KR102263945B1 - Security program and computing device for providing security function per each user session and method thereof - Google Patents

Abstract

According to embodiments of the present invention, in a computer program stored in a computer-readable storage medium in combination with a computer to perform a security method, the security method includes the steps of: executing a service process in a service session; Executing each of the agent processes in each of the user sessions, and the executed service process interrupts or terminates the execution of each of the agent processes executed in each of the user sessions, or blocks an event from among the agent processes and maintaining the execution of each of the agent processes as a method of re-executing the stopped or terminated at least one agent process even if the at least one execution is stopped or terminated.

Description

A security program providing a security function for each user session, a method of providing a security service, and a computing device {SECURITY PROGRAM AND COMPUTING DEVICE FOR PROVIDING SECURITY FUNCTION PER EACH USER SESSION AND METHOD THEREOF}

Embodiments according to the concepts of the present invention relate to a security program, a method for providing a security service, and a computing device, and more particularly, to a security program for providing a security function for each user session, a method for providing a security service, and a computing device.

With the development of Internet and network-related technologies, anyone can easily share information. Accordingly, there is a problem in that even information that should not be shared is leaked.

In order to prevent the leakage of such information, various security programs that provide a security function are provided. However, since the security program is always operated regardless of whether the operation performed by the electronic device is a security operation, a non-security operation is performed. The user had the hassle of manually disabling the security program.

In addition, when different security functions are desired according to users of the electronic device, since separate security programs must be installed for each user one by one, installation and management are cumbersome.

Korean Patent Publication No. 10-1060277 (2011. 08. 29. Announcement) Korean Patent Publication No. 10-2016-0085140 (published on July 15, 2016)

An object of the present invention is to provide a security program, a method for providing a security service, and a computing device capable of establishing a security environment for each logged-in user account.

The problem to be solved by the present invention is to execute each of a plurality of agent processes in each of user sessions of an operating system, and provide a security program and a security service that can ensure the stability of each of the running agent processes To provide a method and a computing device.

The problem to be solved by the present invention is to provide a security program, a method for providing a security service, and a computing device capable of controlling a process executed in a user session so that data can be read or written only in a secure area of a computing device. have.

According to embodiments of the present invention, in a computer program stored in a computer-readable storage medium in combination with a computer to perform a security method, the security method includes the steps of: executing a service process in a service session; Executing each of the agent processes in each of the user sessions, and blocking the event that the executed service process stops or terminates the execution of each of the agent processes executed in each of the user sessions to each of the agent processes maintaining the execution of
In a computer program stored in a computer-readable storage medium in combination with a computer to perform a security method, the security method includes: executing a service process in a service session; Executing in each, and maintaining the execution of each of the agent processes by re-executing the stopped or terminated agent process even if the executed service process stops or terminates the execution of at least one of the agent processes includes steps.

A security service providing method according to embodiments of the present invention includes the steps of executing a service process in a service session of an operating system running on a computer, and the executed service process performs each of the agent processes in each of the user sessions of the operating system. executing; determining, by the executed service process, whether each of the agent processes is currently being executed in each of the user sessions; and according to a result of the determination, the service process is selected from among the user sessions. identifying a user session in which the agent process is not running, and re-executing the corresponding agent process in the identified non-running user session.
A security service providing method according to embodiments of the present invention includes the steps of executing a service process in a service session of an operating system running on a computer, and the executed service process performs each of the agent processes in each of the user sessions of the operating system. executing, wherein the executed service process obtains a process list related to a process currently running in each of the user sessions, and each of the agent processes is currently executed in each of the user sessions by using the process list determining whether there is, and according to a result of the determination, the service process identifies a user session in which a corresponding agent process is not running from among the user sessions, and the corresponding agent in the identified non-executing user session re-running the process.

