KR20190047202A - Saving screen information when oprating a specific program to prevent information leakage from PC Security system and its method - Google Patents

Abstract

Disclosed are a security system which monitors whether a processor of a program capable of checking sensitive information from a PC in order to cope with damages such as an increase of an information leakage damage in society is operated, and a method thereof. To this end, a specific processor registered by an administrator transmits a screen recording file recording a monitor screen from the time of execution, keyboard input information, and system function call information to a management server, and the management server performs index processing on a separate storage and stores the information. Through the call of the administrator, the stored information can be played through the call of the administrator, so that the information leakage by an insider can be prevented in advance and the cause of information leakage can be easily grasped.

Description

Technical Field [0001] The present invention relates to a security information storage system, and more particularly, to a security information security system and a method thereof,

In the present invention, leakage of personal information or confidential information is frequently caused by leakage of personal information or transmission of data through a specific program used by each institution in response to information leakage. And to provide screen information storage for responding to information leakage so as to prevent a recurrence, and a method thereof.

In recent years, the office environment through computers has been generally constituted, and the number of business hours through the Internet has been continuously increasing, so network and internet usage time is continuously increasing. In addition, as portable storage devices such as USB become popular, various methods for easily and conveniently moving data have been continuously developed, and various solutions have been developed and used in preparation for exposure to personal information, confidential information or hacking.

Most of existing security programs are mostly concentrated on preventing information leakage due to external intrusion through the network, and existing solutions are limited in terms of information leakage through internal users. In other words, there are information leakage caused by external attack in general information leakage cases, but information leakage caused by malicious intention of internal users is also occurring continuously.

Korean Patent Laid-Open No. 10-2007-0045448 discloses an apparatus and method for blocking harmful multimedia through intelligent screen monitoring. Korean Patent Laid-Open Publication No. 10-2007-0045448 discloses a method of detecting the presence of a harmful screen by grasping the mathematical structure of an image and blocking the corresponding multimedia.

However, in this case, not only the blocking process is carried out only by judging the overexposure of a specific image of simple multimedia, but also the program which is currently blocked is limited.

Korean Patent Publication No. 10-2011-0031014 discloses a harmful information monitoring apparatus on a PC and a harmful information monitoring method using the same.

Korean Patent Laid-Open No. 10-2011-0031014 discloses a method of capturing a screen of a specific client terminal through a mobile communication terminal and transmitting it to a management server.

However, there is no way to determine the basis of the harmful information, and the screen is captured at the time of the request through the manager's mobile communication terminal, so that it is only limited to immediate detection and storage of the malicious program.

Korean Patent Laid-Open No. 10-2011-0041778 discloses a method for blocking information leakage of a host apparatus. Korean Patent Laid-Open Publication No. 10-2011-0041778 discloses a method for controlling access to a portable storage medium and copying and creation of a file to a portable storage medium.

However, it can prevent leakage of important information by blocking physical connection, but it can not control and inquire shooting and output through screen capture by querying by user and provides countermeasures against situations that can be leaked to a network There is a limit that can not be done.

Korean Patent Laid-Open No. 10-2006-0089555 discloses a remote computer use monitoring system through transmission of monitor screen contents.

Korean Patent Laid-Open Publication No. 10-2006-0089555 discloses a technique of installing a monitoring program that utilizes a screen capture function of a computer to capture and store a monitor screen in operation for a predetermined time, irregular time, or a server request, Program. The server that receives the data can display it on the computer screen and save the data for later inspection.

However, since only one still image is transmitted to the server computer by turning on the computer screen, the user can not know the entire history of using the computer or who actually used the computer, And so on.

Korean Patent Laid-Open No. 10-2007-0045448 (published on May 22, 2007) Korean Patent Publication No. 10-2011-0031014 (published on March 24, 2011) Korean Patent Publication No. 10-2011-0041778 (published on April 22, 2011) Korean Patent Publication No. 10-2006-0089555 (published on August, 2006)

An object of the present invention is to provide a method and apparatus for capturing and storing a screen of an internal user PC such as a corporation, a public institution, a financial institution, a hospital, The present invention provides a method of specifying an internal user by retrieving the specific information when an accident occurs or exporting the information to the outside, and reproducing the status of the PC operation for the user.

