KR100627810B1 - Method and System for Checking Computer Carry-out for Information Security - Google Patents

Abstract

The present invention relates to a retrieval method and system for information security on computer export.

The present invention provides a retrieval method for information security during computer export, comprising: (a) generating export approval information for accepting an export request from an payment server by an agent; (b) transmitting the export approval information from the payment server to the security server, and transmitting the export request result and the export approval information for the export request in step (a) to the agent; And (c) generating, by the security server, an export token including a security policy for restricting the operation of the mobile computer by receiving the agent's export token generation request and transmitting the export token to the agent. To provide a search method and system.

According to the present invention, there is an effect of protecting the internal information of the enterprise stored in the mobile computer by limiting the operation of the mobile computer when carrying out a task by carrying out the mobile computer to the outside.

Security, Removable Computer, Export, Agent, Security Server, Payment Server, Usage Timeout

Description

Method and System for Checking Computer Carry-out for Information Security

1 is a block diagram showing a computer export system for information security according to a preferred embodiment of the present invention;

Figure 2 is a block diagram showing the internal configuration of the payment server according to an embodiment of the present invention,

3 is a block diagram showing an internal configuration of a security server according to an embodiment of the present invention;

4 is a block diagram showing an internal configuration of an agent according to an embodiment of the present invention;

5 is a flow chart showing a search method for information security upon computer export in accordance with a preferred embodiment of the present invention;

6 is a flowchart illustrating a method for controlling the operation of a mobile computer for information security in an agent according to a preferred embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: payment server 110: security server

120: internal network 130: mobile computer

200: export request information input unit 210: export request payment unit

220: payment information database 230: export approval information file generation unit

240: export request result transmission unit 300: export approval information file receiving unit

310: export information database 320: export token generator

330: export token encryption processing unit 340: security policy setting unit

400: agent 410: export request processing unit

420: export token request processing unit 430: export token storage unit

440: export token decryption processing unit 450: mobile computer use control unit

460: time measuring unit

The present invention relates to a retrieval method and system for information security on computer export. More specifically, when an agent installed on a mobile computer requests an export of the mobile computer from the agent to the payment server, the export approval information is generated to approve the export request, the payment server passes the export approval information to the security server, and the agent requests the export. Sends the export request result and export approval information to the agent, and when the agent requests the export token generation to the security server, the security server generates an export token that contains a security policy that restricts the behavior of the mobile computer and sends it to the agent. The present invention relates to a retrieval method and system for information security upon computer export.

With the rapid development of electronic and computer technologies, the collection, exchange and transmission of information has become active. Information consisting of texts, voices, images, videos, etc. can all be created and edited in the form of files used on computers. It is done. Recently, the use of mobile computers such as laptop computers and PDAs (Personal Digital Assistants), which have advantages in terms of portability and mobility, are being activated.

However, as information is easily collected, exchanged, and transmitted, the risk of leaking internal information stored in a mobile computer increases, and the amount of damages caused by the leakage of internal information continues to increase. As a result, many companies are working to protect and secure their internal information.

The conventional security solution (Solution) for preventing the leakage of information stored in the mobile computer is composed of an agent (Agent) installed in the mobile computer and a server for managing the agent. The server is connected to a mobile computer through the corporate internal network and manages agents installed on the mobile computer. The agent monitors and blocks the leakage path of information stored in the mobile computer to prevent the leakage of internal information.

Agents can be thought of in two ways to prevent the leakage of information stored on mobile computers.

First, the information leakage path of the mobile computer is blocked without any security policy depending on the physical location or access network (internal or external network). Therefore, it is possible to fundamentally block the leakable path after loss or theft, and to prevent the leakage of internal corporate information stored in the mobile computer by a malicious computer user with malicious intention.

However, this security method has a problem that can cause inconvenience to the user in good faith. For example, a removable disk that can be connected to a mobile computer using a connection port such as a universal serial bus (USB) can be a major leakage path for internal company information, while at the same time useful for backing up or sharing large amounts of information. Storage device. Therefore, if you do not allow the use of such removable disks, you will have to build a new network system for backing up and sharing information. Therefore, there is an additional cost for building and managing the system, and it is necessary to solve the security problem for the system itself. have.