In a computing device including a processor, a storage device, and a communication interface according to embodiments of the present invention, the storage device includes a general area and a security area, the general area stores a security program, and the security program includes the In combination with a computing device, the method includes instructions for performing a security method, the method comprising: executing a service process in a service session of an operating system running on the computing device; Executing each of the agent processes in each of the user sessions, and blocking the event that the executed service process stops or terminates the execution of each of the agent processes executed in each of the user sessions to each of the agent processes maintaining the execution of
In a computing device including a processor, a storage device, and a communication interface according to embodiments of the present invention, the storage device includes a general area and a security area, the general area stores a security program, and the security program includes the In combination with a computing device, the method includes instructions for performing a security method, the method comprising: executing a service process in a service session of an operating system running on the computing device; Executing each of the agent processes in each of the user sessions, and the executed service process re-executing the stopped or terminated agent process even if the execution of at least one of the agent processes is stopped or terminated to the agent and maintaining execution of each of the processes.

Since the security program according to the embodiments of the present invention can build a security environment according to the logged-in user account, when the logged-in user account is not a security account, the security functions provided by the security program are not operated separately. It is automatically terminated, which has the effect of reducing resource usage.

The security program according to the embodiments of the present invention executes each of a plurality of agent processes in each of the user sessions, and can ensure the stability of each of the running plurality of agent processes, so that the stability of the security program is improved. has an improving effect.

The security program according to embodiments of the present invention has an effect of blocking reading or writing of data processed in a non-security area other than the secure area of the computing device in which the security program is executed.

1 conceptually illustrates a security system according to embodiments of the present invention.
2 conceptually illustrates sessions of an operating system according to embodiments of the present invention.
3 conceptually illustrates a security program according to embodiments of the present invention.
4 is a flowchart for explaining the operation of a security program according to embodiments of the present invention.
5 is a view for explaining the operation of a security program according to embodiments of the present invention.
6 is a flowchart for explaining the operation of an access control module (or access control process) according to embodiments of the present invention.
7 is a view for explaining the operation of the access control module according to embodiments of the present invention.

Hereinafter, detailed contents for carrying out the present invention will be described with reference to the accompanying drawings.

As used herein, a program or module means computer software including instructions (or program codes) used in an electronic device having a data processing function to obtain a specific result. That is, the processor (or CPU) of the electronic device may execute the program and perform various functions according to instructions included in the program. The program may be stored in a non-transitory medium and distributed through a communication network.

In this specification, a process means a unit of work being executed in an electronic device. For example, when a program is executed, processes corresponding to commands included in the program are generated, and the generated processes are executed in the electronic device.

That is, a program is stored data (or files), and a process is a task created as the program is executed. Accordingly, when one program is executed multiple times, multiple processes may be created.

However, since it is sometimes difficult to distinguish a function of a program from a function of a process corresponding to the program, in the present specification, the program and the process may be used interchangeably, except when a distinction is required.

In this specification, when a program or process executed in a device performs a certain function, it means that the device performs the certain function according to a control or command of the program or the process. That is, a function of a program or process described in this specification may be understood as a function performed by an apparatus in which the program or process is executed.

1 conceptually illustrates a security system according to embodiments of the present invention. Referring to FIG. 1 , the security system 10 may include an electronic device 100 and a management server 500 .

The electronic device 100 may execute the security program 200 and perform a security function provided by the security program 200 according to the execution of the security program 200 . According to embodiments, the electronic device 100 may be a device capable of performing an operation processing function. For example, the electronic device 100 may be a computer or a mobile device, and the mobile device includes a tablet PC, a smartphone, a mobile internet device (MID), and an Internet of Things (IoT). It may be an Internet of Things (IoT)) device, or a wearable computer, but is not limited thereto.

The electronic device 100 may include a processor 110 , a drive (or data storage device) 120 , an input/output interface 130 , and a communication interface 140 .

The processor 110 may control the overall operation of the electronic device 100 . According to embodiments, the processor 110 may perform various operations and may control operations of the components 110 , 120 , 130 and 140 of the electronic device 100 .

The processor 110 may execute a program (eg, the security program 200 ) stored in the data storage device 120 . For example, the processor 110 fetches instructions from a code of a program stored in the data storage device 120 , and controls the operation of the electronic device 100 based on the fetched instructions. can do.

For example, the processor 110 may include a central processing unit (CPU), a graphics processing unit (GPU), an application processor (AP), a communication processor (CP), or general-purpose computing on graphics processing (GPGPU). units), but is not limited thereto.

