KR102483980B1 - Security management system for recording and tracking face image information of security policy violator - Google Patents

Abstract

The present invention relates to a security management system for recording, tracking, and managing facial information of a security policy violating actor and a method thereof. The security management system comprises: a security access agent installed in a terminal; and a security proxy server having a user information storage module, a security policy storage module, a relay module, a security processing module, a violator information storage module, and a violator identification module. Therefore, the security management system has an effect of increasing security by providing strict control on internally authorized command blocking authority of a user.

Description

Security management system and method for recording, tracking and managing facial information of security policy violating actors

The present invention relates to a security management system and method for recording, tracking, and managing facial information of security policy violating actors.

Conventionally, it was uncertain to secure the identity of a user who accesses a security target server or executes a command unless an administrator directly observes a network communication situation between a terminal and a security target server. In addition, even if the administrator checks the communication situation one by one, the conventional security system only checks the account, access IP, access to the access server, and authority control. In order to supplement this, additional authentication means (secondary authentication, OTP, payment) are used together in addition to the user account, but there was a limit that it was virtually impossible to identify the actual user if the additional authentication means were stolen.

In order to solve this problem, the security management system was strengthened to analyze the behavior patterns of normal users through behavior pattern tracking and identify users who behave differently than usual. There was a limit that control could not be achieved.

In order to solve this problem, a biometric technology has been developed to check the authority of a user who has attempted access and execution for server access and command execution. As is well known, biometric technology is a technology that extracts physical and behavioral characteristics of a person (user) to confirm whether or not the person is a person, and is already widely used in security technology. Biometric targets include fingerprint recognition, iris-scan, retina-scan, hand geometry, and facial recognition. The face, which can automatically recognize the user's biometrics and proceed with the procedure without any action, was used as a target for biometrics.

However, in the conventional biometric technology for server access and command execution, security procedures are performed only at the time of initial access, so when a user is authenticated, another user without authority later manipulates a terminal connected to the security target server without permission, Unusual commands could be entered into the server. In addition, when a terminal is infected with malicious code, other users can remotely control the terminal online and input abnormal commands to the security target server.

As a result, it is urgently required to secure the identity of a user who accesses a security target server or executes a command, and to improve biometric technology with improved security.

Prior art literature 1. Patent Publication No. 10-2021-0004319 (published on January 13, 2021)

Accordingly, the present invention is intended to solve the above problems, by accurately identifying and recording server users, enabling follow-up control of unauthorized users, tracking of real users, and even if an authorized user accesses the server, unauthorized users It is a task to solve the problem of providing a security management system and method that records, traces, and manages the facial information of security policy violators who can block server access-related operations by continuously checking whether or not they are used.

In order to achieve the above object, the present invention,

In a security management system equipped with a security proxy server for relaying data communication between a terminal and a security target server and for security management of server users' actions,

A face recognition module that repeatedly collects and transmits facial information of a user who has been authorized to access the security target server and is connected at a designated time or in a designated situation, and a user's command confirmed through analysis of work traffic information with the security target server A security access agent installed in the terminal having a use state detection module for transmitting a signal so that the face recognition module collects the user's face information when it is confirmed that the command is an unauthorized command based on the user's security policy; and

A user information storage module for storing user information including user face information, a security policy storage module for storing security policies for each user, and a relay module for relaying data communication between the secure access agent and the security target server; The face image of the face information received from the face recognition module is compared with the face image of the user information to determine whether they match, and according to the security policy corresponding to the user information, access to the security target server is blocked, or only designated data communication is controlled or authorized. A security processing module that controls the relay module so that the execution of other commands is restricted, and if the security processing module blocks access to the security target server, controls specified data communication, or restricts the execution of commands other than the authority, the face recognition module receives A security proxy server equipped with a violator information storage module that stores the face information as violator information and a violator identification module that retrieves and confirms violator information matching the face information received from the face recognition module from the violator information storage module;

It is a security management system that records, traces, and manages the facial information of security policy violating actors.

