WO2016032233A2

WO2016032233A2 - Data management method, computer program for same, recording medium thereof, user client for executing data management method, and security policy server

Info

Publication number: WO2016032233A2
Application number: PCT/KR2015/008936
Authority: WO
Inventors: 조규곤; 권오승; 조정현
Original assignee: 주식회사 파수닷컴
Priority date: 2014-08-27
Filing date: 2015-08-26
Publication date: 2016-03-03
Also published as: WO2016032233A3

Abstract

The present invention relates to a data management method, a computer program for the same, a recording medium thereof, a user client for executing the data management method, and a security policy server. According to one aspect of the present invention, disclosed is the data management method network-linked to a DB server and the security policy server, and executed by the user client and in which a security program having a user right policy management function is installed, comprising the steps of: 1) recognizing a user ID through user authentication; 2) detecting whether a DB control application is executed; 3) determining whether the DB control application, of which the execution is detected, is allowed to be used for the user ID; 4) determining whether the DB server, to which an access is attempted, is allowed to be accessed for the user ID if it is determined that the DB control application is allowed to be used; 5) allowing the access to the DB server if it is determined that the DB server is allowed to be accessed; and 6) managing the encryption of data transmitted according to a preset user right policy if the data is transmitted from the DB server as a result of the access.

Description

Data management method, computer program for it, recording medium, user client executing data management method, security policy server

The present invention relates to a data management method, a computer program for the same, a recording medium, a user client for executing the data management method, and a security policy server. The security program has a network interworking with a security policy server and has a user rights policy management function. Using the user client, execute the data management method, the computer program, the recording medium, and the data management method, which are configured to integrate the access to the data managed by the DB server and the user authority management of the data transmitted to the user client. It relates to a user client, a security policy server.

Various security management techniques have been proposed to prevent unauthorized users from accessing or using the data managed by the DB server.

For example, a DB encryption scheme has been proposed to provide a data encryption function in a DB server, to provide encrypted data to a user client requesting data, and to use data only when a decryption function is installed in the user client.

As an example of such a DB encryption method, a plug-in method for installing a plug-in agent in a DB server to interoperate an encryption server, an API method for interworking with an encryption server using an API method in a DB server, or a hybrid method for mixing them has been proposed.

As another example, a DB access control method has been proposed that allows a user client to access a DB server through an access control server.

As a DB access control method, an agent method in which an agent including an access control and logging function is ported to the DB server itself, and all IPs connected to the DB server are configured through the DB security server (proxy server) or between the DB server and the client. In this paper, a gateway method for configuring an inline security system and a sniffing method for analyzing and logging packets on a network line have been proposed.

However, the conventional methods as described above have a limitation in that they cannot provide an integrated security technology in which a DB encryption method and a DB access control method are organically combined.

In addition, in the conventional methods as described above, since data is not controlled after receiving data from a user client having access to a DB server, data transmitted to a user client having access authority (for example, plain text) There is a fundamental problem that the unauthorized user can not control the data or the decrypted data).

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and accesses and manages data managed by a DB server using a user client installed with a security program interworking with a security policy server and having a user rights policy management function. It is an object of the present invention to provide a data management method, a computer program, a recording medium, a user client for executing the data management method, and a security policy server configured to integrally manage user rights of data transmitted to the data.

According to an aspect of the present invention for achieving the above object, a data management method that is interworked with the DB server and the security policy server, and executed in a user client installed with a security program having a user rights policy management function, 1) user authentication Recognizing a user ID through; 2) detecting whether the DB control application is running; 3) determining whether the DB control application that has detected execution is a DB control application permitted to use for the user ID; 4) if it is determined that the DB application is allowed to use, determining whether the DB server attempting to access the DB server is allowed to access the user ID; 5) if it is determined that the access is a DB server, allowing access to the DB server; And 6) if data is transmitted from the DB server as a result of the access, encrypting and managing the transmitted data according to a preset user right policy.

Preferably, the security policy server includes at least one of first security information about a DB control application that is allowed to use for each user ID and second security information about a DB server that is permitted to access to each user ID. Storage management.

Preferably, the second security information includes at least one of information about an IP address, a port address, and a usage protocol of a DB server permitted to access each user ID.

Preferably, the user authentication of step 1) is characterized in that the user client is made by making a user authentication request to the security policy server.