The data storage device 120 may store data or information necessary for the operation of the electronic device 100 . In some embodiments, the data storage device 120 may be a non-volatile memory device. For example, the data storage device 120 may be a read only memory (ROM), a flash memory, a non volatile RAM (NVRAM), a hard disk drive (HDD), or a solid state drive (SDD), but is not limited thereto. no.

The data storage device 120 may include a non-secure region 121 and a secure region 123 .

The non-security area 121 is a data storage area accessible when logging in with a general account (non-security account), and the security area 123 is a data storage area accessible when logging in with a security account.

The security area 123 may be implemented as a virtual drive image, but is not limited thereto. According to embodiments, data stored in the security area 123 may be encrypted data.

A security program 200 and an operating system (OS) 300 may be stored in the non-security area 121 .

The security program 200 may be software, a computer program, or a set of computer program codes that may be executed by the device 100 . The security program 200 may be written as a computer-readable computer program (or computer program code), stored in a computer-readable recording medium (eg, a data storage device, a memory device, a database, or a processor) and executed. .

The security program 200 may be executed in each of the sessions of the OS 300 and may perform a security function corresponding to each user account logged into each of the sessions. Furthermore, the secure program 200 may be kept running in each of the sessions.

The OS 300 includes the components (() of the electronic device 100 so that a function corresponding to the electronic device 100 or a program (eg, the security program 200) executed by the processor 110 can be performed. 110, 120, 130, and 140) may be a program capable of controlling or managing them.

For example, the OS 300 may be Windows (Windows ^® ), Mac OS (Mac OS ^® ), Linux (Linux ^® ), Unix ^® , Android (Android ^® ) or iOS ^® , but is not limited thereto.

The OS 300 may include at least one of a kernel 310 , middle ware 320 , and an application programming interface (API) 330 .

The kernel 310 may perform a function corresponding to (or implemented by instructions included in the program) of a program (eg, the security program 200 ) executed by the electronic device 100 or the processor 110 . Thus, the operation of each of the components 110 , 120 , 130 , and 140 of the electronic device 100 may be controlled.

According to embodiments, in the kernel 310 , the middleware 320 , the API 330 , or the security program 200 accesses the components 110 , 120 , 130 , and 140 of the electronic device 100 to obtain system resources. Interfaces can be provided to control them.

The middleware 320 may play an intermediary role so that the API 145 or the security program 200 communicates with the kernel 310 to exchange data.

The API 330 may be an interface including commands used to control functions provided by the kernel 310 or the middleware 320 . For example, the API 330 may include at least one interface (or command) for data (or file) control, window control, image processing, or text control. According to embodiments, the security program 200 may use commands included in the API 330 .

The input/output interface 130 transmits commands or data input to the electronic device 100 from an external (eg, a user of the electronic device 100 or a peripheral device 400 ) to the components ( Commands or data transmitted to 110 , 120 , 130 and 140 or transmitted from the components 110 , 120 , 130 and 140 of the electronic device 100 may be output to the outside.

According to embodiments, the input/output interface 130 may transmit input data input through the input device 410 to the components 110 , 120 , 130 and 140 of the electronic device 100 , and the electronic device 100 . ), output data output from the components 110 , 120 , 130 and 140 may be output through the output device 420 .

For example, the input device 410 may be a keyboard, a mouse, a touchpad, or a touch screen, but is not limited thereto. For example, the output device 420 may be a display device, a speaker, or a printer, but is not limited thereto.

Although the input device 410 and the output device 420 are illustrated separately from the electronic device 100 in FIG. 1 , according to embodiments, the input device 410 and the output device 420 are the electronic device 100 . ) may be included.

The communication interface 140 may control data communication between the electronic device 100 and the management server 500 . According to embodiments, the communication interface 140 transmits a user account (ACC) to the management server 500 using a wired or wireless communication network, and a security policy corresponding to the user account (ACC) from the management server 500 . (or policy information; PCY).

For example, the communication interface 140 may send and receive data to and from the management server 500 using a communication network. The communication network may be a computer network, the Internet, or a mobile communication network. The computer network may be a local area network (LAN) or a wide area network (WAN), and the mobile communication network is a ^{long-term evolution (LTE TM} ), LTE Advance (LTE-A), or code division multiple access (CDMA) network. , WCDMA (wideband CDMA), UMTS (universal mobile telecommunications system), WiBro (Wireless Broadband), or GSM (Global System for Mobile Communications), but embodiments of the present invention are not limited to the type of communication network.

