KR101104300B1 - System of access management comprising exclusive tool for accessing of personal information database and method thereof - Google Patents

Abstract

PURPOSE: An access management system with an exclusive tool for the access of personal information database and a method thereof are provided to improve security for personal information since the exclusive tool should be used for the search and modification of the personal information data. CONSTITUTION: An exclusive tool(10) is installed in a user terminal for the modification of the personal information and forms the SQL(Structured Query Language) for collecting the state before the modification of the personal information, the SQL for the modification, and the SQL for collecting the state after modification of the personal information in the same session. A personal information exclusive management server comprises a database connector(180), an exclusive tool connector(110), a request executing unit, and an inquiry answer unit. The request executing unit successively executes SQL transmitted from the exclusive tool.

Description

SYSTEM AND ACCESS MANAGEMENT COMPRISING EXCLUSIVE TOOL FOR ACCESSING OF PERSONAL INFORMATION DATABASE AND METHOD THEREOF}

The present invention relates to an access management system and method including a dedicated tool for accessing a personal information database, and more particularly, to configure a personal information management server for exclusively managing personal information data and to access the personal information management server. Access management system including a dedicated tool for access to a personal information database that greatly increases the security of personal information data by accessing through the private information management server when searching or manipulating personal information using a tool; and It is about a method.

Personal information generally refers to any information related to an individual's private area, such as identification, judgment, and evaluation of an individual (natural person). Even if the information alone does not recognize a specific individual, it can be easily combined with other information. It is a concept that includes everything that can be recognized.

Examples of such personal information may include a name indicating an individual's identity, a social security number, an address, an educational background indicating a social career, an income indicating a job, a criminal record or an economic relationship, a property, a credit, a transaction history, and the like.

In addition, as information that can be easily combined with other information to identify an individual, the personal information may include an IP address, an e-mail address, a religion, biometric information, location information, network information, and the like.

Recently, due to the rapid development of database technology, such personal information can be easily stored and managed, and a large number of companies store and use a large number of unique personal information accumulated through various paths in their own systems.

Such personal information is widely used as identification information of any individual or individual in a marketing system or personal identification system, and more and more companies are using the system as a system for various other business purposes.

Such personal information may be managed in the form of files in the company's storage space or stored in a database for professional management.

On the other hand, since the personal information corresponds to the unique information of the individual as described above, it is possible to easily identify the individual by using or combining only the corresponding information, so that a large social problem may occur when it is leaked.

In addition, such leaked personal information is often used for illegal crimes such as hacking or fraud, and legal regulations on the management of personal information to prevent the leakage of personal information are continuously being strengthened.

However, since such personal information is often used in combination with various information existing in the company, it is not easy to select and manage only data corresponding to personal information among various information existing in the company.

In addition, even when the management of personal information is strengthened, it is not easy to prevent personal information data from being leaked by an authorized user.

Therefore, in order to select and centrally manage personal information in a large database due to the recent rapid increase in the amount of information, it is necessary to manage all stages of personal information generation, transmission, storage, and destruction, and to prevent external attacks. In addition to defending against or preventing the leakage of information, it is required to enhance security by controlling the flow of information internally.

An object of the embodiment of the present invention for improving the above-mentioned problem is to use a dedicated tool for retrieval and manipulation of personal information data in a database, and the access to the database is unique so that the execution of retrieval and manipulation using the dedicated tool is performed. The present invention provides an access management system and method including a dedicated tool for accessing a personal information database to unify access to personal information data by managing results in the access management system.

Another object of the embodiments of the present invention for improving the above-mentioned problem is to sequentially execute SQL for collecting pre-operation data, SQL for an operation, and SQL for collecting data after an operation in the same session in order to manipulate personal information data in a database. The present invention provides an access management system and method including a dedicated tool for accessing a personal information database to accurately grasp the state before and after the operation.

Another object of the embodiment of the present invention for improving the above-mentioned problem is to parse a corresponding SQL statement when searching and manipulating personal information data in a database, and then checking the access authority according to the dictionary information of the database, and then executing the SQL statement. By executing, the user can precisely control the execution of the SQL statement according to the access authority, and access including a dedicated tool for accessing the personal information database that allows the control such as masking up to the detailed information of personal information resulting from the search. It is to provide a management system and method.

