KR100939106B1 - Method for preventing unauthorized copies of data stored in removable storage apparatus and system adapted to the same - Google Patents

Abstract

The present invention relates to a removable storage device and a system using the same, and more particularly, to prevent unauthorized internal users from intentionally or unintentionally leaking data stored in the removable storage device to the outside, The present invention relates to a system for receiving a history of use of information stored in a removable storage device and performing a post-security audit.

In the random copy protection method of the data stored in the removable storage device according to the present invention, when a user accesses a removable storage device storing a data file to a computer, the stored data file is loaded by driving a dedicated browser embedded in the removable storage device. And if the user generates an event to transmit the loaded data file to the outside of the removable storage device, blocking the execution of the event.

Removable Storage, Flash Memory, Security, Playout, Blocking

Description

Method for preventing unauthorized copies of data stored in removable storage apparatus and system adapted to the same}

The present invention relates to a removable storage device and a system using the same, and more particularly, to prevent unauthorized internal users from intentionally or unintentionally leaking data stored in the removable storage device to the outside, The present invention relates to a system for receiving a history of use of information stored in a removable storage device and performing a post-security audit.

BACKGROUND OF THE INVENTION Information stored in computers are stored on portable storage devices through a universal serial bus (USB) or a serial interface (IEEE1394) of the American Institute of Electrical and Electronics Engineers. In particular, as the storage capacity of the mobile storage device is increased in size and the information transmission speed is improved, a large amount of information can be easily and quickly transferred from the computer to the mobile storage device and stored.

On the other hand, due to the emergence of such removable storage device is increasing the security risks for the leakage of confidential information inside the enterprise. In order to solve this problem, conventionally, a security problem is required by requiring password authentication when storing or storing information in a portable storage device or password authentication when encrypting and storing and decrypting information on a removable storage device. Doing.

However, this method can prevent the information stored in the removable storage device from leaking out if the user who has access to the removable storage device is lost or stolen, but the normal use of the removable storage device is prevented. In the case of malicious information leakage by an authorized user, that is, an internal user, the internal user already knows the password, so it is not useful.

In addition, in the past, when illegal information leakage occurred by an internal user, the information leakage status could not be checked in real time, so that it was not possible to immediately respond to a security problem, and a person who could access specific security information was assigned to a position or authority. By classifying accordingly, there is a problem that a practical solution for preventing information leakage can not be provided when a password is known as an illegal method.

The technical problem to be achieved by the present invention is to prevent random copying of data to prevent illegal information leakage of the user inside the company / organization by blocking and managing the transmission of the information stored in the removable storage device and a suitable removable storage device To provide.

Another technical problem to be solved by the present invention is to post-security audit by managing the usage history of the information stored in the removable storage device to the system when an attempt is made to transmit the information stored in the removable storage device to the outside by an internal user. It is to provide an information leakage monitoring system and a method suitable for this.

Data random copy prevention method according to the present invention for solving the above technical problem,

When the user connects the removable storage device storing the data file to the computer, driving the dedicated browser embedded in the removable storage device to load the stored data file, and storing the loaded data file by the user. When generating an event to be sent out of the device, characterized in that it comprises the step of blocking the execution of the event.

Information leakage monitoring system according to the present invention for solving the technical problem,

Display the internally stored data file through the built-in dedicated browser, determine whether to execute the event when an external transmission related event occurs for the displayed data file, and generate a log of the external transmission related event that occurred. Removable storage device is installed to store the first agent application, the security policy related to the setting of the event to the removable storage device, and transmits the data file stored therein to the removable storage device includes a unique management number And store information about the removable storage device and the computer and the user who uses them, the agent computer having a second agent application installed therein for inserting a tag and delivering a log of usage history of the data file to a management server. Create a policy Distributed to the portable storage device, it characterized in that it receives a log of the use history including the management server, the management, analysis, and reporting server application that is installed.