According to embodiments, the processor 110 , the storage device 120 , the input/output interface 130 , and the communication interface 140 may be connected to each other through a connection circuit (eg, a bus) to exchange data.

The management server 500 may exchange data with the electronic device 100 through a communication network. According to embodiments, the management server 500 may further include an accessible database (or data storage device), and the management server 500 accesses the database to read or write data. can

2 conceptually illustrates sessions of an operating system according to embodiments of the present invention. 1 and 2 , the OS 300 may create sessions (SS and CS1 to CSn; n is a natural number equal to or greater than 3) and manage the sessions (SS and CS1 to CSn).

Each session (SS and CS1 to CSn) is a user environment created (or activated) by the OS 300, and a process may be executed on (on) each session (SS and CS1 to CSn). According to embodiments, each session SS and CS1 to CSn may be created when the OS 300 is executed.

The sessions SS and CS1 to CSn may include one service session SS and a plurality of user sessions CS1 to CSn.

The service session SS is automatically created when the OS 300 is executed as the electronic device 100 is booted, and is destroyed (or removed) when the OS 300 is terminated.

The service session SS has the strongest (or highest) authority among the sessions SS and CS1 to CSn that can be created by the OS 300 . According to embodiments, the service session SS may execute a process on the user sessions CS1 to CSn, and monitor, stop, terminate, or terminate a process running on the user sessions CS1 to CSn. can be changed According to embodiments, the process executed on the service session SS is not stopped, terminated, or changed by the process executed on the user sessions CS1 to CSn.

Each user session (CS1 to CSn) is created as each user account (ACC1 to ACCn; collectively, ACC) is logged into the OS 300, and each logged in user account (ACC1 to ACCn) is logged off ) can be destroyed when According to embodiments, the first user session CS1 is created when the first user account ACC1 logs in to the OS 300 and is destroyed when the logged-in first user account ACC1 is logged off. can

FIG. 2 exemplarily illustrates that the first user account ACC1 is a security account SCACC, but is not limited thereto. The number of security accounts (SCACC) may be plural.

3 conceptually illustrates a security program according to embodiments of the present invention. 1 to 3 , the security program 200 may include a service module 210 , an agent module 220 , and a plurality of security modules 230-1 to 230-6.

Although, in the present specification, the security program 200 is divided into a service module 210, an agent module 220, and a plurality of security modules 230-1 to 230-6, but the security program 200 is integrated may be a single program, software, or program code.

The service module 210 may execute the agent module 220 . According to embodiments, the service module 210 may execute the agent module 220 on each user session CS1 to CSn.

The service module 210 may execute the agent module 220 and maintain the execution of the executed agent module 220 . This will be described in detail later.

The agent module 220 may control the execution (or enable) of each of the plurality of security modules 230-1 to 230-6. According to embodiments, the agent module 220 may control whether each of the plurality of security modules (230-1 ~ 230-6) is executed.

According to embodiments, the agent module 220, based on the security policy (PCY) transmitted from the management server 500, executes at least one of the plurality of security modules (230-1 ~ 230-6) (or can be activated).

Each of the plurality of security modules 230 - 1 to 230 - 6 may provide a security function for the electronic device 100 . Although only six security modules 230 - 1 to 230 - 6 are described in FIG. 3 , these are exemplary, and embodiments of the present invention are not limited to the number of security modules.

The access control module 230-1 determines whether an event generated (or to be processed) in the user sessions CS1 to CSn accesses the security area 123 , and when the event accesses the security area 123 , Only the event can be controlled so that the event is processed.

The virtual drive module 230 - 2 may create a virtual drive image. According to embodiments, the virtual drive module 230 - 2 may receive size (or amount of data) information and may generate a virtual drive image corresponding to the input size information. The OS 200 may mount the created virtual drive image and allocate (or create) a virtual drive corresponding to the virtual drive image. In some embodiments, the virtual drive may be included in the security area 123 .

The watermark generating module 230 - 3 may generate watermark data and output the generated watermark data. The OS 300 may display the watermark data through an output device of the electronic device 100 .