Another present invention in order to achieve the above object,

In a security management system equipped with a security proxy server for relaying data communication between a terminal and a security target server and for security management of server users' actions,

A face recognition module that repeatedly collects and transmits facial information of a user who has been authorized to access the security target server and is connected at a designated time or in a designated situation, and uses state detection that checks and transmits work traffic information with the security target server a secure access agent equipped with a module and installed in the terminal; and

A user information storage module for storing user information including user face information, a security policy storage module for storing security policies for each user, and a relay module for relaying data communication between the secure access agent and the security target server; If the command confirmed by analyzing the work traffic information is determined to be an unauthorized command based on the user's security policy, the face recognition module transmits a signal to collect the user's face information, and the face image of the face information received from the face recognition module It compares the user information with the facial image of the user information to check whether it matches, and blocks access to the security target server according to the security policy corresponding to the user information, controls only designated data communication, or controls the relay module to restrict the execution of commands other than privileges. and violator information that stores the face information received from the face recognition module as violator information when the security processing module blocks access to the security target server, controls designated data communication, or restricts execution of commands other than authority. a security proxy server equipped with a storage module and a violator identification module that searches and confirms violator information matching the face information received from the face recognition module from the violator information storage module;

It is a security management system that records, traces, and manages the facial information of security policy violating actors.

Since the present invention described above records the image information of an unauthorized user who has stolen an authorized user's account and tracks the unauthorized user, it is possible to quickly take follow-up measures by recognizing unauthorized access by an unauthorized user, Even if the user is changed while the authorized user is working on the server, the changed user's security policy can be immediately retrieved and access to the working server can be blocked while the policy manager is notified. Even authorized users with legitimate access rights to the server can execute commands In case of violation, the user is recorded and managed in the audit log, so even for users who appear to be internally authorized users, strict control over command blocking authority is provided, which has the effect of improving security.

1 is a diagram schematically showing a communication system of a security management system according to the present invention;
2 is a block diagram showing the configuration of a security management system according to the present invention;
3 is an image showing an example of an input window in which a security target server is set in the security management system according to the present invention;
4 is an image showing an example of an input window in which a security policy of a user authorized to access a security target server is set in the security management system according to the present invention;
5 is an image showing an example of a list of log data related to security history executed by the security management system according to the present invention;
6 is an image showing an embodiment in which the security management system according to the present invention can check image information of a user who has committed a violation along with log data;
7 is an image showing an example of an input window and a message window in which a notification mode of violator information is set in the security management system according to the present invention;
8 is a flowchart sequentially showing a security management method based on a security management system according to the present invention;
9 is an image showing an example of an authorized user's work in the security management system according to the present invention;
10 is an image showing an example of an unauthorized user's work in the security management system according to the present invention;
11 is an image showing an example of an act violator's work in the security management system according to the present invention.

The terms used in the embodiments have been selected from general terms that are currently widely used as much as possible while considering the functions in the present invention, but they may vary according to the intention of a person skilled in the art or precedent, the emergence of new technologies, and the like. In addition, in a specific case, there is also a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the invention. Therefore, the term used in the present invention should be defined based on the meaning of the term and the overall content of the present invention, not simply the name of the term.

In the entire specification, when a part is said to "include" a certain component, it means that it may further include other components, not excluding other components unless otherwise stated. In addition, as described in the specification, "... wealth", "… A term such as “module” refers to a unit that processes at least one function or operation, and may be implemented as hardware or software or a combination of hardware and software.

Hereinafter, with reference to the accompanying drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily carry out the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein.

Hereinafter, the present invention will be described in detail based on the accompanying drawings.

1 is a diagram schematically showing a communication system of a security management system according to the present invention, FIG. 2 is a block diagram showing the configuration of a security management system according to the present invention, and FIG. 3 is a security management system according to the present invention. 4 is an image showing an example of an input window in which a security target server is set, and FIG. 4 is an image showing an example of an input window in which a security policy of a user authorized to access a security target server is set in the security management system according to the present invention. 5 is an image showing an embodiment of a list of log data related to security history executed by the security management system according to the present invention, and FIG. It is an image showing an embodiment in which image information (facial image) can be checked together with log data, and FIG. 7 shows an example of an input window and a message window in which a notification mode of violator information is set in the security management system according to the present invention. It is an image.

1 to 7, the security management system according to the present invention relates to a security process performed in a communication system in which a terminal (C) accesses a security target server (S) through a security proxy server (200).

To explain this in more detail, the present invention relays data communication between a terminal (C) and a security target server (S), and in a security management system equipped with a security proxy server (200) for security management of the server user's behavior. , The face recognition module 110 that repeatedly collects and transmits the facial information of the user who is authorized to access the security target server (S) and is connected at a specified time or in a specified situation, and the security target server (S) Work traffic information analysis When the user's command confirmed through is confirmed to be an unauthorized command based on the user's security policy, the facial recognition module 110 has a use state detection module 130 that transmits a signal to collect the user's facial information, and the terminal (C) a secure access agent 100 installed in; A user information storage module 210 for storing user information including user facial information, a security policy storage module 220 for storing security policies for each user, a secure access agent 100 and a security target server (S) The relay module 240 for relaying data communication and the face image of the face information received from the face recognition module 110 are compared with the face image of the user information to determine whether they match, and according to the security policy corresponding to the user information. A security processing module 250 that controls the relay module 240 to block access to the security target server, control only designated data communication, or restrict execution of non-authorized commands, and the security processing module 250 to the security target server ( S) and the violator information storage module 230 that stores the face information received from the face recognition module 110 as violator information when access to the face recognition module 110 is blocked or specified data communication is controlled, and the face information received from the face recognition module 110 A security proxy server 200 equipped with a violator confirmation module 270 for searching and confirming violator information matching the violator information storage module 230;