Information leakage monitoring method according to the present invention for solving the technical problem,

Loading a data file stored in a removable storage device through a dedicated browser provided by security software built in the removable storage device; and when an event occurs to transmit the stored data file to the outside of the removable storage device, the event is generated. Determining whether the event corresponds to a preset prohibition event, as a result of determination, the execution of the event is blocked in the case of the prohibition of the event, and if the event does not correspond to the prohibition event, the data file transmission history in the removable storage device Generating a log relating to the data file transmission history, and transmitting the generated log to the management server when a communication environment is established between the mobile storage device and the management server. .

The random copy prevention method according to the present invention, even if the illegal copy is made by a user inside the company with a normal use rights, the data stored in the removable storage device can not be sent to other storage media, the confidentiality of the company There is an effect that can prevent the information from being widely distributed among economic companies.

In addition, the information leakage prevention system according to the present invention, each time the user inside the company attempts to leak information stored in the removable storage medium to the outside, by creating a usage log for this report to the management server, the information of each user It is possible to monitor the leakage behavior, thereby preventing information leakage accidents in advance.

In order to fully understand the present invention, the operational advantages of the present invention, and the objects attained by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents described in the drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, if it is determined that the detailed description of the related well-known configuration or function may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a view showing a removable storage device according to the present invention.

The removable storage device 100 according to the present invention includes a security area 110 in which security software is installed and a memory area 120 in which data files are stored. The security area 110 is an area which is inaccessible by a general user, and security software according to the present invention is installed in the security area when the removable storage device 100 is manufactured.

Meanwhile, the removable storage device 100 includes a flash memory or a hard disk, and is connected to a computer through a universal serial bus (USB) or a serial interface (IEEE1394) standard established by the American Institute of Electrical and Electronics Engineers. As an information storage device, a portable device is shown.

2 is a flowchart illustrating an embodiment of a method for preventing random copying of data according to the present invention.

A removable storage device having security software installed thereon is connected to the computer (210). Removable storage devices connected to a computer are recognized and set by a plug and play method. In particular, the process is set up so that the security software in which the computer is installed in the security zone is recognized first.

The security software prevents the data stored in the removable storage device from being displayed even if the default browser (eg, Windows Explorer) provided by the computer operating system required for data loading is executed. In operation 220, a browser is loaded to store the stored data. Dedicated browsers act as a shield against data leakage.

Thereafter, when a specific event occurs, it is determined whether the generated event corresponds to an external transmission-related event (230, 240). The external transmission related event may include an event for storing a data file stored in the removable storage device in another storage medium, an event for transmitting a data file stored in the removable storage device through a network, and the like. Specific types of outgoing events are stored inside removable storage.

If it is determined that the event corresponds to an external transmission, the execution of the event is blocked (250). For example, if you want to copy data stored on a removable storage device to a computer hard disk, make sure that copying is not allowed. The process may be performed without running an application for viewing the data file.

If it is determined that the event does not correspond to an external transmission-related event, execution of the event is not blocked (260). For example, if you want to edit some of the data stored in the removable storage using an application, the editing is allowed. The process may be performed while running an application for viewing a data file.

3 is a flowchart illustrating another embodiment of a method for preventing random copying of data according to the present invention.

The management server sets a security policy on the removable storage device (310). The security policy indicates a type of prohibition of execution and may be applied differently to each removable storage device. For example, the security policy may be a policy that completely prohibits the leakage of data to the outside, or may be a policy that prohibits the leakage of data through the network.

The removable storage device with the security policy set is connected to the computer (320). Thereafter, the storage data is loaded by driving a dedicated browser program embedded in the removable storage device (330). Thereafter, when a specific event occurs, it is determined whether the generated event corresponds to a preset prohibition event (340, 350).

The pre-execution event may vary depending on the security policy applied to each removable storage device. Events you want to save to an external local drive or other removable storage, Events you want to send via e-mail, Events you want to send via IM or P2P, Events you want to save on your web hard disk, Events you want to print via your printer, Events you want to capture your screen It may be at least one of the.

As a result of determination, when the generated event corresponds to a preset execution prohibition event, execution of the event is blocked (360). The process of blocking the execution of the event is a process of not hooking the event execution process. As a result of the determination, when the generated event does not correspond to the preset prohibition event, the event is executed (370).

4 is a view briefly showing an information leakage prevention system according to the present invention.