Second, the security policy is applied differently according to the physical location or access network of the mobile computer. That is, the security policy may be applied differently depending on whether the access network accessed by the mobile computer is an internal network or an external network. For example, if the mobile computer is connected to the corporate network, normal use is allowed, and if the mobile computer is not confirmed, the mobile computer is locked to prevent the user from using the mobile computer. Can be applied.

In a network environment using static IP without using fixed IP (Internet Protocol), an agent installed in a mobile computer distinguishes whether the mobile computer is in-house or off-site based on whether the server can be connected to the server. Therefore, it is possible to prevent the leakage of internal company information through a path that can be leaked after loss or theft while allowing normal use in the company.

However, this security method has a problem that can cause inconvenience to a well-intentioned user in the case of using a mobile computer outside the company, such as traveling outside. When a mobile computer is taken outside for an external business trip, the agent is forced to change the mobile computer to the locked state because the mobile computer is either connected to the outside network or has no network connection and the agent cannot connect to the internal server. do. When the mobile computer is changed to a locked state, even if a well-intentioned user takes out the mobile computer for a trip outside, the mobile computer cannot be used, and thus, the mobile computer cannot be used and the work efficiency is impaired.

In order to solve this problem, the present invention, when requesting the export of the mobile computer from the agent installed in the mobile computer to the payment server generates the export approval information to approve the export request, and transfers the export approval information from the payment server to the security server; Sends the export request result and export approval information for the agent's export request to the agent, and when the agent requests the creation of an export token from the security server, the security server generates an export token with a security policy that limits the behavior of the mobile computer. An object of the present invention is to provide a retrieval method and system for information security during computer export to the agent.

According to a first object of the present invention, a mobile computer in which an agent for information security is installed, a payment server for paying an export request of the mobile computer, a security server for generating an export token, and managing the agent; A search method for information security during computer export using a system including an internal access network connecting the mobile computer, the payment server, and the security server, the method comprising: (a) receiving an export request of the agent from the payment server; Generating export approval information to approve; (b) transmitting, at the payment server, the export approval information to the security server, and transmitting the export request result and the export approval information for the export request in step (a) to the agent; And (c) receiving, at the security server, a request for generating the export token of the agent, generating the export token including a security policy for restricting the operation of the mobile computer, and transmitting the generated export token to the agent. Provides a search method for information security on export.

According to a second object of the present invention, an agent installed in a mobile computer approved for export to the outside from a system including an in-house access network, a payment server for approving an export request, and a security server for generating an export token. A method of controlling the operation of a mobile computer, comprising: (a) determining whether there is the export token downloaded from the security server upon receiving a request for use of the mobile computer; (b) querying usage time information included in the export token; And (c) approving the use of the mobile computer when the usage time of the mobile computer does not exceed the available time included in the usage time information, and operating the mobile computer when the usage time exceeds the available time. A method for controlling the operation of a mobile computer for information security, comprising the step of setting a state to a locked state.

According to a third object of the present invention, a computer export system for information security that receives an export request of a mobile computer through an in-house access network and performs an export procedure to the outside, is installed in the mobile computer, and the mobile computer is exported. An agent for requesting the export, downloading the export token, and restricting the operation of the mobile computer according to the security policy included in the export token; A payment server configured to generate and store export approval information for approving the export request when receiving the export request of the mobile computer from the agent, and transmit the export request result for the export request and the export approval information to the agent; And providing the agent on the mobile computer, receiving and storing the export approval information from the payment server, and generating the export token and transmitting the generated export token to the agent when requested to generate the export token from the agent. It provides a computer export system for information security, comprising a security server.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a block diagram showing a computer export system for information security according to a preferred embodiment of the present invention.

As shown in FIG. 1, the computer export system for information security according to a preferred embodiment of the present invention includes an payment server 100, a security server 110, an internal access network 120, a mobile computer 130, and the like. can do.

