KR100834715B1 - Security system and method - Google Patents

Abstract

The present invention relates to a security system and method, wherein the system is based on a user terminal including an application that can inquire customer information and an inquiry log generation module that generates an inquiry log when the customer information is inquired, and an inquiry log. And generating an inquiry signal by generating the inquiry data and determining whether the inquiry data satisfies a predetermined condition. According to the present invention, by generating an inquiry log or an event signal according to the inquiry of the customer information of the internal user and issuing an alarm, a security officer can take appropriate measures to prevent leakage of customer information.

Security system, customer information database, query log database, analysis server, monitor server, query log, event

Description

Security system and method {SECURITY SYSTEM AND METHOD}

1 is a block diagram of a security system according to an embodiment of the present invention.

2 and 3 are examples of screens for querying customer information in the user terminal of FIG. 1.

4 is a flow chart showing the operation of the security system shown in FIG.

5 is a block diagram of a security system according to another embodiment of the present invention.

6 is a flowchart illustrating the operation of the security system shown in FIG.

7 is a block diagram of a security system according to another embodiment of the present invention.

8 is a flowchart illustrating the operation of the security system shown in FIG.

<Description of Drawing>

100: customer information database, 200: communication network,

300, 350, 360: user terminal, 310, 311, 312: application,

320, 322: query log generation module, 330, 332: event generation module,

400: query log storage database,

500: analytics server, 510: event collection server,

520: collection and analysis server, 600, 610, 620: monitor server

The present invention relates to a security system and method.

Recently, as a communication network such as the Internet and its application technology are developed, services performed offline are easily provided to a user through the Internet. In addition, Internet service types are also diversified, such as e-commerce, Internet banking, electronic advertising, Internet phones, and Internet games. Accordingly, Internet service is rapidly emerging as the most important business.

A user who wants to receive the Internet service submits his or her personal information such as his / her name, social security number, member ID, password, etc. to the Internet service provider, becomes a member through a predetermined procedure, and becomes a member. On the other hand, the service provider stores the member's personal information in the database, utilizes the member's personal information in various ways, and provides the Internet service to the member.

Recently, customer information has been leaked from online game providers and financial institutions, causing social problems. Since personal information is likely to be misused if it is leaked to a third party, service providers use various methods to prevent the leakage of customer information stored in the database. These methods focus primarily on protecting the database from external intrusions.

However, it is necessary to prevent the leakage of customer information by internal users because it is more frequently leaked by internal users of service providers than when the customer information is leaked by external intrusions. To do this, there is a way to keep an inquiry record and investigate it when internal users query the database. However, according to this method, it is difficult to immediately respond to the leakage of customer information, it is easy to be used only for post-audit, and it is difficult to cope when the internal user leaks the customer information using a normal application such as a customer consultation program.

Accordingly, an aspect of the present invention is to provide a security system and method that can effectively prevent the leakage of customer information from internal users.

A security system according to an aspect of the present invention for achieving the technical problem, a user including an application that can query the customer information and the inquiry log generation module for generating an inquiry log when the customer information inquires in the application And a terminal and an analysis server generating inquiry data based on the inquiry log, and determining whether the inquiry data satisfies a predetermined condition and generating an alarm signal.

The inquiry data includes a number of times that the customer information is queried from a predetermined time point, a number of times the customer information is queried for a specific customer from the predetermined time point, the number of the customer information queried from the predetermined time point, and a time when the customer information is queried. It may include at least one.

The predetermined condition includes a first condition in which the number of times of inquiry of the customer information is greater than or equal to a first reference value, a second condition in which the number of times of inquiry of customer information for the specific customer is greater than or equal to a second reference value, and a third number in which the number of the inquired customer information is greater than or equal to a third reference value. A condition and a fourth condition in which the customer information inquiry time is out of a reference time.

The monitor server may further include a monitor server that receives the alarm signal from the analysis server and issues an alarm.

The monitor server may adjust at least one of the first to third reference values and the reference time.

The inquiry log generating module may further include an inquiry log storage database that receives and stores the inquiry log.

The inquiry log may include at least one of a user ID, an IP address of the user terminal, an inquiry time, a search condition, and the number of inquired customer information.