Unlike this, in the security management system according to the present invention, the usage state detection module 130 confirms and transmits work traffic information with the security target server (S), and the security processing module 250 analyzes and confirms the work traffic information. If it is confirmed that is a non-authorized command based on the user's security policy, the face recognition module 110 transmits a signal to collect the user's facial information and sends a facial image of the facial information received from the face recognition module 110 to the user The relay module (240) compares the information with the facial image and checks whether it matches, and blocks access to the security target server (S) according to the security policy corresponding to the user information, controls only designated data communication, or restricts the execution of non-authorized commands. ) to control.

As a result, the use state detection module 130 of the secure access agent 100 analyzes the work traffic information for data communication between the OS (Operating System) of the terminal C where the secure access agent 100 is installed and the security target server S. ) may be executed, or the security processing module 250 of the security proxy server 200 may execute.

On the other hand, the use state detection module 130 is authorized to access the security target server S and detects a change in the state of the user being accessed, and transmits a signal so that the face recognition module 110 collects the user's facial information.

For reference, the face image performs a function of vectorizing the user's unique face shape and converting it into a unique code using a known face recognition algorithm along with a photographed image of the user's face as it is. The unique code is face vector information, stored in the security environment of the terminal (C), and transmitted to the secure proxy server 200 as a component of face information.

Each configuration is explained.

The secure access agent 100 according to the present invention is an application installed in the user's terminal (C) to execute security functions, and interworks with the terminal (C)'s OS (Operating System) for self-execution and access to an external communication network. do.

The face recognition module 110 configured in the secure access agent 100 collects a face image of the current user using a photographing means such as a camera installed in the terminal C. Facial image collection by the facial recognition module 110 is performed at the time of login operation for accessing the secure access agent 100 or the security target server S, as well as repeatedly collected at designated time points or repeatedly collected at designated situations. do. When a photographed image of a user's face and a facial image in which a unique code is set are collected, the facial recognition module 110 attaches the user's identification ID (Identity) to the facial image, sets it as facial information, and sets the specified IP through the OS ( Internet Protocol). Here, the designated IP is the IP of the secure proxy server 200.

The security management system according to the present invention collects the facial image matching the identification ID at least once through the facial information registration module 140 of the secure access agent 100, and the user information storage module 210 of the secure proxy server 200. ) to be registered and managed. This is an operation necessary to build together user information mapped with facial information in the user or the secure proxy server 200 . In this embodiment, the face information is composed of a photographed image, a unique code, and an identification ID, but other than that, the face information may consist of only a unique code and an identification ID.

The notification module 120 outputs the data communication status between the OS (Operating System) of the terminal C and the security target server S. Here, the data communication situation refers to whether the secure connection agent 100 is connected to the security target server S, and a method for guiding whether or not the connection is provided may vary. For example, if the access of the secure access agent 100 to the secure server S is blocked, the notification module 120 simply displays only a warning window regarding data communication restriction in the form of a speech bubble according to the set process. The screen of the terminal (C) can be forcibly terminated (locked), the work window (web page) of the web browser for the security target server (S) is forcibly terminated, or the security target server (S) receives the You can also forcibly close the work window of a word processor, which is an application that runs data files. In addition, the work window of the web browser or application may be maintained without termination, but movement of a mouse cursor, text input, or other function operations in the work window may be restricted. In addition, the notification module 120 may display a separate independent pop-up window after controlling the above-described task window to guide the user to a subsequent procedure for self-verification. For reference, the security processing module 250 transmits a notification signal when blocking access to the security target server (S) or controlling only designated data communication, and the notification module 120 responds to the face information recollection according to the notification signal. Outputs information about the information. The user re-performs face photographing according to the guidance of the guide data, and newly creates his/her own face information.

