim 3,
The security key (300)
If the local agent enters the security mode due to the occurrence of an event in which the security terminal is given and the encrypted fragment file is downloaded from the cloud server 100 while the user terminal 200 is using the cloud service,
The second encryption / decryption module 330 is switched to the second encryption / decryption module 330 through the mode switching unit 320 for switching from the first encryption / decryption module 310 to the second encryption / decryption module 330,
The second encryption / decryption module 330 combines and decrypts the scrambled file having the security identifier received from the local agent through the security ID and fragment algorithm information,
To the local agent. &Lt; Desc / Clms Page number 22 &gt;
5. The method according to any one of claims 1 to 4,
The user terminal (200)
Is first authenticated according to the authentication procedure of the first authentication unit 110 of the cloud server 100 and is connected to the cloud server 100,
The second authentication unit 310 decrypts the authentication ID used in the authentication procedure of the second authentication unit 130 of the cloud server 100 by using the first encryption / decryption module 310 of the security key 300, Wherein the endpoint security server management system comprises:

Images