The analysis server may determine whether the predetermined condition is satisfied by generating the inquiry data for each user ID or IP address of the user terminal.

The user terminal may further include an event generation module generating an event signal when a specific function is executed in the application program.

The specific function may include a function of downloading the customer information as a file.

The analysis server may generate the alarm signal based on the event signal.

According to another aspect of the present invention, a security system includes a user terminal including an application program capable of processing customer information and an event generation module generating an event signal when a specific function is executed in the application program, and the event signal. And an event collection server for generating an alarm signal based on the result.

The specific function may include at least one of a function of downloading the customer information as a file, a function of copying, a function of deleting, and a function of modifying.

The monitor may further include a monitor server that receives the alarm signal from the event collection server and issues an alarm.

According to another aspect of the present invention, a security method includes: querying customer information; generating an inquiry log when the customer information is inquired; generating inquiry data based on the inquiry log; Determining whether the data is satisfied, and generating an alarm signal when the inquiry data satisfies the predetermined condition in the determining step.

The method may further include generating an event signal when the customer information is downloaded as a file.

The generating of the alarm signal may include generating the alarm signal based on the event signal.

According to another aspect of the present invention, a security method includes processing customer information, generating an event signal when a specific function is executed in the processing step, and generating an alarm signal based on the event signal; The specific function may include at least one of a function of downloading the customer information as a file, a function of copying, a function of deleting, and a function of modifying.

A computer readable medium according to another aspect of the present invention records a program for causing a computer to execute any of the above methods.

DETAILED DESCRIPTION Embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

First, a security system according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 3.

1 is a block diagram of a security system according to an embodiment of the present invention, Figures 2 and Figure 1 is an example of a screen for querying customer information in the user terminal of FIG.

As shown in FIG. 1, a security system according to an exemplary embodiment of the present invention includes a customer information database 100, a plurality of user terminals 300, and an inquiry log storage database 400 connected through a communication network 200. , An analysis server 500, and a monitor server 600 connected to the analysis server 500.

The customer information database 100 is connected to an Internet service system (not shown) capable of playing Internet games, Internet banking, e-commerce, etc., and personal information of a user who receives an Internet service (hereinafter, referred to as customer information). Remember) Customer information includes basic personal information such as name, social security number, address, telephone number, user identification, password, etc. Depending on the type of service, service usage history, credit card number, past purchase history, height, weight, health information , Income, membership level, anniversary, etc. The customer information database 100 provides the customer information stored in accordance with the request of the service system to the service system. In addition, the customer information database 100 provides the customer information to the user terminal 300 in response to a request from the user terminal 300.

The communication network 200 does not select a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), the Internet, and the like. It doesn't matter what type of communication you have.

The user terminal 300 includes an application program 310 capable of inquiring customer information and an inquiry log generation module 320. Here, the user using the user terminal 300 refers to an internal user who provides an Internet service, not an external user who receives an Internet service from a service system, and accesses the customer information database 100 to query customer information. I have authority. The user terminal 300 is provided with memory means such as a laptop computer, a workstation, a palmtop computer, a personal digital assistant (PDA), a web pad, a mobile communication terminal, as well as a desktop computer, and includes a microprocessor. It can be made of a terminal equipped with a computing power.

The application 310 is installed in the user terminal 300, and accesses the customer information database 100 through the communication network 200 in accordance with the user's operation to query the customer information stored therein. The search result is then displayed on the user terminal 300. The application 310 may have various functions in addition to the above. The application 310 may include, but is not limited to, a customer counseling program of a customer service center, a developer development program, an advertiser counseling work program, a bank teller work program, and the like. This may also be the case.

The application 310 specifies each user to enter their unique identification into the application 310, for example, an employee number, and to specify which user uses the application 310 to look up customer information. To be able. In contrast, when a plurality of users use a common ID, it is possible to specify which user terminal 300 inquires customer information by referring to an IP address (internet protocol address) of each user terminal 300.