The screen capture prevention module 230 - 4 may block leakage (or capture) of screens corresponding to user sessions CS1 to CSn. According to embodiments, the screen capture prevention module 230 - 4 blocks the storage (or capture) of screen data corresponding to the screen of each user session CS1 to CSn, and blocks the screen data from being transmitted to the outside. can

The screen capture prevention module 230 - 4 may block, stop, or terminate the execution of a screen leak (or capture) program having a screen leak (or capture) function. For example, the screen leaking program may mean a screen capture program, a remote control program, and a streaming program, but is not limited thereto.

According to embodiments, the screen capture prevention module 230 - 4 monitors each process (or program) running on each user session CS1 to CSn, and according to the monitor result, whether the executed process is a screen leak program or not can be judged

According to embodiments, the screen capture prevention module 230 - 4 analyzes a pattern of an executed process, and determines whether the executed process is a screen leak program, or refers to a list of screen leak programs according to the analysis result. It may be determined whether the executed process is a screen leaking program or not.

The screen capture prevention module 230 - 4 may block use of a clipboard (eg, use of a clipboard through a print screen key).

The harmful site blocking module 230 - 5 may block the electronic device 100 from accessing the harmful site. According to embodiments, the harmful site blocking module 230 - 5 may block access to the website when the website to be accessed by the electronic device 100 is a harmful website.

The process execution control module 230-6 determines whether each process executed in each user session CS1 to CSn is an allowed process or not, and blocks execution of the process when the process is not the allowed process, You can stop or quit.

4 is a flowchart for explaining the operation of the security program according to the embodiments of the present invention, and FIG. 5 is a diagram for explaining the operation of the security program according to the embodiments of the present invention.

1 to 5 , the processor 110 may execute the service module 210 in a service session SS (on) (S1010). According to embodiments, the processor 110 stores the service module 210 in a memory accessible by the processor 110 from the data storage device 120 (the memory may exist inside or outside the processor 110 ). It may load, generate a service process (SVP) corresponding to the service module 210 , and execute the generated service process (SVP) in the service session (SS).

The executed service process SVP may execute each agent process AGP1 to AGPn on each user session CS1 to CSn (S1020). According to embodiments, the processor 110 loads the agent module 220 from the data storage device 120 to the memory, creates the agent processes (AGP1 ~ AGPn) corresponding to the agent module 220, and the generated Each of the agent processes AGP1 to AGPn may be executed in each of the corresponding user sessions CS1 to CSn. For example, the first agent process AGP1 is executed on the first user session CS1.

Since the agent processes AGP1 to AGPn are generated from one agent module 220, the functions of each of the agent processes AGP1 to AGPn may be the same.

The service process SVP may maintain execution of each agent process AGP1 to AGPn executed in each user session CS1 to CSn ( S1030 ). According to embodiments, the service process (SVP) blocks an event to stop or terminate the execution of each of the agent processes (AGP1 to AGPn) executed in each of the user sessions (CS1 to CSn), or the agent processes (AGP1 to) Even if the execution of at least one of the AGPn) is stopped (or terminated), the execution of each of the agent processes AGP1 to AGPn may be maintained by re-executing the stopped (or terminated) at least one agent process.

According to embodiments, the service process SVP may determine whether each of the plurality of agent processes AGP1 to AGPn is currently running in each of the user sessions CS1 to CSn. For example, the service process (SVP) obtains a process list related to a process currently running in each of the user sessions (CS1 to CSn), and uses (or refers to) the process list to process a plurality of agent processes (AGP1 to AGPn) It may be determined whether each of the user sessions CS1 to CSn is currently being executed.

According to embodiments, the service process (SVP) periodically (periodically) or in real time (on-the-fly or real time) a plurality of agent processes (AGP1 ~ AGPn) each of the user sessions (CS1 ~ CSn) You can determine whether it is currently running in .

According to the result of the determination, the service process (SVP) may identify a user session in which the corresponding agent process is not running from among the user sessions CS1 to CSn, and execute the corresponding agent process again on the identified user session. have. For example, when the second agent process AGP2 is not running on the second user session CS2, the service process SVP may run the second agent process AGP2 again on the second user session CS2. .