Preferably, the first security information and the second security information, characterized in that transmitted from the security policy server to the user client during the user authentication of step 1).

Preferably, after the user authentication of step 1), based on the second security information, the session connection between the DB server and the user client allowed access to the user ID is made.

Preferably, after the session connection is established, 101) the user client periodically transmitting the session maintenance confirmation data to the DB server; And 102) maintaining the session when the session maintenance confirmation data is normally received at the DB server.

Preferably, the user right policy of step 6) relates to setting of user rights for at least one of viewing, editing, printing, screen capturing, decryption, and watermark printing of data managed by the user client. It features.

Preferably, the user rights policy is transmitted from the security policy server to the user client at the time of user authentication in step 1), or is secured at the request of the user client for setting user rights for data encryption management in step 6). It is characterized in that the transmission from the policy server.

According to yet another aspect of the present invention, a data management method executed in a security policy server interworking with a user client on which a DB server and a security program having a user rights policy management function is installed is provided. Storing and managing at least one of first security information about a DB control application that is permitted to use and second security information about a DB server that is permitted to access to each user ID; And 202) authenticating a user by receiving a user authentication request from the user client—transmitting at least one of the first security information and second security information to the user client during the user authentication, wherein the first security information is transmitted. And managing access from the user client to the DB server based on at least one of the second security information.

According to yet another aspect of the present invention, a computer program stored in a medium for executing the data management method in combination with hardware is disclosed.

According to yet another aspect of the present invention, a computer-readable recording medium having recorded thereon a computer program for executing the data management method on a computer is disclosed.

According to another aspect of the present invention, a data management unit for interworking with the DB server and the security policy server, a user client installed with a security program having a user rights policy management function, storing and using the data transmitted from the DB server ; A user authentication manager that performs user authentication processing in association with the security policy server, wherein the user authentication processing includes a function of recognizing a user ID through user authentication; A user rights policy management unit which encrypts the data transmitted from the DB server in a manner according to a user rights policy and manages the data to be used only by a user whose user rights are verified based on the user rights policy; And a DB access management unit that performs an access management function for the DB server. The access management function includes a function for detecting whether a DB control application is executed and a DB control application for which execution is detected is allowed to be used for the user ID. A function of determining whether or not it is a DB control application, and a function of determining whether a DB server attempting access is a DB server permitted to access the user ID, if it is determined that the DB application is permitted to use; If it is determined that this is an allowed DB server, the user client configured to include a; includes a function to allow access to the DB server.

Preferably, a session management unit that performs management functions related to session connection, maintenance, and termination with the DB server-The management function related to session maintenance includes a function of periodically transmitting session maintenance confirmation data to the DB server after a session connection. It includes; further comprises.

According to another aspect of the present invention, a DB server and a security policy server interworking with a user client on which a security program having a user rights policy management function is installed, the DB control permitted to use for each user ID of the user client A policy setting unit for setting or managing first security information about an application, second security information about a DB server permitted to access to each user ID, and a user rights policy for each user ID and the DB server; User management unit for managing user registration and authentication for each user ID-The user authentication is performed by receiving a user authentication request from the user client, the first security information and the second security information to the user client at the time of user authentication Transmitting at least one of the following: managing access to the DB server from the user client based on at least one of the first security information and the second security information; And a server manager for managing registration with a DB server.

As such, the present invention has an advantage in that access to data managed by the DB server and user rights management of data transmitted to the user client are integrated so that improved data security management is achieved.

In particular, by using the user rights policy management function, there is an advantage that the data transmitted to the user client with the use rights can be managed in a way that unauthorized users can not use.

1 is a system configuration diagram for executing a data management method according to an embodiment of the present invention;

2 is a flowchart of a user client perspective of a data management method according to an embodiment of the present invention;

3 is a flowchart illustrating a session management process of a data management method according to an embodiment of the present invention;

4 is a flowchart illustrating a security policy server in a data management method according to an embodiment of the present invention.

The present invention can be embodied in many other forms without departing from the spirit or main features thereof. Therefore, the embodiments of the present invention are merely examples in all respects and should not be interpreted limitedly.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise", "comprise", "have", and the like are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification. Or other features or numbers, steps, operations, components, parts or combinations thereof in any way should not be excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and the same or corresponding components will be denoted by the same reference numerals regardless of the reference numerals and redundant description thereof will be omitted. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a system configuration diagram for executing a data management method according to an embodiment of the present invention.