Referring to FIG. 4, the information leakage prevention system 400 according to the present invention includes a management server 410, a plurality of agent computers 421 to 42n, and a removable storage device connected to each agent computer ( 431-43n). However, a plurality of removable storage devices may be connected to one agent computer.

Agent applications are installed in each of the agent computers 421 to 42n, and similarly, agent applications are also installed in each of the removable storage devices 431 to 43n. The management server 410 communicates with the plurality of agent computers 421-42n, and communicates with the plurality of removable storage devices 431-43n through the agent computers 421-42n.

The management server 410 distributes a security policy to each removable storage device 431 to 43n through each agent computer 421 to 42n, and each removable storage device through each agent computer 421 to 342n. Receives log file of transmission attempt status from (431 ~ 43n). Each agent computer 421-42n serves as a relay.

5 is a view showing in detail the information leakage prevention system according to the present invention.

Referring to FIG. 5, the information leakage prevention system 500 according to the present invention includes a database module 511, a communication module 512, a policy generation module 513, a device management module 514, and a device monitoring module 515. Management server 510, including log storage module 516, and audit reporting module 517, and agent including communication module 521, user authentication module 522, and file management module 523. A computer 520, a communication module 531, a user authentication module 532, a policy authentication module 533, a data control module 534, a barrier generation module 535, and a log generation module 536. Removable storage 530.

The database module 511 is responsible for storing information about a user, information about a removable storage device, and information about an agent computer. The information about the user may include a user ID, a password, and the like, the information about the removable storage device may include a manufacturer, a serial number, and the like, and the information about the agent computer may include a computer management number and the like. can do.

The communication module 512 is responsible for transmitting a security policy to the agent computer and receiving a log from the agent computer. In detail, the communication module 512 transmits the security policy generated by the administrator to the mobile storage device through the agent computer, and receives log information about the usage history stored in the mobile storage device through the agent computer.

The policy generation module 513 is responsible for generating and distributing a policy to be applied to the removable storage device. The security policy may be applied differently for each removable storage device or user, and the security policy created or changed by the administrator is transmitted to the removable storage device through the agent computer.

The device management module 514 is responsible for generating and distributing a unique management number for the removable storage device. The unique management number is different from the serial number recorded on the removable storage device itself, and the management server generates and registers the unique management number of the removable storage device, thereby preventing unauthorized use of the removable storage device.

The device monitoring module 515 is responsible for monitoring policy violation attempts for the removable storage device to which the security policy is applied in real time. If a user attempts to leak the information, he / she reports the date / time of occurrence of the event, the IP address of the computer used, and the data attempted to output in real time through the network to identify the information leakage status.

The log storage module 516 is responsible for storing and managing log information indicating a history of use of the removable storage device. The information stored in the log storage module 516 may be log information received by the device monitoring module 515 in real time through a network or log information stored in a removable storage device transmitted through an agent computer.

The audit report module 517 is responsible for analyzing the log information representing the usage history information for the removable storage device to generate an audit report. In detail, the audit report module 517 displays the information leakage attempt status that occurred by user or by period, by dividing the occurrence date, file name, file type, file capacity, and action history.

The communication module 521 is responsible for transmitting the security policy received from the management server to the removable storage device and transmitting the log received from the agent computer to the management server. When the removable storage device is connected to the agent computer, the user authentication module 522 receives a user ID and a password to determine whether the user is a legitimate user, and is responsible for authenticating the use of the removable storage device according to the determination result.

The file management module 523 is responsible for inserting a tag including a unique management number into each data file sent from the agent computer to the removable storage device, and for recognizing and managing the sent file. The tag is required to create a log of a usage history, and can be checked for possible leakage through management of the sent file.

The communication module 531 is responsible for receiving a security policy from the agent computer and transmitting a usage log to the agent computer. Unlike the user authentication module 522 included in the agent computer 520, the user authentication module 532 is responsible for determining whether there is a legitimate usage right when the removable storage device is connected to an external computer.

The policy authentication module 533 is responsible for receiving a security policy through an agent computer and applying the received security policy. For example, if an existing security policy was to completely prohibit the transmission of stored information, and the new security policy would allow the transmission of stored information to a local drive, Run data control module 534.