Another object of the embodiment of the present invention for improving the above-mentioned problem is that a dedicated tool provides a unique connection SQL sequence when a SQL request is made to a private information management server, and the private information management server retrieves the hash information of the access SQL sequence. It is to provide access management system and method including a dedicated tool for access to personal information database that facilitates clear identification and version checking of dedicated tools by identifying whether a dedicated tool of the connection is checked based on the version.

Another object of the present invention for improving the above-described problem is to prevent the download of personal information data to the user terminal by configuring a keyboard lock function to prevent the use of the screen capture or the clipboard in a dedicated tool installed in the user terminal It is to provide an access management system and method including a dedicated tool for accessing a personal information database.

An access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention for achieving the above object is a system for managing access to a personal information database management system for managing a personal information database. Installed in the terminal of the user for the manipulation of the personal information, the SQL to collect the state before the operation of the personal information when the operation of the personal information, the SQL for the operation and the SQL for collecting the state after the operation of the personal information is the same A dedicated tool configured in a session; and a database connection unit for connecting to the personal information database management system through a preset connection environment, a dedicated tool connection unit for connecting the dedicated tool to identify the dedicated tool as preset unique information, and the dedicated tool. Requests to manipulate personal information through SQL sent from The request execution unit and the database connection unit sequentially executing SQL for collecting the state before the manipulation of the personal information, SQL corresponding to the request for manipulation of the personal information, and SQL for collecting the state after the manipulation of the personal information in the same session. It includes; and a personal information management server having a query response unit for receiving a response result of the operation on the SQL through the dedicated tool.

Preferably, the inquiry response unit responds to the dedicated tool with execution results of the SQL collecting the pre-operation state and the SQL collecting the post-operation state.

The private information management server receives a request for manipulation of personal information through SQL transmitted from the dedicated tool, and analyzes the SQL using pre-stored metadata according to SQL grammar according to the type of the database. And an access right according to a predetermined classification according to a criterion including a SQL parsing unit for parsing some of the tokens of the SQL classified according to the dictionary information of the database using a dictionary information of the database, and the predetermined object. And an access right management unit for storing information of the user, and determining whether to execute the SQL by identifying the access right of the user through the unique information of the dedicated tool or the user information transmitted from the dedicated tool. Can be.

Preferably, the access right management unit classifies and sets the standard for the access right according to a reference including at least one of a database account, a table, a column, and an SQL statement.

In this case, the access right management unit may manage the personal information control attribute for each table or column of the database and classify the access rights of users into classes, thereby managing the operation of the table or column.

The dedicated tool provides a unique connection SQL sequence as the unique information to the dedicated tool connection unit, and the dedicated tool connection unit identifies a dedicated tool of the connection based on the hash information of the connection SQL sequence to check a version. Can be.

On the other hand, the operation may be one of the addition, deletion, update of the personal information data in the database.

Alternatively, the operation may be one of controlling user authority in the database or creating, deleting, and changing the predetermined object in the database.

The private information management server further includes a virtual file manager that stores and manages the result of the operation as a file according to a preset storage rule, wherein the inquiry response unit combines the data of the file with respect to the operation result to perform the dedicated operation. You can respond with the tool.

The dedicated tool operates on a web browser basis and the private information management server further includes a web server, so that the dedicated tool accesses the private information management server on a web basis.

The dedicated tool may further include a keyboard lock function to prevent the use of screen capture or the clipboard.