Payment server 100 according to a preferred embodiment of the present invention is a server for paying and recording the export request of the mobile computer (130). When the payment server 100 requests the export of the mobile computer 130 from the agent 400 installed in the mobile computer 130, the payment server 100 determines whether to approve the export and generates export approval information for approving the export request of the agent 400. do. The payment server 100 stores the generated export approval information in the payment information database 220 and transmits it to the security server 110 through the in-house access network 120. In addition, the payment server 100 transmits the export request result and the export approval information for the export request of the agent 400 to the mobile computer 130 through the in-house access network 120. An internal configuration of the payment server 100 will be described in detail with reference to FIG. 2.

Security server 110 according to a preferred embodiment of the present invention is a server that controls the use of the mobile computer 130 for information security. The security server 110 provides the agent 400 for information security to be installed on the mobile computer 130, generates an export token, and manages the agent 400. When the export request of the agent 400 is approved in the payment server 100, the security server 110 receives the export approval information from the payment server 100 through the in-house access network 120 and stores it in the export information database 310. do.

When the security server 110 receives a request for generation of an export token from the agent 400 that has been approved for the export request from the payment server 100, the security server 110 generates an export token including information for limiting the usage time of the mobile computer 130. Transfer to the mobile computer 130. Here, the export token is a certificate for authenticating the use of the mobile computer 130 exported to the outside, and the agent 400 determines whether to use the mobile computer 130 exported to the outside by querying the export token. An internal configuration of the security server 110 will be described in detail with reference to FIG. 3.

Meanwhile, the payment server 100 and the security server 110 of the present invention are connected to a plurality of clients and / or other servers through the in-house access network 120, and receive a request for performing work of the client or another server and It can be implemented with a computer system that derives and provides work results and computer software installed therefor.

In-house access network 120 according to a preferred embodiment of the present invention provides a passage for transmitting and receiving data by connecting the payment server 100, security server 110 and the mobile computer 130. Intra-company access network 120 is a communication network that only the insiders, such as a company, a specific organization, etc., where the system of the present invention is installed for information security, shares information and is closed to an external network. You can set up an intranet environment that doesn't have circuits or allow access from the outside. The internal access network 120 may include a wireless communication network such as a wireless local area network (WLAN) as well as a wired communication network such as a local area network (LAN) and a virtual area network (VAN), and the data using the internal access network 120. The transmission may be performed by TCP / IP, X.25, or serial communication.

The mobile computer 130 according to the preferred embodiment of the present invention is a computer having portability and mobility so that it can be carried out to process business and may include a laptop computer, a hand-held PC, a PDA, and the like. have. An agent 400 for information security is installed on the mobile computer 130, and the agent 400 may be downloaded from the security server 110 and installed on the mobile computer 130.

The agent 400 requests the export of the mobile computer 130 to the payment server 100 to receive the export request result and the export approval information. When the agent 400 receives the export approval from the payment server 100, the agent 400 requests the generation of the export token to the security server 110, and downloads and stores the export token generated by the security server 110. When the mobile computer 130 receives the export permission and is exported to the outside, the agent 400 controls the use of the mobile computer 130 according to the information included in the export token. An internal configuration of the agent 400 will be described in detail with reference to FIG. 4.

Figure 2 is a block diagram showing the internal configuration of the payment server according to a preferred embodiment of the present invention.

As shown in FIG. 2, the payment server 100 according to the preferred embodiment of the present invention generates an export request information input unit 200, an export request settlement unit 210, a payment information database 220, and an export approval information file. The unit 230 and the export request result transmitter 240 may be included.

The export request information input unit 200 receives export request information including user personal information, reason for export, and the like of the mobile computer 130 from the agent 400 and transmits the export request information to the export request settlement unit 210. The export request settlement unit 210 receives the export request information to determine whether to approve the export, and approves the export request information including the personal information of the mobile computer 130, the personal information of the payer, and the reason for the export. Create

The payment information database 220 stores the export approval information generated after the export request approval in the export fairy payment unit 210, and the export approval based on the mobile computer 130, the user, the payer, and the like so that the payment details can be viewed. Information can be classified and stored. The export approval information file generation unit 230 generates an export approval information file including the export approval information so that the approval result of the export request from the payment server 100 may be transmitted to the security server 110. To pass). The export request result transmission unit 240 transmits the export request result and the export approval information for the export request of the agent 400 from the export request settlement unit 210 to the agent 400.