A user client 3000 interworking with the DB server 2000 and the security policy server 1000 and having a security program having a user rights policy management function is installed. The user rights policy management function is, for example, in a form similar to that of a conventional DRM technology, and differentially sets usage rights of a file or data according to a user, and controls the file or data differentially according to the set authority. It can be understood as a function of a concept similar to managing to be accomplished.

For example, the user rights policy management function may include encryption and decryption processing for a file or data packet to be managed, user authority verification processing based on identification of a user ID, and user authority verification for an encrypted file or data packet. To allow a designated user to perform usage activities including viewing, editing, printing, screen capture, decryption, and watermark printing, and to determine which range of usage behaviors for each user is allowed for each user. Rights management processing.

The DB server 2000 is a server that manages data to be accessed by the user client 3000. When the data management unit 2010 and the user client 3000 which perform a normal DBMS function want to access through a DB application. Session access with DB access control unit 2012 performing access control function, encryption management unit 2014 performing encryption function for managing data, control unit 2016 performing overall server management function, and user client 3000 And a session manager 2018 that performs management functions related to maintenance and termination. The session manager 2018 may be implemented in the form of a separate session control server interworking with the DB server 2000.

Data to be accessed by the user client 3000 may be, for example, customer personal information data or financial transaction information data managed by the DB server 2000.

A DB application can be understood as a conventional DB control program for a user to perform a query (SQL) operation or the like through a user client. Examples of commercial products include Todd, Orange, Oraclegate and Golden SQLdeveloper. Orange, for example, is a DB client software that makes DB management and development easy through the UI.

The security policy server 1000 includes a policy setting unit 1010 that sets or manages the first security information, the second security information, and the user rights policy, which will be described later, in association with each user ID and / or DB server, and each user ID. And a user manager 1012 for managing user registration and authentication and interworking, a server manager 2014 for managing registration and interworking with the DB server, and a controller 1016 for performing overall server management functions.

Preferably, the policy setting unit 1010 may include first security information about a DB control application that is allowed to use for each user ID of the user client, and a second information about a DB server that is permitted to access to each user ID. 2 Set or manage security information and user authorization policy for each user ID and DB server.

Preferably, the user authentication performed by the user manager 1012 is performed by receiving a user authentication request from the user client, and at least one of the first security information and the second security information to the user client during the user authentication. One is transmitted, and access management from the user client to the DB server is performed based on at least one of the first security information and the second security information.

The user client 3000 is distinguished from the general client 4000 in which the security program is not installed or deleted in that the user client 3000 is a client in which a security program having a user rights policy management function is installed.

The user client 3000 includes a data manager 3010 for storing or using data transmitted from the DB server, a user authentication manager 3012 for performing a user authentication process in association with the security policy server 1000, and a DB server. User rights policy management unit 3014, which encrypts the transmitted data in a manner according to the user rights policy and makes it available for use by users whose user rights are verified based on the user rights policy, and manages the entire user client. The control unit 3016 to perform, the DB access management unit 3018 to perform the access management function for the DB server 2000, the session management unit 3020 to perform management functions for connection, maintenance, and termination of the session with the DB server 2000 ).

Preferably, the user authentication process performed by the user authentication manager 3012 includes a function of recognizing a user ID through user authentication. For example, user authentication may be performed through a single sign-on (SSO) user login process. For example, the user ID recognition may be performed by a user inputting a user ID through the user client 3000 or by recognizing the user ID in the authentication server based on user input information. The authentication server may be provided with a separate integrated authentication server (not shown) for implementing single sign on (SSO) and interwork with the security policy server 1000. It can also be comprised as a subsystem.

Preferably, the access management function performed by the DB access manager 3018 includes a function of detecting whether a DB control application is executed and a DB control in which execution is detected that the DB control application is allowed to use for the user ID. A function for determining whether the application is an application, a function for determining whether the DB server attempting to access the DB server that attempts to access the DB server is allowed to access the user ID, If it is determined that the database server is included, a function of allowing access to the DB server is included.

The data management unit 3010 manages a user whose user authority is confirmed to perform data use operations relating to at least one of viewing, editing, printing, screen capturing, decryption, and watermark printing.