The data control module 534 is under the control of the policy authentication module 533, and is responsible for controlling data being sent out of the removable storage device. The data control module 534 corresponds to the security software described with reference to FIGS. 1 and 2, and the execution of the prohibition-execution event set by executing the security software inside the removable storage device is prohibited.

The barrier generation module 535 is responsible for preventing capturing a file whose content of information is displayed due to execution of a related application. For example, when a user browses a word file and attempts to save or print the file contents through a capture program or a print screen, the user may perform a function of creating a barrier on the browsed word file.

When the user attempts to send data stored in the removable storage device to the outside, the log storage unit 536 is responsible for creating and storing a log thereof. The log also includes both allowed and prohibited actions in the security policy. The log is created using a tag added to the header of each data file.

6 is a flowchart illustrating a method of registering user / device information according to the present invention.

A communication environment is established between the management server, the agent computer, and the removable storage device (610). First, the management server is communicatively connected to each agent computer through an internal network environment, and then a removable storage device to be used is connected to the agent computer.

Information about the user and the removable storage device is input (620). User information may include a user ID and password for user authentication. The removable storage device information may include a serial number and a manufacturer. If such information is entered, the management server stores the entered information in an internal database.

The management server generates a unique management number for identifying the removable storage device and transmits the unique management number to the removable storage device through the agent computer (630). The transmitted unique management number is stored in the secure area of the removable storage device. Through this process, the removable storage device used by a specific user can be registered in the management server.

7 is a flowchart illustrating a method of transmitting a data file according to the present invention.

A communication environment is established between the management server, the agent computer, and the removable storage device (710). The setting method of the communication environment is as described above. In operation 720, the management server determines whether the unique management number is a registered mobile storage device. This is to prepare for security problems by using only the removable storage device is installed security software according to the present invention distributed by the company.

In the case of an unregistered removable storage device, it is determined that the removable storage device is not allowed and transmits a message to the agent computer that it cannot be used (730). In this case, the communication environment with the unregistered removable storage device may be blocked. In the case of the registered removable storage device, it is determined whether the user ID and the password match (740). This is to prevent the use of removable storage devices other than their own.

If the user authentication information matches, it enables the use of the removable storage device. Thereafter, it is determined whether an event for sending data from the agent computer to the removable storage device occurs (750). If a data transmission event occurs, a tag including a unique management number is inserted into each of the transmitted data files, and then the data files are transmitted from the agent computer to the portable storage device (760, 770).

8 is a flowchart illustrating a method of preventing information leakage according to the present invention.

If the user attempts to send a data file stored in the removable storage device to the outside, it is determined whether the attempt violates the security policy (810, 815). The security policy may be set differently for each removable storage device.

As a result, if the security policy is violated, the data is blocked from being transferred outside the removable storage device (for example, other than the agent computer), and if the data is not violated, the data is stored outside the removable storage device. Allow to be sent (820,825). For example, it allows you to print the contents of the data.

Thereafter, it is determined whether the computer to which the removable storage device is currently connected is an agent computer (830). Here, the agent computer refers to a computer in which an agent application that is communicatively connected to the management server and which transfers information to the management server is installed.

The computer used herein is a concept that collectively manages an information processing apparatus in which an operating system is installed and an application capable of executing a specific file is not limited to a desk-top, a notebook, a PDA, and the like.

As a result, if the currently connected computer is an agent computer, it is determined whether the internal network is connected, and if the internal network is connected, a log of data transmission attempt is generated and transmitted to the agent computer (840 and 850). The agent computer transmits the transmitted log to the management server (860).

However, when not connected to the internal network, the log generated inside the removable storage device is stored (845), and when the agent computer is connected to the internal network later, the log stored on the removable storage device is transferred to the management server through the agent computer. (840, 850, 855).

As a result of the determination, if the currently connected computer is not the agent computer, it is determined whether the computer is connected to the Internet, and if it is connected to the Internet, a log of data transmission attempt is generated and transmitted to the agent computer through the Internet (850). . The agent computer transmits the transmitted log to the management server (860).