3 is a block diagram showing the internal configuration of a security server according to an embodiment of the present invention.

As shown in FIG. 3, the security server 110 according to an exemplary embodiment of the present invention may include an export approval information file receiver 300, an export information database 310, an export token generator 320, and an export token encryption processor. 330, a security policy setting unit 340, and the like.

The export approval information file receiving unit 300 receives the export approval information file transmitted from the payment server 100 and extracts the export approval information included in the file. The export information database 310 stores the export approval information extracted by the export approval information file receiving unit 300 and classifies the export approval information on the basis of the mobile computer 130, the user, the payer, and the like so that the export approval details can be viewed. Can be stored.

The export token generating unit 320 generates an export token for authenticating the use of the mobile computer 130 when the mobile computer 130 is exported to the outside using the export approval information stored in the export information database 310. The information stored in the export token generated by the export token generation unit 320 may include usage time information including an export start time and an export end time, a mobile computer for a peripheral device such as a communication modem, a LAN card, a removable disk, a printer, and the like. It may include the user's information including the security setting information (130), the employee's name, company number, affiliation group, job title, and the like, information on the payment of the employee, and the reason for export.

The export token encryption processing unit 330 encrypts the export token to securely manage the export token, and then transmits the export token to the agent 400. The export token encryption processing unit 330 may encrypt the export token by public-key cryptography. . The public key encryption method uses a public key paired with an encryption key and a decryption key. Since the sender who wants to send the information knows the encryption key of the receiver, the sender encrypts the information using the receiver's encryption key. When delivered to the receiver, it refers to an encryption scheme in which the receiver decrypts information using its decryption key. Public key ciphers and methods are more efficient than traditional secret key cryptography because they do not need to encrypt the public key itself for security.

In the case of using the public key encryption method, the agent 400 provided to the mobile computer 400 by the security server 110 includes a decryption key set in the corresponding agent 400. When the export token encryption processing unit 330 encrypts the export token using the encryption key set in the agent 400 and transmits the export token to the mobile computer 130, the agent 400 transmits the export token received using its decryption key. It decrypts and uses the information contained in the export token.

The security policy setting unit 340 sets and changes a security policy applied to the mobile computer 130 managed by the security server 100. For example, in the in-house use mode where the mobile computer 130 is connected to the in-house access network 120, the security policy is set to enable normal use, and in the in-use mode in which the mobile computer 130 is exported outside, A security policy may be set to limit the use of the peripheral device in which the information stored in 130 may be leaked and to limit the use time of the mobile computer 130. To this end, the export token generating unit 320 generates an export token reflecting the security policy of the external use mode set in the security policy setting unit 340.

Meanwhile, the payment information database 220 described with reference to FIG. 2 and the export information database 310 described with reference to FIG. 3 have a general data structure implemented in a storage space (hard disk or memory) of a computer system using a database management program (DBMS). It has a data storage type that can freely search (extract), delete, edit, and add data.

Figure 4 is a block diagram showing the internal configuration of the agent according to a preferred embodiment of the present invention.

As shown in FIG. 4, the agent 400 according to the preferred embodiment of the present invention includes an export request processor 410, an export token request processor 420, an export token storage 430, and an export token decryption processor 440. ), A mobile computer usage control unit 450, and the like.

The export request processor 410 receives the export request information from the mobile computer 130 and requests the export of the mobile computer 130 to the payment server 100 through the in-house access network 120, and exports it from the payment server 100. Receive request result and export approval information. The export token request processor 420 requests the generation of the export token to the security server 110 through the internal access network 120, and downloads the export token generated by the security server 110 to the export token storage 430. To pass.

The export token storage unit 430 stores the downloaded export token. When the new export token is downloaded from the security server 110, the export token storage unit 430 deletes the existing export token and stores the new export token. The export token decryption processor 440 decrypts the export token stored in the export token storage 430. Since the export token is transmitted to the mobile computer 130 in an encrypted state for security, the export token decryption processing unit 440 decrypts the corresponding export token to query the information included in the export token.