The general client 4000 may be understood as a client without a security program installed or deleted, and may be understood as a client of a user who does not have permission to use encrypted data according to a user right policy.

2 is a flowchart of a user client perspective of a data management method according to an embodiment of the present invention, and FIG. 3 is a flowchart of a session management process of a data management method according to an embodiment of the present invention. Hereinafter, the data management method according to the present embodiment will be described from a user client perspective.

The data management method of this embodiment is networked with a DB server and a security policy server, and is executed in a user client in which a security program having a user rights policy management function is installed.

Preferably, the security policy server includes at least one of first security information about a DB control application that is allowed to use for each user ID and second security information about a DB server that is permitted to access to each user ID. Storage management. In particular, the second security information includes at least one of information about an IP address, a port address, and a usage protocol of a DB server that is allowed to access each user ID. The first security information and the second security information may be preconfigured and managed by an administrator client (not shown) in the security policy server, and are generated based on user registration information and DB server registration information for setting a user ID.

In step S1, the user client recognizes the user ID through user authentication. In a preferred embodiment, the user authentication of step S1 is performed by the user client requesting a user authentication to the security policy server.

Preferably, the first security information and the second security information is transmitted from the security policy server to the user client at the time of user authentication in the step S1.

In step S2, the user client detects whether the DB control application is running. In order to detect whether the DB control application is executed, a security program having a user rights policy management function installed in the user client may include a function file for detecting execution of the DB control application, for example, a dynamic linking library (DLL) file, It can be included in the form of an exe file.

In step S3, the user client determines whether the DB control application that is detected to be running is a DB control application that is allowed to use the user ID.

In step S4, if it is determined that the user client is a DB application allowed to use, the user client determines whether the DB server attempting to access the DB server is allowed to access the user ID.

In step S5, if it is determined that the user client is a DB server is allowed access, the user client allows access to the DB server. For example, access to the DB server may be understood as a state in which a user client may query a user ID for a user ID allowed to access a data managed by the DB server and request a transmission.

In step S6, when the data is transmitted from the DB server as a result of the access, the user client encrypts and manages the transmitted data according to a preset user rights policy. Encryption management can be made by a variety of known data encryption processes, detailed description thereof will be omitted.

In a preferred embodiment, the user rights policy relates to a user right setting regarding at least one of viewing, editing, printing, screen capturing, decryption, and watermark printing for data managed by the user client.

For example, the user rights policy is transmitted from the security policy server to the user client at the time of user authentication at step S1, or at the request of the user client for setting user rights for data encryption management at step S6. Is sent from.

On the other hand, in a preferred embodiment, in step S100 after the user authentication in step S1, a session connection between the DB server and the user client allowed access to the user ID is made based on the second security information. For example, a session connection may be understood as a logical connection state for data transfer between a DB server and a user client.

After the session connection is made in step S101, the user client periodically transmits the session maintenance confirmation data to the DB server. The transmission of session maintenance confirmation data may be performed based on the request of the DB server after the initial session connection, or by the user's own operation without request of the DB server after confirming the session connection with the DB server.

In step S102, the user client maintains the session when the session maintenance confirmation data is normally received by the DB server. For example, when the DB server does not receive the session maintenance confirmation data from the user client at regular intervals or does not receive the normal session maintenance confirmation data, the DB server terminates the session connection to the DB server of the user client. Block access Through this process, data transmission can be blocked in advance for user clients whose sessions are not normally maintained, thereby increasing the security of data management.

4 is a flowchart illustrating a security policy server in a data management method according to an embodiment of the present invention. Hereinafter, a data management method according to the present embodiment will be described in terms of a security policy server.

In step S201, the security policy server of the first security information about the DB control application allowed to use for each user ID of the user client, and the second security information about the DB server allowed access to each user ID Store and manage at least one.

In step S202, the security policy server receives a user authentication request from the user client to authenticate the user. In a preferred embodiment, the security policy server transmits at least one of the first security information and the second security information to the user client during the user authentication, and at least one of the first security information and the second security information. Based on this, access management from the user client to the DB server is performed.

Embodiments of the present invention include a program for performing various computer-implemented operations and a computer readable medium recording the same. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROM, DVD, USB drives, magnetic-optical media such as floppy disks, and ROM, RAM, Hardware devices specifically configured to store and execute program instructions, such as flash memory, are included. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Claims

A data management method that runs on a user client with a security program with user authorization policy management function that is networked with a DB server and a security policy server.