In one embodiment of the usage state detection module 130, when the user's command confirmed through the analysis of work traffic information with the security target server (S) is confirmed to be an unauthorized command based on the user's security policy, the face recognition module ( 110) transmits a signal to the face recognition module 110 to collect the user's face information. Unlike this, in another embodiment of the usage state detection module 130, work traffic information with the security target server (S) is checked and transmitted without analysis. In other words, the usage state detection module 130 directly analyzes the work traffic information to check the command and checks whether or not the command is not authorized based on the security policy, or the usage state detection module checks the work traffic information and detects the command. Work traffic information may be transmitted to the security processing module 250 . On the other hand, in the case of another embodiment, the security processing module 250 transmits a signal to the face recognition module 110 to directly collect the user's face information.

The face recognition module 110 repeatedly collects user's facial information at a designated time point or in a designated situation. Here, the designated time point is a certain time interval or a specific time specified by an administrator or a user. In addition, the designated situation relates to a change in the user's state, and may vary, such as a change in the user's posture, the user leaving the shooting range of the photographing means, checking the facial images of two or more people within the shooting range, and changing the image of the user's clothes or accessories. there is.

In addition, the use state detection module 130 detects the case where the access to the security target server S is authorized and the input command is a non-authorized command while being connected, so that the face recognition module 110 detects the user's facial information. You can pass a signal to collect.

As is known, since an OS-based terminal generates task traffic (session information) during execution, the command is confirmed by analyzing task traffic information. Therefore, the use state detection module 130 or the security processing module 250 analyzes the work traffic information generated during the work related to the security target server (S) to confirm the command, and the security policy stored in the security policy storage module 220. By comparing with , it can be determined whether or not the command is not authorized.

In this embodiment, the non-authorized command is a specific command other than the user's business, that is, an access command to an area inaccessible to the user in the security target server (S), an Internet authentication information check and copy command, a personal information leakage command, These include commands to install unauthenticated applications and commands to run online banking other than user tasks. In addition, the specific command may be related to a forbidden word, a command subject to intensive monitoring, a command subject to payment, and the like. In addition, commands other than authority may be various, and various modifications may be implemented within the limit that does not deviate from the scope of the following rights. As described above, although the use state detection module 130 may directly execute the task traffic information analysis for command confirmation, when the face recognition module 110 transmits the face information, the task traffic information is sent to the security proxy server 200 without the analysis. ) can also be sent together.

Since the security proxy server 200 is a gateway for accessing the security target server S, the terminal C attempting to access the security target server S needs to perform data communication with the security proxy server 200. In addition, since the user's facial recognition analysis and authentication process is performed in the security proxy server 200, not in the terminal C itself, security performance through facial recognition can be remarkably increased. Furthermore, since the security proxy server 200 is security for the security target server (S), the terminal (C) blocks only the communication process with the security target server (S) or reads the data file received from the security target server (S). It only blocks the execution of a specific application that is running, and does not participate in the control of Internet access and application operation unrelated to the security target server (S). Therefore, the web page of the server irrelevant to the security target server S and the task window of the application keep running without the control of the security proxy server 100 .

A description of this is given in more detail below.

The security proxy server 200 includes a user information storage module 210, a security policy storage module 220, a violator information storage module 230, a relay module 240, a security processing module 250, and a violator confirmation module 270. and a notification module 280. In addition, an audit log storage module 260 for recording the execution history of the security processing module 250 may be further included.

The user information storage module 210 stores user information including user's facial information. In addition, the user information includes the user's personal information and identification ID. Therefore, information about the login procedure for verifying whether or not the user is the user is retrieved from the user information storage module 210 . When a user registers in the secure proxy server 200 regardless of whether access to the security target server (S) is permitted, the user information of the corresponding user can be stored in the user information storage module 210, and the security target server Only the user information of the user authorized to access (S) may be stored in the user information storage module 210 . In the present embodiment, the user information storage module 210 stores only the user information of the user for which access is authorized, but is not limited to the present embodiment within the scope of the following rights.

The security policy storage module 220 stores security policies for each user. The security policy relates to the access range authorized to the registered user, and if the user is not registered, the access to the security target server S is unconditionally blocked regardless of who the user is. Also, the security policy storage module 220 stores security policies for each command. Therefore, when a non-authorized command is input to the terminal, the security processing module 250 restricts data communication between the terminal C and the security target server S or restricts the execution of the non-authorized command according to the security policy of the command. In this embodiment, the security policy stored in the security policy storage module 220 is classified into security levels by differentiating access ranges to the server (S) authorized for each security level, and designating the security level for each user to secure security. Systematicity and efficiency of policy management were improved. In this embodiment, the administrator registers the IP of the security target server (S) as shown in FIG. 3 and sets security options to monitor the Telnet/SSH service. In addition, as shown in FIG. 4, the administrator registers the user information of the user who allows access to the security target server (S), designates the access range of the corresponding user, and unauthorized users (policy violating actors; hereinafter 'violators'). Set whether to register facial information. Since the image of the input window shown in FIGS. 3 and 4 is an example, the method for setting the security policy may be variously modified without departing from the scope of rights below.