However, if the user is not connected to the Internet, a log generated inside the removable storage device is stored (865), and when the user is electrically connected to an agent computer communicatively connected to the management server (870). The log is transmitted to the management server through the agent computer (850, 855).

9 is a view showing a first interface related to a security policy setting method according to the present invention.

Referring to FIG. 9, an administrator who is a principal of a management server may set and distribute a security policy to be applied to each user by using an interface displayed on a screen. In particular, it is possible to apply the same security policy to a plurality of users at the same time, the security policy may vary according to the user's position and authority.

Meanwhile, an administrator may set different security policies for each user by using the interface, and transmit the applied security policies to each of the removable storage devices. The security policy is delivered to the removable storage device through the agent computer described above. Specific types of security policies will be described later.

10 is a view showing an interface relating to an information leakage monitoring method using a log according to the present invention.

Referring to FIG. 10, when an agent application installed in the removable storage device attempts to send data from the removable storage device to the outside, the agent application creates log information about the data and transmits the log information to the management server. The server application on the management server generates reports by sorting the sent log information by user or by time.

The log information is generated not only when the transmission is authorized by the security policy but also when the transmission is blocked. Therefore, the administrator can easily identify through which audit report the user attempted to leak information at any place and time, thereby preventing the possibility of information leakage in advance.

11 is a view showing a second interface related to a security policy setting method according to the present invention.

Referring to FIG. 11, specific types of security policies are illustrated. For example, outputting a data file stored in a removable storage device may be prohibited or storing data on a local drive may be prohibited. In other words, the removable storage device may prohibit the execution of each event type.

For this reason, the agent application stored inside the removable storage device determines whether an event generated by the current user violates the set security policy according to the security policy sent from the management server, and if it is violated, prevents execution of the information so that the information is stored. Prevents the device from being sent outside the device.

12 is a view showing a capture preventing blocking film according to the present invention.

Referring to FIG. 12, the capture prevention barrier according to the present invention may be performed after reading a stored file using a data file application (for example, a Korean program, a word program, an Excel program, a note pad program) stored in a removable storage device. It is formed when the mouse pointer is out of the frame of the browsed file. Here, the left figure is a view showing a state in which a document created by a notepad program is opened before forming the anti-capture blocking film, and the right figure is a view showing a state after the anti-capturing film is formed.

In the anti-capture blocking film according to the present invention, when the user moves the mouse pointer outside the dedicated browser and clicks another program (whether or not it is a file capture program), the anti-capturing program is automatically executed to form a blocking film on the dedicated browser. . However, if the mouse pointer moves back inside the dedicated browser, the barrier disappears. This is true even when the print screen key on the keyboard is pressed.

The best embodiment has been disclosed in the drawings and specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims.

Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

1 is a view showing a removable storage device according to the present invention.

2 is a flowchart illustrating an embodiment of a method for preventing random copying of data according to the present invention.

3 is a flowchart illustrating another embodiment of a method for preventing random copying of data according to the present invention.

4 is a view briefly showing an information leakage prevention system according to the present invention.

5 is a view showing in detail the information leakage prevention system according to the present invention.

6 is a flowchart illustrating a method of registering user / device information according to the present invention.

7 is a flowchart illustrating a method of transmitting a data file according to the present invention.

8 is a flowchart illustrating a method of preventing information leakage according to the present invention.

9 is a view showing a first interface related to a security policy setting method according to the present invention.

10 is a view showing an interface relating to an information leakage monitoring method using a log according to the present invention.

11 is a view showing a second interface related to a security policy setting method according to the present invention.

12 is a view showing a capture preventing blocking film according to the present invention.