2 shows, as an example of the application program 310, a member inquiry screen of a customer consultation program called an integrated information management system. As shown in FIG. 2, the customer information database 100 may be searched by inputting a member's ID, name, social security number, email address, and the like on the inquiry screen. The search result displays the member's customer information. 3 shows a member search result screen in which the member ID is set as 'test123'. The search result screen displays customer information such as ID, name, social security number, member classification, telephone number, and address.

On the other hand, a large amount of customer information can be inquired by entering wildcards such as '?' Or '*' in each field in the search screen, or a large amount of customer information can be inquired by specifying a search condition separately. As a search condition, for example, a member having the same name, a member having the same birthday, a member having the same membership grade, or a member who has registered as a member between designated periods and the like. You can also search for all members.

The inquiry log generation module 320 generates the inquiry log according to the customer information inquiry of the application 310 and transmits the inquiry log to the inquiry log storage database 400. The inquiry log may be generated whenever the user inquires customer information in the application 310. The inquiry log may include a user ID for inquiring customer information, an IP address of the user terminal 300, an inquiry time, an inquiry condition, and the number of inquired customer information.

The inquiry log generation module 320 is a script execution code that can be generated in various programming languages. The query log generation module 320 may be downloaded from the service system and installed in the user terminal 300, but may be implemented as one program together with the application 310. It may be.

The inquiry log storage database 400 receives and stores the inquiry log from the inquiry log generation module 320 of each user terminal 300, and stores the inquiry log stored at the request of the analysis server 500. To provide. Of course, the inquiry log may be transferred from the inquiry log generation module 320 to the analysis server 500 directly through the communication network 200.

The analysis server 500 reads the inquiry log from the inquiry log storage database 400 in real time, classifies it by each user ID, and calculates or extracts inquiry data related to customer information inquiry for each user ID. Then, it is determined whether the inquiry data meets a predetermined condition, and when the predetermined condition is met, an alarm signal is generated and the generated alarm signal is transmitted to the monitor server 600. That is, the analysis server 500 analyzes the read inquiry log to determine whether the user's customer information inquiry is a normal inquiry or an abnormal inquiry, and if it is an abnormal inquiry, generates an alarm signal to inform that the customer information may leak.

The inquiry data includes the number of times the user has inquired the customer information from a predetermined time point, the number of times the customer information has been inquired with respect to a specific customer, the number of the inquired customer information, and the inquiry time. Here, the predetermined time point may be determined as the start time of the business time, but may be set to an arbitrary time as needed, or may be determined as the start time of the business time of the beginning of the week or the beginning of the month when the inquiry data is calculated and determined on a weekly or monthly basis.

Predetermined conditions and judgments thereof may be described by using the following examples, but the present invention is not limited thereto, and the condition may be set to correspond to an abnormal inquiry when the user information inquiry of the user deviates from a normal average degree.

First, the analysis server 500 may generate an alarm signal by determining whether the number of times of inquiry of the customer information of the user is greater than or equal to the first reference value. For example, if the average number of customer information inquiries is 100 per counselor per day in a counseling center, and a user's number of customer information inquiries reaches 200, an alarm signal may be generated by determining that the customer information has been queried abnormally. As such, if the user makes a considerable number of inquiries as compared to the normal inquiries, it may be determined that the inquiries are abnormal.

For example, the first reference value may be set to a value obtained by adding a predetermined value or multiplying a predetermined ratio to the number of average daily customer information inquiries per user. Alternatively, a predetermined value may be added to the number of times of searching for the average customer information per user or the previous month, or multiplied by a predetermined ratio, or may be set to an arbitrary value.

The analysis server 500 may generate an alarm signal by determining whether the customer information inquiry frequency for any one customer is greater than or equal to the second reference value. For example, in a customer service center, it is unlikely that an agent will consult with a customer multiple times. Therefore, if a user inquires the customer information about the customer more than the reference, it can be determined that the abnormal inquiry.

Meanwhile, the analysis server 500 may generate an alarm signal by determining whether the number of the inquired customer information is greater than or equal to the third reference value. If the number of customer information is more meaningful than the number of inquiries, such as when a user inquires a large amount of customer information through a condition search, etc. can do.