The relay module 240 relays data communication between the secure access agent 100 and the secured server (S). The relay module 240 controls data communication under the control of the security processing module 250 .

The security processing module 250 compares the face image of the face information received from the face recognition module 110 with the face image of the user information to determine whether they match, and the security target server according to the security policy corresponding to the user information. The relay module 240 is controlled to collectively block access to (S), control only specified data communication, or limit execution of non-authorized commands. As described above, the security processing module 250 compares the facial information repeatedly collected during the operation of the user accessing the security target server (S) with the facial image of the user information, and continues to determine whether the current user is an authorized user. In case of emergency, the connection of the terminal (C) to the server (S) subject to security is blocked according to the user's security policy, or only the designated data communication is blocked, or the execution of non-authorized commands is restricted. In this case, the offender information storage module 230 stores the face information received from the face recognition module 110 as offender information. In addition, the face recognition module 110 collects and transmits facial information of a user attempting to access the secure access agent 100 or the server subject to security (S), and the security processing module 250 performs the facial recognition module 110 The face image of the face information sent from is compared with the face image of the user information to check for inconsistency, and the access to the secure access agent 100 or the secure server (S) is restricted according to the security policy corresponding to the user information. In addition, the violator information storage module 230 stores the face information received from the face recognition module 110, that is, the face information of the user whose access is restricted by the security processing module 250 as the violator information. In addition, the notification module 280 transmits facial information stored as offender information to a designated terminal.

In the end, regardless of whether the secure access agent 100 or the security target server is accessed, the user's facial information is not searched in the user information storage module 210 or the security policy storage module 220, or the violator information is stored. When searched in the module 230, the notification module 280 transmits the corresponding facial information or violator information to the designated terminal.

For reference, although an identification ID is configured in the face information in this embodiment, the identification ID may not be configured in the face information due to an unexpected reason. In this case, the security processing module 250 queries the secure access agent 100 for an identification ID of face information, and the face recognition module 110 retrieves the identification ID from the face information registration module 140 and transmits it. In addition, the security processing module 250 analyzes the work traffic information to check the command, retrieves the security policy corresponding to the command from the security policy storage module 220, and establishes access to the security target server (S) according to the security policy. The relay module 240 is controlled to collectively block or control only designated data communication.

A description of the process of the security processing module 250 will be given again below.

The security proxy server 200, when the data communication between the server subject to security (S) and the terminal (C) is restricted by the security processing module 250 or the command confirmed through task traffic information analysis is a non-authorized command, the security proxy server 200 An audit log storage module 260 for recording and storing log data when data communication is restricted or execution of non-authorized commands is restricted is further included. Accordingly, the administrator checks the log data stored in the audit log storage module 260 and updates the secure access agent 100 and the secure proxy server 200 . In this embodiment, when data communication and command execution between the security target server (S) and the terminal (C) are restricted, log data is generated and stored in the audit log storage module 260, but data communication and command execution are restricted Regardless of whether or not, the execution contents of the security processing module 250 may be recorded as log data.

For reference, the log data stored in the audit log storage module 260 can be output as a list by the administrator as shown in FIG. 5, and the user checks the security history recorded in the log data to update the security management system according to the present invention. can do.

On the other hand, if the security processing module 250 blocks access to the security target server, controls designated data communication, or restricts the execution of non-authorized commands, the violator information storage module 230 receives the corresponding information received from the face recognition module 110. Facial information is stored as violator information, and as shown in FIG. 6, the facial image information of a user with a history of violations stored by the violator information storage module 230 is combined with a list of log data stored by the audit log storage module 260. print out For the violator information configured in the list, it is possible to set an option whether or not to output a face image of the corresponding face information.

Meanwhile, the violator identification module 270 searches the violator information storage module 230 for the facial information collected by the face recognition module 110 and identifies the violator information matching the facial information. If the violator identification module 270 searches for violator information that matches the facial information, the user is subject to blocking access to the security target server (S), controlling specified data communication, or restricting the execution of commands other than authority, and notification The module 280 notifies the designated terminal, that is, the administrator's terminal, of the violator information retrieved by the violator confirmation module 270 and the unauthorized access situation so that the manager recognizes the access of the user subject to violation. As a result, the administrator can quickly recognize and respond to a user who unauthorizedly accesses the security target server (S).