Accordingly, since the service process SVP can ensure the stability of the execution of each of the plurality of agent processes AGP1 to AGPn running in each of the user sessions CS1 to CSn, the security program according to the embodiments of the present invention There is an effect that the stability of (200) is improved.

Each of the agent processes (AGP1 ~ AGPn), each of the user accounts (ACC1 ~ ACCn) logged in to each of the user accounts (CS1 ~ CSn) in which the agent processes (AGP1 ~ AGPn) run, each of the security account (SCACC) Recognition may be determined (S1040). For example, the first agent process AGP1 may determine whether the first user account ACC1 logged into the first user account ACC1 is a security account SCACC.

According to embodiments, each of the agent processes AGP1 to AGPn refers to a configuration file of the security program 200 and determines whether each of the user accounts ACC1 to ACCn is a security account SCACC. can judge

Each of the agent processes (AGP1 to AGPn), when each of the user accounts (ACC1 to ACCn) is a security account (SCACC) (YES in S1040), each of the user accounts (ACC1 to ACCn) through a communication network to the management server It can be transmitted to (500) (S1050). For example, the first agent process AGP1 may transmit the first user account ACC1 to the management server 500 through the communication network.

Each of the agent processes (AGP1 to AGPn) receives each of the security policies (PCY1 to PCYn; collectively PCY) corresponding to each of the user accounts (ACC1 to ACCn) from the management server 500 through the communication network. It can be (S1060). For example, the first agent process AGP1 may receive the first security policy PCY1 corresponding to the first user account ACC1 from the management server 500 through the communication network.

The security policies PCY1 to PCYn may be stored in the management server 500 in the form of a lookup table. Each of the security policies PCY1 to PCYn may indicate which security process is to be executed or not.

Each of the agent processes AGP1 to AGPn may execute each of the security processes SCP1 to SCPn based on each of the security policies PCY1 to PCYn ( S1070 ).

Each of the security processes SCP1 to SCPn may be at least one process executed as at least one of the security modules 230-1 to 230-6 shown in FIG. 3 is executed. Although each of the security processes SCP1 to SCPn is illustrated as one process in FIG. 5 , each of the security processes SCP1 to SCPn may be a set of a plurality of processes according to embodiments.

For example, the first agent process AGP1 may execute the first security process SCP1 based on the first security policy PCY1 .

According to embodiments, the processor 110 loads at least one of the plurality of security modules 230-1 to 230-6 from the data storage device 120 into the memory based on the first security policy PCY1, and , may generate at least one first security process SCP1 corresponding to the at least one security module, and execute the generated first security process SCP1 on the first user session CS1. Since the processor 110 may perform the same or similar operation to the above-described operation for each of the remaining user sessions CS2 to CSn, a description of each of the remaining user sessions CS2 to CSn will be omitted.

Each of the agent processes AGP1 to AGPn stops or terminates the execution of each of the security processes SCP1 to SCPn when each of the user accounts ACC1 to ACCn is not the security account SCACC (NO in S1040) You can (S1080). For example, the first agent process AGP1 may stop or terminate the execution of the first security process SCP1 currently running in the first user session CS1 .

When the first user account ACC1 is not the security account SCACC, the processor 110 stops, terminates, or can be deactivated.

Accordingly, since the security program 200 (or the electronic device 100 executing the security program 200 ) can build a security environment according to each logged-in user account ACC1 to ACCn, the user accounts ACC1 to ACCn ), there is no need to install any security programs.

In addition, since the security program 200 may automatically deactivate the security functions provided by the security program 200 when it is a non-security account, the user using the non-security account can perform performance due to the activation of the security function. You may not feel any deterioration. That is, resource usage may be reduced.

6 is a flowchart for explaining the operation of an access control module (or an access control process) according to embodiments of the present invention. 7 is a view for explaining the operation of the access control module according to embodiments of the present invention.

For convenience of explanation, it is assumed that the first user account ACC logged into the first user session CS1 of FIGS. 6 and 7 is a security account SCACC, and only the operation on the first user session CS1 will be described. do.