Claims (14)

When the user connects the removable storage device storing the data file to a computer, loading the stored data file by driving a dedicated browser embedded in the removable storage device; And And preventing the execution of the event when the user generates an event to transmit the loaded data file to the outside of the removable storage device. The method of claim 1, wherein blocking the execution of the event comprises: Determining a type of event generated by the user; And And blocking the execution of the event when the determined event type corresponds to a predetermined prohibition of execution event. The method of claim 2, wherein the event, The removable storage device is set by a management server that can be electrically connected, and the random copy data prevention method, characterized in that the type of the prohibition of the execution event can be changed according to the security policy of the management server. The method of claim 2, wherein the event, Events you want to save to an external local drive or other removable storage, Events you want to send via e-mail, Events you want to send via IM or P2P, Events you want to save on your web hard disk, Events you want to print via your printer, Events you want to capture your screen , At least one or more of an event to be transmitted through FTP, an event to be transmitted using a clipboard. The method of claim 4, wherein the blocking of the execution of the event comprises: If the user moves the mouse point out of the file application frame and clicks while the data file stored in the removable storage device is opened, the method may further include forming a protective film for preventing the capture of information displayed on the screen. Method for preventing random copying of data. When the user connects the removable storage device storing the data file to the computer, the user loads the stored data file by driving a dedicated browser embedded in the removable storage device, and And a computer program for executing a method of blocking execution of the event when the user generates an event for transmitting the loaded data file to the outside of the removable storage device. The method of claim 6, wherein the removable storage device, A portable storage device comprising a flash memory or a hard disk and a portable information storage device connected to a computer through a universal serial bus or a serial interface standard established by the American Institute of Electronics and Electrical Engineers. Display the internally stored data file through the built-in dedicated browser, determine whether to execute the event when an external transmission related event occurs for the displayed data file, and generate a log of the external transmission related event that occurred. Removable storage device is installed to store the first agent application; It transmits a security policy related to the setting of the event to the removable storage device, and inserts a tag including a unique management number when sending a data file stored therein to the removable storage device, An agent computer on which a second agent application is installed which forwards logs to a management server; And A server application that stores information about the removable storage device, a computer, and a user who uses them, creates and distributes the security policy to the removable storage device, and receives, manages, analyzes, and reports a log of the usage history. Information leakage monitoring system comprising the installed management server. The method of claim 8, wherein the management server, A communication module in communication with the removable storage device and the agent computer; A policy generation module for generating and distributing a policy to be applied to the removable storage device; A device management module for generating and distributing a unique management number of the removable storage device; A device monitoring module that monitors a usage state of the removable storage device in real time; A log storage module for storing a log of a usage history of the removable storage device; An audit report module for analyzing, auditing, and reporting the stored logs; And And a database module for storing information about the removable storage device, the agent computer, and the user. The method of claim 9, wherein the agent computer, A communication module in communication with the management server and the removable storage device; A user authentication module in charge of authenticating the user; And And a file management module for recognizing and managing a data file transmitted to the removable storage device and inserting a tag into the transmitted data file. The method of claim 9, wherein the removable storage device, A communication module in communication with the management server and the agent computer; A user authentication module in charge of authenticating the user; A policy authentication module for applying a security policy distributed from the management server; A data control module for controlling input / output of the stored data file; A log generation module for generating and storing a log of the usage history; And Information leakage monitoring system comprising a barrier generation module for generating a barrier for preventing file capture. Loading a data file stored in a removable storage device through a dedicated browser provided by security software built in the removable storage device; Determining whether the event corresponds to a preset prohibition event when an event for transmitting the stored data file to the outside of the removable storage device occurs; Blocking the execution of the event when the event corresponds to the prohibition event; and generating a log of a data file transmission history in the removable storage device when the event does not correspond to the prohibition event; And And transmitting the generated log of the data file transmission history to the management server when a communication environment is established between the mobile storage device and a management server. The method of claim 12, wherein the transmitting to the management server comprises: Determining whether a computer electrically connected to the removable storage device is connected to a network capable of communicating with a management server; If it is determined that the network is connected, transmitting the generated log to the management server through the network; and if the network is not connected to the network, storing the generated log in the removable storage device. ; And And transmitting the stored log to the management server through the agent computer when the removable storage device is electrically connected to an agent computer communicating with the management server. The method of claim 13, Determining whether the removable storage device corresponds to a pre-registered device when an agent computer under the control of the management server and the removable storage device are electrically connected; If it is determined that the device does not correspond to the registered device, blocking the communication relationship between the agent computer and the removable storage device and requesting user authentication when the device corresponds to the registered device; And And if the user authentication is approved, allowing the transmission of a data file from the agent computer to the removable storage device.

Images