In order to accomplish the object of the present invention, in order to provide screen information for operating a specific program of the present invention, an agent installed in a user PC and a plurality of agents are managed, And Storage for storing the corresponding data.

Here, the agent monitors the execution of the processor of the corresponding program when registering a specific program of the manager server, captures a screen of the corresponding program at the same time when the corresponding processor is in operation, and stores the screen in a specific folder as a file.

The Agent also runs automatically when the computer is running and terminates with the computer shutdown after execution.

The Agent is running on the computer and attempts connection with the management server. The agent performs authentication process through the unique MAC address, user ID and password of the Agent installed computer Lancard, and receives the policy from the management server.

Agent sends a screen-captured screen file to the management server, and transmits the file through the encrypted communication channel for the security of the file.

Meanwhile, the management server provides efficient registration and management of a plurality of agents. The management server authenticates the access authorization when the first installed agent requests registration, and allows the management to proceed by assigning a unique key value to each agent.

The management server classifies and manages users by department in order to increase the convenience of management, stores programs for storing screens for each group, and transmits information about the settings for each agent.

The management server can set a predetermined time period for each agent to receive a specific alive keep signal so that the management server can intuitively confirm whether or not the agent has a failure.

The management server maps the unique key value of the user in the management server on the basis of the source IP of the file transmitted to the received file, indexes the user and the process time, do.

The management server provides a function to reproduce the stored information according to the authority of the administrator.

According to the screen information storage security system and method for operating a specific program for blocking information leakage from the PC in order to cope with the information leakage of the present invention, it is possible to record and save the monitor screen during execution of a specific program for each user, In the case of an information leak and an information leakage time for each user, it is possible to confirm after the information leak time or what operation is performed on the user's computer when the user confirms.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram illustrating a schematic configuration of a security system according to an embodiment of the present invention, and FIG.
2 is a block diagram of an internal detailed operating module of a security system according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a security system and method (hereinafter, referred to as 'security system and method') for providing screen monitoring information for coping with information leakage according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a security system according to an exemplary embodiment of the present invention.

1, the security system of the present invention includes a plurality of personal computers (PC) 100-1, 100-2, ..., 100-n, a network 120, a management server, .

A plurality of PCs 100-1, 100-2, ..., 100-n generate a file recording a monitor screen. The generated files and information are generated according to the time interval set by the administrator server (), which will be described later.

For example, if the time interval is set to 3 minutes, the screen recording file is generated to have the following file name. That is, the monitor screen is recorded in a unit of one second and is generated as a video file.

2017_10_15_14_22_01_00001_A1. jpg

2017_10_15_14_22-02_00001_A1. jpg

2017_10_15_14_22_03_00001_A1. jpg

If the time interval is set to 2 seconds and the monitor screen is set to record, the file is created as below.

2017_10_15_14_22_01_00001_A1. jpg

2017_10_15_14_22-03_00001_A1. jpg

2017_10_15_14_22_05_00001_A1. jpg

Also, in order to classify users, each user is created as follows to identify the user when the user code is issued.

The identification code of the user having the 192.168.1.1 IP is 00002

If the identification code of the user having the 192.168.1.2 IP is 00003

192.168.1.1 The IP user's creation file is created as below

2017_10_15_15_10_01_00002_A1. jpg

2017_10_15_15_10_02_00002_A1. jpg

2017_10_15_15_10_03_00002_A1. jpg

... ... ... ...

192.168.1.2 The IP user's creation file is created as below.

2017_10_15_15_10_01_00003_A1. jpg

2017_10_15_15_10_02_00003_A1. jpg

2017_10_15_15_10_03_00003_A1. jpg

... ... ... ...