1) recognizing a user ID through user authentication;

2) detecting whether the DB control application is running;

3) determining whether the DB control application that has detected execution is a DB control application permitted to use for the user ID;

4) if it is determined that the DB application is allowed to use, determining whether the DB server attempting to access the DB server is allowed to access the user ID;

5) if it is determined that the access is a DB server, allowing access to the DB server; And

6) if data is transmitted from the DB server as a result of the access, encrypting and managing the transmitted data according to a preset user rights policy.
The method of claim 1,

The security policy server,

Data management, characterized in that at least one of the first security information about the DB control application allowed to use for each user ID, and the second security information about the DB server allowed to access to each user ID are stored and managed. Way.
The method of claim 2,

In the second security information,

And at least one of information on an IP address, a port address, and a usage protocol of a DB server that is allowed to access each user ID.
The method of claim 3,

User authentication of step 1),

And the user client makes a user authentication request to the security policy server.
The method of claim 4, wherein

The first security information and the second security information,

And transmitting the data from the security policy server to the user client in the step 1).
The method of claim 5,

After user authentication in step 1),

Based on the second security information, a session connection between a DB server permitted to access a user ID and a user client is established.
The method of claim 6,

After the session connection is made,

101) periodically transmitting, by the user client, session maintenance confirmation data to the DB server; And

102) The method of claim 1, further comprising maintaining a session when the session maintenance confirmation data is normally received in the DB server.
The method of claim 1,

User rights policy of step 6),

And a user authority setting for at least one of viewing, editing, printing, screen capturing, decryption, and watermark printing for data managed by the user client.
The method of claim 8,

The user rights policy,

Transmitted from the security policy server to the user client at the time of user authentication in step 1);

The method of claim 6, wherein the user client is transmitted from the security policy server upon request to set a user right for data encryption management of step 6).
A data management method that is executed in a security policy server that interworks with a user client with a security program having a DB server and user rights policy management.

201) storing and managing at least one of first security information about a DB control application that is allowed to use for each user ID of the user client and second security information about a DB server that is permitted to access to each user ID. step; And

202) authenticating a user by receiving a user authentication request from the user client-transmitting at least one of the first security information and second security information to the user client during the user authentication, wherein the first security information and And manage access to the DB server from the user client based on at least one of the second security information.
A computer program stored in a medium in combination with hardware to execute a data management method according to any one of claims 1 to 10.
A computer-readable recording medium having recorded thereon a computer program for executing a data management method according to any one of claims 1 to 10 on a computer.
It is a user client that is interworked with DB server and security policy server and has security program with user rights policy management

A data manager configured to store or use data transmitted from the DB server;

A user authentication manager that performs user authentication processing in association with the security policy server, wherein the user authentication processing includes a function of recognizing a user ID through user authentication;

A user rights policy management unit which encrypts the data transmitted from the DB server in a manner according to a user rights policy and manages the data to be used only by a user whose user rights are verified based on the user rights policy; And

DB access management unit performing an access management function for the DB server-The access management function includes a function of detecting whether a DB control application is executed and a DB control application that is detected to be executed is allowed to use the user ID. A function of determining whether the application is a control application; a function of determining whether the DB server attempting to access the DB server that is allowed to access the user ID is determined to be a DB application that is allowed to use; A user client configured to include access to the DB server if it is determined to be an allowed DB server.
The method of claim 13,

Session management unit for performing management functions related to session connection, maintenance, and termination with the DB server-The management function for session maintenance includes a function of periodically transmitting session maintenance confirmation data to the DB server after a session connection. A user client configured to include further;
A security policy server that interworks with a user client with a security program that has a DB server and user rights policy management.

The first security information about the DB control application that is allowed to use for each user ID of the user client, the second security information about the DB server that is allowed to access to each user ID, and the user authorization policy for each user ID. And a policy setting unit for setting or managing a DB server.

User management unit for managing user registration and authentication for each user ID-The user authentication is performed by receiving a user authentication request from the user client, the first security information and the second security information to the user client at the time of user authentication Transmitting at least one of the following: managing access to the DB server from the user client based on at least one of the first security information and the second security information; And

Security policy server configured to include; server management unit for managing registration to the DB server.