In addition, the analysis server 500 may generate an alarm signal by determining whether the time when the user inquires the customer information is out of the reference time. The reference time may be determined by the business hours of the company providing the service system, but may be set to another time as needed. For example, in a place such as a counseling center, a user who is an agent does not need to inquire customer information outside of business hours, and thus, if the counselor inquires customer information outside of business hours, it may be determined that an abnormal inquiry is made.

Although it has been described as generating an alarm signal by determining whether the inquiry data for each user ID satisfies a predetermined condition, the alarm signal is determined by determining whether the inquiry data for each IP address of the user terminal 300 satisfies a predetermined condition instead of the inquiry data for each user ID. In this case, each reference value may have a different value.

Meanwhile, the analysis server 500 transmits the corresponding user ID, the IP address of the corresponding user terminal 300, and the inquiry data to the monitor server 600 together with the alarm signal, and separately the alarm signal according to the request of the monitor server 600. Inquiry data may be transmitted for a user who is irrelevant.

The monitor server 600 receives an alarm signal and related data from the analysis server 500 and displays the alarm signal and related data on the screen or issues an alarm such as to sound an alarm so that the security officer can know. In addition, the monitor server 600 has a computer and telephony integration (CTI) function, and when receiving an alarm signal from the analysis server 500 may transmit a message to a security officer through a wired or wireless telephone. The security officer can then alert the user or take appropriate action.

Separately, the monitor server 600 may request and display the inquiry data for each user by requesting the analysis server 500. The analysis data related to the inquiry of the customer information may be displayed using the inquiry data from the analysis server 500. For example, the average daily number of views and the average number of monthly views can be calculated. The security officer may adjust the first to third reference values or adjust the reference time with reference to the analysis data. That is, when the security officer inputs new first to third reference values and reference time to the monitor server 600, the monitor server 600 transmits them to the analysis server 500, and the analysis server 500 receives the predetermined conditions. Reflect on. Thereafter, the analysis server 500 determines whether the inquiry of the customer information of the user is abnormal according to the new first to third reference values and the reference time.

The monitor server 600 may be integrated with the analysis server 500 and implemented as one.

Next, an operation of the security system according to an embodiment of the present invention will be described in detail with reference to FIG. 4 along with FIG. 1.

4 is a flow chart showing the operation of the security system shown in FIG.

First, the user launches the application 310 and inputs his user ID and password to specify the user. Then, the user accesses the customer information database 100 using the application 310 to query the customer information (S710). Then, the inquiry log generation module 320 generates an inquiry log (S720) and transmits it to the inquiry log storage database 400.

Inquiry log storage database 400 stores the inquiry log transmitted from the inquiry log generation module 320 of each user terminal 300 (S730). The analysis server 500 reads the inquiry log in real time from the inquiry log storage database 400 to generate inquiry data for each user ID or for each user terminal 300 (S740), and whether the inquiry data satisfies a predetermined condition. It is determined (S750). If the determination result satisfies a predetermined condition, that is, if it is determined that the user information inquiry is abnormal inquiry (S760), generates an alarm signal and transmits to the monitor server 600. If it is determined that the predetermined condition is not satisfied, that is, it is determined that the user information inquiry is normal inquiry, the operation returns.

The monitor server 600 receives an alarm signal from the analysis server 500 and issues an alarm (S770) to notify the security officer.

As described above, according to the security system according to the present embodiment, an inquiry log is generated in real time with respect to the inquiry of customer information and an inquiry signal is generated for each user, and an alarm signal is generated according to whether a predetermined condition is satisfied. Can be informed to the security officer, thereby preventing the leakage of customer information.

Next, a security system according to another embodiment of the present invention will be described in detail with reference to FIG. 5. Parts substantially the same as those described in the previous embodiment are given the same reference numerals and detailed description thereof will be omitted. Many of the features of the security system of FIGS. 1-4 described above can also be applied to the security system of this embodiment.

5 is a block diagram of a security system according to another embodiment of the present invention.

As shown in FIG. 5, another security system according to another embodiment of the present invention includes a customer information database 100, a plurality of user terminals 350, an event collection server 510, and a communication system 200 connected through a communication network 200. And a monitor server 610 connected to the event collection server 510.