In order for the administrator to be aware of the unauthorized access situation and unauthorized user information to the security target server (S) through a warning message, the notification module 280 is configured as the administrator's e-mail address or SMS or SMS as shown in (a) of FIG. An input window for inputting other contacts is displayed on the manager's terminal. Therefore, in case of emergency, the violator information including the face image is transmitted as a warning message to the manager's terminal as shown in (b) of FIG. 7, and the manager can quickly respond by checking the warning message.

8 is a flowchart sequentially showing a security management method based on the security management system according to the present invention, and FIG. 9 is an image showing an example of an authorized user's work in the security management system according to the present invention. It is an image showing an example of an unauthorized user's work in the security management system according to the present invention, and FIG. 11 is an image showing an example of an act violator's work in the security management system according to the present invention.

2 and 7 to 11, the security management method according to the present invention is executed based on the security management system.

S111; Login attempt steps through secure access agent

In the security management system according to the present invention, the face recognition module 110 checks the face of the user attempting to access the security target server (S) and executes a login procedure.

In general, the login procedure is based on inputting account information such as the user's ID and PW, and a facial information confirmation process is performed as an additional confirmation procedure. In order to check the user's face information, the photographing means generates a photographed image by photographing the user's face under the control of the face recognition module 110, extracts the face shape from the photographed image, and analyzes the image to extract the face vector information, which is unique. generate code The face image may be a photographed image of the user's face and a unique code, but only the unique code may constitute the face image. Subsequently, when a face image is generated according to the above process, the face recognition module 110 generates face information by setting the user's identification ID and the face image as three sets. The face recognition module 110 transmits facial information to the security proxy server 200, and the security processing module 250 of the security proxy server 200 receives the ID and PW of the user as well as the face recognition module 110. Face information is compared with user information to determine whether the user matches, and a login procedure is performed between the secure access agent 100 and the security target server S.

S112; Account information and face information comparison step

The security processing module 250 converts the account information and face information input by the user into the secure access agent 100 into the account information and face information of the user information stored in the user information storage module 210 of the secure proxy server 200. Compare each.

S113; Steps to confirm whether facial information is present in previously registered account information

As a result of the comparison, if inconsistency of the facial information is confirmed, the security processing module 250 checks whether the inconsistency is due to the absence of facial information registered as user information or whether it is actually inconsistent with facial information previously registered in user information. .

S114; Facial information registration steps related to account information

When it is confirmed that the reason for the inconsistency of the face information is that the face information for the account information is not registered at the time of login, the face information registration module 140 registers the face information in the user information of the corresponding user and stores the user information module 210. After updating, the log-in attempt step (S111) through the secure access agent is re-executed.

S115; Steps to Deny Login

At the time of the login attempt, the user's facial information is already configured in the user information, and the reason for the inconsistency of the facial information is that the facial information configured in the user information and the facial information collected and generated by the face recognition module 110 at the time of the login attempt are inconsistent with each other. If confirmed as one case, the security processing module 250 restricts access to the security target server (S). In addition, the notification module 120 of the secure access agent 100 pops up a warning window in which the reason for refusal to log in is posted so that the user can recognize it.

In addition, the notification module 280 transmits the user's face information to the designated terminal in the notification step (S14'), and the security processing module 250 stores the user's face information in the offender information storage module 230 as offender information. do.

S12; Security target server connection step

When the matching of the face information is confirmed along with the user's ID and PW confirmation, the security processing module 250 controls the relay module 240 as in the process shown in FIG. It processes data communication between them. In this process, the user logs in and connects to the secure access agent 100, and the secure access agent 100 connects to the security target server S.

The security target server (S) may output a web page of a specific site through the web browser configured in the terminal (C), and transmits the security target data file to the terminal (C) according to the user's selection, so that the terminal (C) Data files can also be executed by a specific application installed in .

S13; Facial information collection stage

After accessing the security target server (S), while a specific application is being executed for reading the data file or while the web page of the security target server (S) is being displayed, the face recognition module 110 operates at a designated time or in a designated situation. Each time, the user's face is photographed by repeatedly controlling the photographing means, and the photographed image is analyzed to generate a unique code, which is face vector information about the face shape. In addition, the identification ID confirmed at the time of login is set with the unique code to generate facial information. For reference, the process of FIG. 11 shows a case where an authorized user accesses the security target server S is changed to an unauthorized user after logging in, and the face recognition module 110 recognizes this case as a designated situation and As described above, the face is photographed by controlling the photographing means. Since the facial information generation and collection process is the same as the facial information generation and collection process at the time of log-in, detailed additional description thereof will be omitted.