1 to 7 , the access control process ACP may be executed on the first user session CS1 ( S2010 ). According to embodiments, the first agent process (AGP1) performs the access control process (ACP) on the first user session (CS1) based on the first security policy (PCY) instructing the execution of the access control process (ACP). can be run on

For example, the processor 110 loads the access control module 230-1 from the data storage device 120 into a memory accessible by the processor 110 based on the first security policy PCY1, and controls access An access control process ACP corresponding to the module 230-1 may be generated, and the generated access control process ACP may be executed on the first user session CS1.

The executed access control process (SCP) may monitor the process (P) executed on the first user session (CS1) (S2020). According to embodiments, the access control process SCP may monitor at least one event EVENT1 to EVENT3 generated by the process P executed on the first user session CS1.

According to embodiments, as shown in FIG. 7 , the access control process ACP executed on the first user session CS1 is injected into the process P, and when the process P is executed, the process It can be executed with (P). The access control process (ACP) injected into the process (P) may search the memory area allocated to the process (P).

According to embodiments, the security program 200 may further include an injector for inserting (or injecting) the access control process (ACP) into the process (P). For example, the inserter may detect whether or not a new process is executed on the first user session CS1, and when the new process is executed, the newly executed process may automatically load the access control module 230-1. .

According to the result of the monitor, the access control process (SCP) determines whether at least one event (EVENT1 to EVENT3) generated in the process (P) executed on the first user session (CS1) is processed on the security area (123) It can be done (S2030).

According to example embodiments, each event EVENT1 to EVENT3 may be a command instructing to read or write data. According to embodiments, in the access control process (SCP), the drive path included in one or more events (EVENT1 to EVENT3) generated in the process (P) executed on the first user session (CS1) is secure. It may be determined whether the region 123 is indicated.

The access control process SCP controls whether one or more events EVENT1 to EVENT3 generated in the process P executed on the first user session CS1 are processed according to the result of the determination S2030 can do.

According to embodiments, when each event (EVENT1 to EVENT3) is not processed on the security area 123 (NO in S2030), the access control process (SCP) processes (or proceeds) each event (EVENT1 to EVENT3) It can be stopped (S2040). For example, the first event EVENT1 shown in FIG. 7 is processed in the non-secure area 121 (eg, drive C), and the second event EVENT2 is processed in the non-secure area 121 (eg, drive D). Therefore, the access control process SCP may stop processing the first event EVENT1 and the second event EVENT2.

According to embodiments, when each event EVENT1 to EVENT3 is processed on the security area 123 (YES in S2030), the access control process SCP interrupts the processing (or progress) of each event EVENT1 to EVENT3. may not That is, in this case (YES in S2030), the access control process (SCP) may not perform any operation for each event (EVENT1 ~ EVENT3).

For example, since the third event EVENT3 shown in FIG. 7 is processed on the security area 123 (eg, H drive), the access control process SCP may not perform any action on the third event EVENT3. have.

Therefore, the access control process (SCP) executed on the first user session (CS1; security account) can block the reading or writing of data processed in the non-secure area 121 rather than the secure area 123 , so the security Since the user logged in through the account SCACC can read or write data only in the security area 123 , the security of the electronic device 100 is enhanced.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those of ordinary skill in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Accordingly, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

100; electronic device
110: processor
120: drive or data storage device
121: non-security zone
123: security zone
130: input/output interface
140: communication interface
200: security program
210: service module
220: agent module
300: Operating System (OS)
310: kernel
320: middleware
330: API
410: input device
420: output device
500: management server
SS: service section
SVP: Service Process
CS1-CSn: User sessions
AGP1~AGPn: agent processes

Claims (13)