Each user terminal 350 includes an application program 311 and an event generation module 330 that can process customer information. A user using the user terminal 350 may be an internal user who provides a service system. For example, a system administrator, a data administrator, a system developer, a database administrator, a user having root authority, a system supervisor, and the like may be used. . These users are not only authorized to access the customer information database 100 to query the customer information, but also to perform various functions such as copying, deleting, and modifying the customer information.

The application program 311 may be installed in the user terminal 350 and may access the customer information database 100 through the communication network 200 and process the customer information stored therein according to a user's manipulation. The application program 311 has a function for inquiring customer information, and can download the inquired customer information as a file. In addition, the application program 311 has a function of accessing the customer information database 100 to copy, modify or delete the customer information. Each user may input his or her user ID and use the application 311, and execute a corresponding function by pressing an execution button, clicking a mouse, or entering a command provided in the application 311. The application 311 may be an operating system of the user terminal 350.

The event generation module 330 is installed in the user terminal 350 to generate an event signal in real time and transmit the event signal to the event collection server 510 when a specific function related to customer information is performed in the application program 311. That is, the event generation module 330 uses an execution button provided in the application 311 in order for a user to search a large amount of customer information or download a file or copy, modify, and delete customer information from the user terminal 350. Pressing or clicking a mouse or entering a command detects it and generates an event signal. In addition, the event generation module 330 may transmit the user ID associated with the event signal generation, the IP address of the user terminal 350, the cause of generating the event signal, etc. together with the event signal to the event collection server 510.

The event generation module 330 may be installed in the user terminal 350 as a separate program, but may be inserted in the application program 311 as program code.

When the event collection server 510 receives an event signal and related data from the event generation module 330 of each user terminal 350, the event collection server 510 generates an alarm signal in real time and transmits the generated alarm signal to the monitor server 610.

When the monitor server 610 receives an alarm signal and related data from the event collection server 510, the monitor server 610 issues an alarm such as displaying it on a screen or ringing an alarm so that the security officer can know. On the other hand, when the user is granted permission in advance and executes a specific function, if the permission is stored in the monitor server 610 and the user executes a specific function authorized, the alarm may not be issued. However, it is very dangerous for a user to download a large amount of customer information to a file and copy, delete, or modify it without permission, and if this happens, the security officer can send a warning message to the user or Appropriate measures may be taken, such as blocking access to the customer information database 100.

The operation of the security system according to an embodiment of the present invention will now be described in detail with reference to FIG. 6 along with FIG. 5.

6 is a flowchart illustrating the operation of the security system shown in FIG.

First, the user launches the application 311 and inputs his user ID and password to specify the user. The event generation module 330 monitors whether the application 311 accesses the customer information database 100 to execute a specific function related to the customer information (S713). When a user executes a specific function related to customer information by pressing an execution button or clicking a mouse or inputting a command included in the application 311 (S723), the event generation module 330 generates an event signal (S733). ). Then, the generated event signal, the corresponding user ID, the IP address of the user terminal 350, and data indicating which function is executed are transmitted to the event collection server 510.

The event collection server 510 generates an alarm signal when receiving the event signal (S743) and transmits the alarm signal to the monitor server 610, and the monitor server 610 receives the alarm signal from the event collection server 510 and issues an alarm ( S753) Notify the security officer.

As described above, according to the security system according to the present embodiment, when a user views or downloads a large amount of customer information, an event signal may be generated and an alarm may be notified to a security officer, thereby preventing the leakage of customer information in advance. . The security system according to the present embodiment is effective when it is difficult for a user to leave an inquiry log when a user views a large amount of customer information, and even if a user leaves an inquiry log, it is not known which customer information has been viewed or the number of the inquired customer information. Effective when unknown. In addition, the security system according to the present embodiment can generate an event signal and issue an alarm when the user arbitrarily processes, such as copying, modifying or deleting customer information, so that the security officer can take appropriate measures.

Next, a security system according to another embodiment of the present invention will be described in detail with reference to FIG. 7. Parts substantially the same as those described in the previous embodiment are given the same reference numerals and detailed description thereof will be omitted. Many of the features of the security system of FIGS. 1-6 described above can also be applied to the security system of this embodiment.