The mobile computer usage control unit 450 controls the use of the mobile computer 130 according to the information included in the export token decrypted by the export token decryption processing unit 440. That is, the mobile computer usage control unit 450 restricts the use of the peripheral device according to whether to allow access to the peripheral device included in the export token, and checks the available time using the usage time information included in the export token. The usage time of the mobile computer 130 may be limited.

In addition, the mobile computer usage control unit 450 compares the use time with the use time of the mobile computer 130, subtracts the use time from the use time, and when the remaining time is less than or equal to a predetermined time, the end of export warning message. Output to mobile computer 130. For example, when the remaining usage time reaches 30 minutes, a warning message indicating that the usage time remains 30 minutes may be output to notify the user of the mobile computer 130 of the remaining time.

The mobile computer usage control unit 450 controls to delete the export token stored in the export token storage unit 430 when the mobile computer 130 completes the export use and accesses the internal access network 120 again. The use of the mobile computer 130 is controlled according to an internal security policy set by the security policy setting unit 340 of 110. At this time, if the available time included in the export token has not expired, the mobile computer usage control unit 450 may control the mobile computer 130 to select whether to carry in the company and delete the export token.

The time measuring unit 460 includes a timer function, and transmits the measured time by operating the timer from the time when the export token is received and the export token is received to the mobile computer use control unit 450. At this time, the time measuring unit 460 operates the timer after matching the time of the timer with the time of the security server 110 to synchronize the reference time with the use time information included in the export token. If the time measurement function built in the mobile computer 130 is used to check the usage time of the mobile computer 130, there is a risk that the user of the mobile computer 130 may change the time arbitrarily so as not to limit the usage time. By using the time measured by the time measuring unit 460 itself, the usage time of the mobile computer 130 is measured.

On the other hand, when the user of the mobile computer 130 wants to use the mobile computer 130 by extending the available time allowed by the export token, the agent 400 accesses the security server 110 through an external access network. You can request to issue an emergency key. In this case, the security server 110 only allows limited access for issuing an emergency key for information security, and accesses the computer carrying system of the present invention through an external access network for other tasks in the mobile computer 130. Is not allowed. When the emergency key is issued from the security server 110, the mobile computer 130 can be used for the available time set in the emergency key, and the emergency key once used cannot be reused.

5 is a flowchart illustrating a search method for security of information upon computer export according to a preferred embodiment of the present invention.

As illustrated in FIG. 5, when the mobile computer 130 connected to the company access network 120 is to be exported and used outside, the agent 400 installed in the mobile computer 130 is transferred to the payment server 100. The export of the 130 is requested (S500). The payment server 100 receiving the export request of the agent 400 determines whether to approve the export and generates export approval information for approving the export request of the agent 400 (S502). The payment server 100 stores the export approval information in the payment information database 220, generates an export approval information file including the export approval information, and transmits it to the security server 110 (S504). The security server 110 extracts the export approval information included in the export approval information file transmitted from the payment server 100 and stores it in the export information database 310 to share the export approval information with the payment server 100.

The payment server 100 generating the export approval information transmits the export request result and the export approval information for the export request of the agent 400 to the mobile computer 130 to approve the export request of the agent (S506). The agent 400, which has received the export request from the payment server 100, requests the security server 110 to generate the export token (S508). The security server 110, which is requested to generate the export token from the agent 400, includes information for limiting the use time of the mobile computer 130, information for limiting the use of peripheral devices, etc., by reflecting the security policy of the external use mode. Generate the included export token and transmits it to the mobile computer (130) (S510). The agent 400 receiving the export token changes the operation state of the mobile computer 130 from the in-house use state to the exportable state, and the user of the mobile computer 130 may export the mobile computer 130 to the outside. There is (S512).

6 is a flowchart illustrating a method for controlling the operation of a mobile computer for information security in an agent according to a preferred embodiment of the present invention.

As shown in FIG. 6, the mobile computer 130 approved for export to the outside from the computer export system of the present invention may be exported and used. In order to use the mobile computer 130 exported to the outside, the user of the mobile computer 130 requests the use of the mobile computer 130 to the agent 400 (S600). The agent 400 receiving the use request determines whether there is an export token for authenticating the use of the mobile computer 130 (S602).