The face recognition module 110 sends the collected face information to the secure proxy server 200 .

In addition, the face recognition module 110 transmits work traffic information generated in the process of working with the security target server S along with face information, or sends the face information of the face recognition module 110 together with the user state detection module 130 ) can transmit work traffic information to the security target server (S). In this case, the user state detection module 130 may transmit task traffic information without analyzing it, but the user state detection module 130 analyzes the task traffic information on its own to confirm a command, and the command is a non-authorized command. In the case of , the face recognition module 110 may be controlled to collect the user's face information and then transmit the face information to the secure proxy server 200 along with a command.

S14; Violator Verification Steps

The violator identification module 270 searches the violator information storage module 230 for violator information matching the face information received from the face recognition module 110 . As described above, the violator information storage module 230 is face recognition module 110 when the security processing module 250 blocks access to the security target server S, controls specified data communication, or restricts execution of commands other than authority. Since the face information received from the violator is stored as violator information, the face image of the violator information stored in the violator information storage module 230 is a face image of a user with a history of violations. That is, the violator information storage module 230 stores information of a user having a history of violations.

Therefore, when the violator identification module 270 receives face information from the face recognition module 110, the violator information storage module 230 searches for the same face image of the violator information as the face image of the face information. As described above, since the facial image constitutes a unique code, which is facial vector information, whether the facial images match is confirmed through the unique code comparison.

S14'; notification step

When the facial image of the violator information identical to the facial image of the facial information is retrieved from the violator information storage module 230 by the violator identification module 270, the notification module 280 transmits the information to the designated terminal, that is, the administrator's terminal. As shown in the diagram (b), the violator information is transmitted as a warning message.

In the end, the administrator can observe the behavior of the user who may attempt a violation against the security target server (S) in response to the warning message, and protect the information of the security target server (S) by actively responding in case of emergency. .

S15; Steps to check the security policy for work traffic

If the violator confirmation module 270 does not search the violator information in the violator information storage module 230, the security processing module 250 that receives the job traffic information or command along with the face information from the secure access agent 100 The received face information and command or face information and work traffic information are checked, and a security policy related to the corresponding command is retrieved from the security policy storage module 220 . As a result of the search, if the above command is confirmed as a non-authorized command according to the security policy, the relay module 240 is controlled to completely block or restrictly block the access to the security target server (S) according to the security policy, or as a non-authorized command. Block the execution of the identified command.

On the other hand, if the command is not an authorized command, the security processing module 250 continues the subsequent process to verify facial information.

S16; Face information comparison step

The security processing module 250 searches the user's face image in the user information storage module 210 based on the identification ID of the face information. The searched user information includes a face image of the corresponding user. The security processing module 250 compares the facial image of the facial information with the facial image of the user information to check whether they match. As described above, since the facial image constitutes a unique code, which is facial vector information, whether the facial images match is confirmed through the unique code comparison.

S17, S17'; control phase

As a result of comparing the facial image of the facial information with the facial image of the user information, if it is confirmed that the newly collected facial information and the facial information of the user logged in to the secure access agent 100 match each other, the security processing module according to the process of FIG. 9 (250) maintains data communication between the security target server (S) and the terminal (C). In addition, the facial image of the user information is updated with the facial image of the facial information according to the administrator's settings. Since the face image of the face information is the most recently collected image, it may be most similar to the face image of face information to be collected in the future. Therefore, in order to minimize errors in facial image comparison, it is desirable to update the facial image of the existing user information with the recently collected facial image.

As a result of comparing the facial image of the facial information and the facial image of the user information, if it is confirmed that they are inconsistent with each other, the security processing module 250 allows the user of the facial information retrieved from the user information storage module 210 to log in and access the secure access agent 100. Check whether this is an authorized user.

A user whose face information collected by the face recognition module 110 of the secure access agent 100 is not registered in the user information storage module 210 or who is not allowed to log in to the secure access agent 100 or the security target server S. If confirmed, the access is blocked according to the process shown in FIG. 10 under the control of the security processing module 250 .

S18; Command execution limit step

On the other hand, for comparison with the face information collected by the face recognition module 110 of the secure access agent 100, the user of the face information retrieved from the user information storage module 210 secure access agent 100 as shown in FIG. If it is confirmed that the user is capable of log-in access to , the security processing module 250 maintains the connection between the secure access agent 100 and the security target server (S), and provides commands for the security target server (S) currently in data communication. limit the execution.

Although the detailed description of the present invention described above has been described with reference to preferred embodiments of the present invention, those skilled in the art or those having ordinary knowledge in the art will find the spirit of the present invention described in the claims to be described later. And it will be understood that the present invention can be variously modified and changed within a range that does not deviate from the technical scope.