7 is a block diagram of a security system according to another embodiment of the present invention.

As shown in FIG. 7, another security system according to another embodiment of the present invention includes a customer information database 100, a plurality of user terminals 360, and an inquiry log storage database 400 connected through a communication network 200. , A collection and analysis server 520, and a monitor server 620 connected to the collection and analysis server 520.

Each user terminal 360 includes an application program 312 capable of inquiring customer information, an inquiry log generation module 322, and an event generation module 332.

The application 312 is installed in the user terminal 360, can access the customer information database 100 through the communication network 200 in accordance with the user's operation to query the customer information stored therein, and the result Is displayed on the screen of the user terminal 360. The application 312 may query customer information in various ways, and may download a large amount of customer information into a file.

The inquiry log generation module 322 generates an inquiry log according to the customer information inquiry of the application program 312 and transmits the inquiry log to the inquiry log storage database 400.

The event generation module 332 generates event signals in real time and transmits them to the collection and analysis server 520 when a specific function is performed in the application program 312. An example of a particular function is downloading a large amount of customer information to a file. This is the case when it is difficult to leave an inquiry log when processing customer information, or even when leaving an inquiry log, it is not possible to know which customer information is queried or the number of queried customer information is unknown.

The collection and analysis server 520 reads the inquiry log from the inquiry log storage database 400 in real time, classifies it by each user ID, and calculates or extracts inquiry data related to customer information inquiry for each user ID. Then, it is determined whether the inquiry data satisfies the predetermined condition, and when the predetermined condition is satisfied, the alarm signal is generated and the generated alarm signal and the inquiry data are transmitted to the monitor server 620. Description related to the predetermined condition is substantially the same as described in the previous embodiment, so a detailed description thereof will be omitted. The collection and analysis server 520 generates an alarm signal in real time when the event signal and the related data are received from the event generation module 332 of each user terminal 360, and monitors the data related thereto with the alarm signal. To send).

The monitor server 620 receives the alarm signal and the inquiry data or the data related to the event signal from the collection and analysis server 520, and displays an alarm signal or sounds an alarm, so that the security officer can know.

Next, an operation of the security system according to an exemplary embodiment of the present invention will be described in detail with reference to FIG. 8 along with FIG. 7.

8 is a flowchart illustrating the operation of the security system shown in FIG.

First, the user launches the application 312 and inputs his user ID and password to specify the user. Then, the user accesses the customer information database 100 using the application 312 to query the customer information (S715).

The event generation module 332 monitors the application program 312 and determines whether a specific function is executed in the application program 312 (S725). If it is determined that the specific function is executed, the event signal is generated (S795) and transmitted to the collection and analysis server 520. Accordingly, the collection and analysis server 520 generates an alarm signal (S775) and transmits it to the monitor server 620. The monitor server 620 receives an alarm signal from the collection and analysis server 520 and issues an alarm (S785).

On the other hand, in the case of inquiry of general customer information rather than a specific function, the inquiry log generation module 322 generates an inquiry log (S735) and transmits the inquiry log to the inquiry log storage database 400. Inquiry log storage database 400 stores the inquiry log transmitted from the inquiry log generation module 322 of each user terminal 360 (S745). The collection and analysis server 520 reads the inquiry log from the inquiry log storage database 400 in real time to generate inquiry data for each user ID or for each user terminal 360 (S755), and the inquiry data sets a predetermined condition. Determine whether it meets (S765). If it is determined that the predetermined condition is satisfied, i.e., if the inquiry of the customer information of the user is abnormal, the alarm signal is generated (S775) and transmitted to the monitor server 620. The monitor server 620 receives an alarm signal from the collection and analysis server 520 and issues an alarm (S785) to notify the security officer. If it is determined that the predetermined condition is not satisfied, i.e., it is determined that the user information inquiry is a normal inquiry, the operation returns.

As described above, according to the security system according to the present embodiment, an inquiry log and inquiry data are generated in real time according to general user information inquiry of a user, and an alarm signal is generated according to whether a predetermined condition is met to notify the security officer of an abnormal inquiry of the user. As a result, customer information leakage can be prevented in advance. In addition, when a specific function for customer information inquiry is executed, an event signal can be generated and an alarm can be prevented in advance to prevent the leakage of customer information.