When the export token downloaded from the security server 110 is stored in the export token storage unit 430 of the agent 400, the agent 400 decrypts the export token to query the usage time information included in the export token. (S604). The usage time information includes the export start time and the export end time information, and the time interval from the export start time to the export end time becomes the available time. The agent 400 measures the current time by the time measuring unit 460 to determine whether the available time has been exceeded (S606). If the agent 400 does not exceed the available time and determines that the mobile computer 130 is in a usable state, the agent 400 approves the use of the mobile computer 130, and the user of the mobile computer 130 ends the export for work. By the time it is possible to perform the necessary work by using the mobile computer 130 (S608).

Here, whether the usage time of the mobile computer 130 exceeds the available time may be determined as follows.

If the current time measured by the time measuring unit 460 is between the export start time and the export end time, the agent 400 does not exceed the available time and determines that the mobile computer 130 can be used. In order to prevent the time measurement unit 460 from being affected by a timer error or a time change, the following additional conditions may be set to determine whether to approve the use of the mobile computer 130. Accordingly, the agent 400 does not exceed the available time when all of the conditions of Equation 1 to Equation 3 to be described later are not exceeded, and the agent 400 determines that the mobile computer 130 can be used.

Export start time <Current time <Export end time

Nth start time> N-1th end time

Nth usage time <available time

Here, Equation 1 is an equation for determining whether the current time of the mobile computer 130 exceeds the export end time. On the other hand, during the available time, the user of the mobile computer 130 may use the mobile computer 130 several times for work. Therefore, Equation 2 is used to determine whether the timer malfunctions by determining whether the use start time is after the end time of the previous use, and Equation 3 is used when using the mobile computer 130 several times during the available time. The equation for determining whether the usage time of each number has exceeded the available time.

On the other hand, when the export token does not exist in step S602 or when it is determined in step S606 that the available time set in the export token has been exceeded, the agent 400 sets the mobile computer 130 to the locked state and the mobile computer 130. ) And protect the information stored in the mobile computer (130).

The above description is merely illustrative of the present invention, and those skilled in the art to which the present invention pertains may various modifications without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed herein are not intended to limit the present invention but to describe the present invention, and the spirit and scope of the present invention are not limited by these embodiments. It is intended that the scope of the invention be interpreted by the following claims, and that all descriptions within the scope equivalent thereto shall be construed as being included in the scope of the present invention.

As described above, the present invention allows the use of a mobile computer when carrying out a task by carrying out the mobile computer to the outside, and setting whether to permit access to a peripheral device that may leak information contained in the mobile computer. By limiting the usage time of the mobile computer, a person who works outside can utilize the advantages of the mobile computer to increase the work efficiency and protect the internal information of the company stored in the mobile computer.

Claims (15)