C: Terminal S; Security target server
100; secure access agent 200; secure proxy server

Claims (8)

In a security management system equipped with a security proxy server for relaying data communication between a terminal and a security target server and for security management of server users' actions,
A face recognition module that repeatedly collects and transmits facial information of a user who has been authorized to access the security target server and is connected at a designated time or in a designated situation, and a user's command confirmed through analysis of work traffic information with the security target server A security access agent installed in the terminal having a use state detection module for transmitting a signal so that the face recognition module collects the user's face information when it is confirmed that the command is an unauthorized command based on the user's security policy; and
A user information storage module for storing user information including user face information, a security policy storage module for storing security policies for each user, and a relay module for relaying data communication between the secure access agent and the security target server; The face image of the face information received from the face recognition module is compared with the face image of the user information to determine whether they match, and according to the security policy corresponding to the user information, access to the security target server is blocked, or only designated data communication is controlled or authorized. A security processing module that controls the relay module so that the execution of other commands is restricted, and if the security processing module blocks access to the security target server, controls specified data communication, or restricts the execution of commands other than the authority, the face recognition module receives A security proxy server equipped with a violator information storage module that stores the face information as violator information and a violator identification module that retrieves and confirms violator information matching the face information received from the face recognition module from the violator information storage module;
A security management system for recording, tracking, and managing facial information of a security policy violating actor, characterized in that it comprises a. In a security management system equipped with a security proxy server for relaying data communication between a terminal and a security target server and for security management of server users' actions,
A face recognition module that repeatedly collects and transmits facial information of a user who has been authorized to access the security target server and is connected at a designated time or in a designated situation, and uses state detection that checks and transmits work traffic information with the security target server a secure access agent equipped with a module and installed in the terminal; and
A user information storage module for storing user information including user face information, a security policy storage module for storing security policies for each user, and a relay module for relaying data communication between the secure access agent and the security target server; If the command confirmed by analyzing the work traffic information is determined to be an unauthorized command based on the user's security policy, the face recognition module transmits a signal to collect the user's face information, and the face image of the face information received from the face recognition module It compares the user information with the facial image of the user information to check whether it matches, and blocks access to the security target server according to the security policy corresponding to the user information, controls only designated data communication, or controls the relay module to restrict the execution of commands other than privileges. and violator information that stores the face information received from the face recognition module as violator information when the security processing module blocks access to the security target server, controls designated data communication, or restricts execution of commands other than authority. a security proxy server equipped with a storage module and a violator identification module that searches and confirms violator information matching the face information received from the face recognition module from the violator information storage module;
A security management system for recording, tracking, and managing facial information of a security policy violating actor, characterized in that it comprises a. According to claim 1 or 2,
The facial recognition module collects and transmits facial information of a user who has attempted to access a secure access agent or a secure target server;
The security processing module compares the face image of the face information transmitted from the face recognition module with the face image of the user information, checks for discrepancies, and restricts access to the secure access agent or security target server according to the security policy corresponding to the user information. If so, the violator information storage module stores the face information received from the face recognition module as violator information;
A security management system that records, tracks, and manages facial information of security policy violating actors. The method of claim 3, wherein the secure proxy server,
a notification module for transmitting the facial information stored as the offender information to a designated terminal when the face information of the user attempting to access the secure access agent or the server to be secured is stored as the offender information in the offender information storage module;
A security management system for recording, tracking, and managing facial information of a security policy violating actor, characterized in that it further comprises. The method of claim 1 or 2, wherein the secure proxy server,
a notification module for transmitting the violator information retrieved by the violator identification module to a designated terminal;
A security management system for recording, tracking, and managing facial information of a security policy violating actor, characterized in that it further comprises. The method of claim 1, wherein the secure access agent,
further comprising a notification module outputting a data communication situation between the OS (Operating System) of the terminal and the server subject to security;
A security management system that records, tracks, and manages facial information of security policy violating actors. According to claim 6,
The security processing module transmits a notification signal when blocking access to the security target server or controlling only designated data communication;
The notification module outputs guide data related to face information recollection according to the notification signal;
A security management system that records, tracks, and manages facial information of security policy violating actors. The method of claim 1 or 2, wherein the security processing module,
When it is confirmed that the face image of the face information received from the face recognition module matches the face image of the user information stored in the user information storage module, the face image of the user information stored in the user information storage module is converted to the face image of the face information. updating with images;
A security management system that records, tracks, and manages facial information of security policy violating actors.

Images