A computer program stored in a computer-readable storage medium for performing a security method in combination with a computer, the computer program comprising:
The security method is
running the service process in the service session;
executing, by the executed service process, each of the agent processes in each of user sessions; and
In a computer-readable storage medium comprising the step of maintaining the execution of each of the agent processes by blocking an event that the service process executed stops or terminates the execution of each of the agent processes executed in each of the user sessions stored computer programs. A computer program stored in a computer-readable storage medium for performing a security method in combination with a computer, the computer program comprising:
The security method is
running the service process in the service session;
executing, by the executed service process, each of the agent processes in each of user sessions; and
Computer-readable comprising the step of re-executing the stopped or terminated agent process to maintain execution of each of the agent processes even if the executed service process stops or terminates the execution of at least one of the agent processes A computer program stored on a storage medium. A computer program stored in a computer-readable storage medium for performing a security method in combination with a computer, the computer program comprising:
The security method is
running the service process in the service session;
executing, by the executed service process, each of the agent processes in each of user sessions;
determining, by the executed service process, whether each of the agent processes is currently running in each of the user sessions; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process in the identified non-executing user session; A computer program stored on a computer-readable storage medium comprising a computer program. A computer program stored in a computer-readable storage medium for performing a security method in combination with a computer, the computer program comprising:
The security method is
running the service process in the service session;
executing, by the executed service process, each of the agent processes in each of user sessions;
obtaining, by the service process, a list of processes currently running in each of the user sessions, and determining whether each of the agent processes is currently running in each of the user sessions using the process list ; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process in the identified non-executing user session; A computer program stored on a computer-readable storage medium comprising a computer program. executing a service process in a service session of an operating system running on the computer;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system; and
and maintaining the execution of each of the agent processes by blocking an event in which the executed service process stops or terminates the execution of each of the agent processes executed in each of the user sessions. executing a service process in a service session of an operating system running on the computer;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system; and
and maintaining the execution of each of the agent processes by re-executing the stopped or terminated agent process even if the executed service process stops or terminates the execution of at least one of the agent processes. Way. executing a service process in a service session of an operating system running on the computer;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system;
determining, by the executed service process, whether each of the agent processes is currently running in each of the user sessions; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process in the identified non-executing user session; How to provide security services, including. executing a service process in a service session of an operating system running on the computer;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system;
obtaining, by the service process, a list of processes currently running in each of the user sessions, and determining whether each of the agent processes is currently running in each of the user sessions using the process list ; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process in the identified non-executing user session; How to provide security services, including. A computing device comprising a processor, a storage device, and a communication interface, the computing device comprising:
The storage device includes a general area and a security area,
The general area stores a security program,
The security program includes instructions for performing a security method in combination with the computing device,
The security method is
executing a service process in a service session of an operating system running on the computing device;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system; and
and maintaining the execution of each of the agent processes by blocking an event in which the executed service process stops or terminates the execution of each of the agent processes executed in each of the user sessions. A computing device comprising a processor, a storage device, and a communication interface, the computing device comprising:
The storage device includes a general area and a security area,
The general area stores a security program,
The security program includes instructions for performing a security method in combination with the computing device,
The security method is
executing a service process in a service session of an operating system running on the computing device;
executing, by the executed service process, each of the agent processes in each of the user sessions of the operating system; and
Computing device comprising the step of maintaining the execution of each of the agent processes by re-executing the stopped or terminated agent process even if the executed service process stops or terminates the execution of at least one of the agent processes. A computing device comprising a processor, a storage device, and a communication interface, the computing device comprising:
The storage device includes a general area and a security area,
The general area stores a security program,
The security program includes instructions for performing a security method in combination with the computing device,
The security method is
executing a service process in a service session of an operating system running on the computing device;
the service process executing each of the agent processes in each of the user sessions of the operating system;
determining, by the executed service process, whether each of the agent processes is currently running in each of the user sessions; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process on the identified non-executing user session computing device. A computing device comprising a processor, a storage device, and a communication interface, the computing device comprising:
The storage device includes a general area and a security area,
The general area stores a security program,
The security program includes instructions for performing a security method in combination with the computing device,
The security method is
executing a service process in a service session of an operating system running on the computing device;
the service process executing each of the agent processes in each of the user sessions of the operating system;
obtaining, by the service process, a list of processes currently running in each of the user sessions, and determining whether each of the agent processes is currently running in each of the user sessions using the process list ; and
according to the result of the determination, the service process identifying a user session in which the corresponding agent process is not running among the user sessions, and re-executing the corresponding agent process on the identified non-executing user session computing device. The method of any one of claims 9, 10, 11, or 12, wherein the security method comprises:
Each of the agent processes, the computing device further comprising the step of determining whether each of the user accounts logged into each of the user accounts in which each of the agent processes are executed is a security account.

Images