In order to classify the program to be used, a program code is issued to each designated program and is generated as follows for program identification.

The program identification code of Microrsoft Word is A1

If the program identification code of the mail program is B1

The generated file of Microsoft Word is generated as below

2017_10_15_15_10_01_00002_A1. jpg

2017_10_15_15_10_02_00002_A1. jpg

2017_10_15_15_10_03_00002_A1. jpg

... ... ... ...

The generated file of Internet Explorer is created as below.

2017_10_15_15_10_01_00003_B1. jpg

2017_10_15_15_10_02_00003_B1. jpg

2017_10_15_15_10_03_00003_B1. jpg

... ... ... ...

Recording time interval can be set according to storage storage capacity.

On the other hand, as many PCs (PC-001, PC-002, PC-003, ... PC-n) are booted, the Agent installed in the PC is automatically executed and automatically terminated when the PC is shut down. The Agent can be prevented from being displayed as a Task Manager or an icon so that it can not be recognized by the user through the automatic authentication process by the administrator, or the user can be authenticated by inserting the ID / Password through the manual authentication process have.

Here, a plurality of agents (Agent-001, Agent-002, ..., Agent-n) are firstly stored in a specific file of the corresponding PC and transmitted to the administrative manager server (S-200) through TCP / IP communication. A number of agents (Agent-001, Agent-002, ..., Agent-n) periodically check the network status with the administrator server (S-200) through the keep alive signal, After the capture file is stored in a specific area of the PC, the transmission of the file is resumed when the network status is normalized.

In the manager server S-200, a file transmitted through a network (Net-100) from a plurality of agents (Agent-001, Agent-002, ..., Agent- Hush. The saved file is automatically set up after a period of the administrator's retention period, and provides a function to backup the file in a separate space.

The administrator server (S-200) interprets the recording information index stored in the storage (D-300) and displays it as screen monitoring information. Such screen monitoring information includes a PC usage time and a user shooting screen content.

The administrator server (S-200) provides a user interface for continuously checking a screen recording file by time or searching for and displaying a specific time. Also, the administrator server (S-200) is provided with a user interface capable of specifying a playback speed, a screen size, and the like.

If there are a lot of administrators, it is possible to create an account for each administrator who accesses the administrator server (S-200) separately. To be reproduced.

Figure 2 is a description of the operating modules that are operated separately in the Agent and Server

PC-001, PC-002, PC-003 ,,, PC-n: Multiple PCs
Agent-001, Agent-002, Agnet-003 ,,,, Agent-n: Many PC installation programs
Net-100: Network Switch
D-300: Storage
S-200: Management server

Claims (5)

The management server index processing of the recorded image file transmitted from the agent through the agent network installed on multiple PCs that generate the monitor screen recording file, the keyboard input information, and the system function call information, A security system that provides screen surveillance for responding to an information outflow including storage for storing a file The method according to claim 1,
The Agent monitors the call of the dll from the management server to monitor the screen of the PC in order to record the screen of the PC in the form of a screen capture from the execution of the stored processor and displays the captured image file on the information of the PC A security system that provides screen monitoring corresponding to information leakage by indexing the process name and capture time and transmitting the file to the management server A security method for a security system including an Agent, a management server, and storage installed in a plurality of PCs via a network,
Storing a PC screen when the specified processor of the manager is running in the plurality of agents;
Transmitting the generated file to the management server using an encrypted network protocol;
Indexing received information and encrypting and storing the indexed information in storage;
Providing stored information to a manager screen based on an administrator's query criteria;
A security method of a security system for providing screen information storage for responding to an information outflow The method of claim 3,
Setting a recording time interval of the screen capture file and a storage period of the recording information index, and capturing a corresponding PC screen from the beginning to the end of the specific process and saving the file as a file Security method of security system providing screen information storage to cope with leakage The method of claim 3,
A security system that provides screen information storage for responding to an information leakage characterized by a white list based on a specific process or a black list based on the process, or a screen storage during a process operation other than the corresponding process Security Method

Images