The security system according to an embodiment of the present invention can be applied to customer consultation work systems, advertiser consultation work systems, information management systems, web management systems of banks, Internet shopping malls, telecommunication companies, portals and game companies, and handles personal information of customers. Applicable to all systems.

Embodiments of the invention include a computer readable medium containing program instructions for performing various computer-implemented operations. This medium records a program for executing the method of operation of the security system described above. The media may include, alone or in combination with the program instructions, data files, data structures, and the like. Examples of such media include, but are not limited to, magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CDs and DVDs, floppy disks and magnetic-optical media, programs such as ROM, RAM, flash memory, and the like. Hardware devices configured to store and execute instructions. Alternatively, the medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

As described above, according to the present invention, by generating an inquiry log or an event signal according to the inquiry of the customer information of the internal user and issuing an alarm, a security officer can take appropriate measures to prevent leakage of customer information.

Claims (21)

An application that can inquire customer information, the inquiry log generation module for generating an inquiry log when the customer information is inquired by the application and an event generation module for generating an event signal when a specific function is executed in the application; User terminal, and An analysis server generating inquiry data based on the inquiry log, generating an alarm signal by determining whether the inquiry data satisfies a predetermined condition, and generating an alarm signal based on the event signal; Including, The specific function may include at least one of a function of downloading the customer information as a file, a function of copying, a function of deleting, and a function of modifying. Security system. In claim 1, The inquiry data includes a number of times that the customer information is queried from a predetermined time point, a number of times the customer information is queried for a specific customer from the predetermined time point, the number of the customer information queried from the predetermined time point, and a time when the customer information is queried. Security system comprising at least one. In claim 2, The predetermined condition includes a first condition in which the number of times of inquiry of the customer information is greater than or equal to a first reference value, a second condition in which the number of times of inquiry of customer information for the specific customer is greater than or equal to a second reference value, and a third number in which the number of the inquired customer information is greater than or equal to a third reference value. A condition and at least one of a fourth condition in which the customer information inquiry time is out of a reference time. In claim 3, And a monitor server that receives the alarm signal from the analysis server and issues an alarm. In claim 4, And the monitor server may adjust at least one of the first to third reference values and the reference time. In claim 1, And an inquiry log storage database which receives and stores the inquiry log from the inquiry log generating module. In claim 1, And the inquiry log includes at least one of a user ID, an IP address of the user terminal, an inquiry time, a search condition, and the number of inquired customer information. In claim 7, And the analysis server generates the inquiry data by the user ID or the IP address of the user terminal to determine whether the predetermined condition is satisfied. delete delete delete delete delete delete A security method of a security system including a user terminal and an analysis server, Querying customer information by the user terminal; Generating an inquiry log when the user terminal inquires the customer information; Generating an event signal when the user terminal executes a specific function on the customer information; Generating, by the analysis server, inquiry data based on the inquiry log; Determining, by the analysis server, whether the inquiry data meets a predetermined condition, and Generating, by the analysis server, an alarm signal when the inquiry data meets the predetermined condition in the determining step, and generating an alarm signal based on the event signal. Including, The specific function may include at least one of a function of downloading the customer information as a file, a function of copying, a function of deleting, and a function of modifying. Security method. The method of claim 15, The inquiry data includes a number of times that the customer information is queried from a predetermined time point, a number of times the customer information is queried for a specific customer from the predetermined time point, the number of the customer information queried from the predetermined time point and a time when the customer information is queried Security method comprising at least one. The method of claim 16, The predetermined condition includes a first condition in which the number of times of inquiry of the customer information is greater than or equal to a first reference value, a second condition in which the number of times of inquiry of customer information for the specific customer is greater than or equal to a second reference value, and a third number in which the number of the inquired customer information is greater than or equal to a third reference value. A condition and at least one of a fourth condition in which the customer information inquiry time is out of a reference time. delete delete delete A computer readable medium having recorded thereon a program for causing a computer to execute the method of any one of claims 15 to 17.

Images