A mobile computer on which an agent for information security is installed, a payment server for paying an export request of the mobile computer, a security server for generating an export token and managing the agent, the mobile computer, the payment server, and the A search method for information security when exporting a computer using a system including an internal access network connecting a security server, (a) receiving the export request of the agent at the payment server and generating export approval information for approving the export request; (b) transmitting, at the payment server, the export approval information to the security server, and transmitting the export request result and the export approval information for the export request in step (a) to the agent; And (c) receiving, at the security server, a request for generating the export token of the agent, generating the export token including a security policy for restricting the operation of the mobile computer and transmitting the generated export token to the agent; Search method for information security when the computer export, comprising a. The method of claim 1, The method, (d) changing the operating state of the mobile computer from the in-house use state to the exportable state in the agent; Search method for information security when the computer export, characterized in that it further comprises. The method of claim 1, In step (b), The payment server stores the export approval information in the payment information database of the payment server, generates an export approval information file including the export approval information, and transmits the export approval information file to the security server. And extracting the export approval information included in the export approval information and storing the extracted export approval information in the export information database of the security server. An agent installed on a mobile computer approved for export to the outside from a system including an internal access network, a payment server for approving an export request, and a security server for generating an export token, to secure information on the mobile computer. In the method of controlling the operation, (a) receiving the use request of the mobile computer and determining whether there is the export token downloaded from the security server; (b) querying usage time information included in the export token; And (c) Approving the use of the mobile computer when the usage time of the mobile computer does not exceed the available time included in the usage time information, and when the usage time exceeds the available time, the operating state of the mobile computer. To lock the lock Method for controlling the operation of a mobile computer for information security comprising a. The method of claim 4, wherein In step (c), And determining that the available time is not exceeded when the current time measured by the agent is between an export start time and an export end time. The method of claim 4, wherein Step (c) is, equation Export start time <Current time <Export end time Nth start time> N-1th end time Nth usage time <available time The method of controlling the operation of the mobile computer for information security, characterized in that if the satisfies all of the available time is determined not to exceed. The method of claim 4, wherein In step (c), If the usage time does not exceed the available time, the use of the mobile computer is approved, but the remaining time is obtained by subtracting the use time from the available time by comparing the use time with the available time. And outputting an end-of-export warning message to the mobile computer when it is less than a predetermined time. In the computer export system for information security receiving a request for the export of the mobile computer through the internal access network for performing the export process to the outside, An agent installed in the mobile computer, the agent requesting the export of the mobile computer to receive the export, downloading an export token, and restricting the operation of the mobile computer according to a security policy included in the export token; A payment server configured to generate and store export approval information for approving the export request when receiving the export request of the mobile computer from the agent, and transmit the export request result for the export request and the export approval information to the agent; And Providing the agent to be installed in the mobile computer, receiving and storing the export approval information from the payment server, and when the generation of the export token is requested from the agent, generates the export token and transmits to the agent Security server Computer export system for information security comprising a. The method of claim 8, The agent, An export request processor for requesting the payment of the mobile computer to the payment server and receiving the export request result and the export approval information from the payment server; An export token request processor for requesting generation of the export token from the security server and downloading the export token; An export token storage unit for storing the export token; An export token decryption processing unit for decrypting the export token and inquiring information included in the export token; A mobile computer usage control unit configured to limit the use of the peripheral device according to whether to allow access to the peripheral device included in the export token and to limit the use time of the mobile computer according to the use time information included in the export token; And A time measuring unit having a timer function to measure the use time of the mobile computer and transmit the measured time to the mobile computer use control unit. Computer export system for information security comprising a. The method of claim 8, The payment server, An export request information input unit configured to receive export request information from the agent; An export request approval unit for receiving the payment request information and generating the export approval information; A payment information database for storing the export approval information; An export approval information file generation unit which generates an export approval information file including the export approval information and transmits it to the security server; And Export request result transmission unit for transmitting the export request result and the export approval information to the agent. Computer export system for information security comprising a. The method of claim 8, The security server, An export approval information file receiving unit which receives the export approval information file transmitted from the payment server and extracts the export approval information included in the export approval information file; An export information database for storing the export approval information; An export token generator configured to generate the export token using the export approval information; An export token encryption processing unit encrypting the export token and transmitting the encrypted token to the agent; And Security policy setting unit for setting and changing the security policy applied to the mobile computer in the security server Computer export system for information security comprising a. The method of claim 8, The security server encrypts the export token by public-key cryptography and sends it to the agent, wherein the agent decrypts the encrypted export token to query the information contained in the export token. A computer export system for information security. The method of claim 8, The information stored in the export token includes usage time information including an export start time and an export end time, and information for setting the accessibility of the mobile computer to peripheral devices including a communication modem, a LAN card, a removable disk, and a printer. Computer export system for information security, characterized in that it comprises external security setting information, user information, biller information and reason for export. The method of claim 8, The security server issuing the emergency key to extend the available time included in the export token when the agent of the mobile computer exported to the outside requests the issuance of the emergency key to the security server through an external access network. Computer export system for information security, characterized in that the transmission to the agent. The method of claim 8, The agent receives and processes the selection of whether the mobile computer is imported and whether the deletion of the export token is input so that the mobile computer is brought in and connected to the internal access network even before the available time included in the export token expires. Computer export system for information security, characterized in that.

Images