Access management system including a dedicated tool for accessing a personal information database according to another embodiment of the present invention for achieving the above object is a system for managing access to a personal information database management system for managing a personal information database, A dedicated tool installed in the terminal of the user for searching the personal information; And a database connection unit for accessing the personal information database management system through a preset connection environment, a dedicated tool connection unit for identifying the dedicated tool as preset unique information by connecting to the dedicated tool and receiving user information from the dedicated tool. After receiving a request for retrieval of personal information through SQL transmitted from a dedicated tool, the SQL is analyzed using pre-stored metadata according to the SQL grammar according to the type of the database, and then classified accordingly. A SQL parsing unit for parsing a part of tokens by using dictionary information of the database in correspondence with a predetermined object of the dictionary information, storing information of access rights according to a predetermined classification according to a criterion including the predetermined object, and storing the dedicated information. The SQL through the unique information of the tool or the user information An access right management unit for determining whether to execute the SQL by identifying an access right of the user, and corresponding to a request for retrieving the personal information from the dedicated tool through the database connection only for a user who is allowed to execute the SQL; And a personal information management server including a request execution unit executing a SQL and an inquiry response unit receiving a search result for the SQL through the database connection unit and responding to the dedicated tool.

The personal information management server receives a search result for the SQL through the database connection unit, and masks the data when the inquiry of the data corresponding to the predetermined object is not permitted according to the access right among the search results. And a masking unit, wherein the inquiry response unit may respond to the search result including the masked data with the dedicated tool.

The personal information management server may further include a virtual file manager configured to store and manage the search result as a file according to a preset storage rule, wherein the inquiry response unit combines the data of the file with respect to the search result. You can also respond with a dedicated tool.

Access management method of the access management system including a dedicated tool for access to the personal information database according to another embodiment of the present invention for achieving the above object is a personal information database management system for managing a personal information database, the personal information An access management method of an access management system including a private information management server for managing access of a personal computer and a dedicated tool installed on a terminal of a user for manipulation of the personal information, the method comprising: a) the personal information management server is configured to provide a preset access environment; Accessing the personal information database management system through; b) the personal information dedicated management server is connected to the dedicated tool to identify the dedicated tool as preset unique information; c) configuring, by the dedicated tool, SQL for collecting the pre-operational state of the personal information when the personal information is manipulated, SQL for the operation, and SQL for collecting the post-operational state of the personal information in the same session; d) the personal information management server is requested to manipulate the personal information through the SQL transmitted from the dedicated tool to collect the pre-operation status of the personal information in the same session, corresponding to the request for the operation of the personal information Sequentially executing SQL and SQL for collecting a state after manipulation of the personal information; And e) the personal information management server responding with the operation result of the SQL to the dedicated tool.

In the access management method, f) the private information management server analyzes the SQL using pre-stored metadata according to an SQL grammar according to the type of the database that has been previously identified, and then, among the tokens of the SQL classified accordingly, Parsing a portion by using a dictionary information of the database in correspondence with a predetermined object of the dictionary information; And g) the private information management server stores the information of the access right according to the preset classification according to the criteria including the predetermined object, and the SQL through the unique information of the dedicated tool or the user information transmitted by the dedicated tool. And determining whether to execute the SQL by identifying the access authority of the user.

The step g) may further include responding to the dedicated tool an execution result of the SQL collecting the pre-operation state and the SQL collecting the post-operation state.

In step g), the criteria for the access authority may be classified and set according to the criteria including one or more of a database account, a table, a column, and an SQL statement.

In this case, step g) may manage personal information control attributes for each table or column of the database and classify the access rights of users into classes, thereby managing the operation of the table or column.

Access management method of the access management system including a dedicated tool for access to the personal information database according to another embodiment of the present invention for achieving the above object is a personal information database management system for managing a personal information database, the personal information An access management method of an access management system including a private information management server for managing access of a personal computer and a dedicated tool installed on a user's terminal for retrieving the personal information, the method comprising: a) the personal information management server is configured to provide a preset access environment; Accessing the personal information database management system through; b) connecting the dedicated personal information management server to the dedicated tool to identify the dedicated tool as preset unique information and receiving user information from the dedicated tool; c) The personal information management server receives a request for retrieval of personal information through SQL transmitted from the dedicated tool, and analyzes the SQL using pre-stored metadata according to SQL grammar according to the type of the database. And parsing a portion of the tokens of the SQL classified according to the corresponding object of the dictionary information by using the dictionary information of the database. d) the personal information management server stores the information of the access authority according to the preset classification according to the criteria including the predetermined object, and access of the user to the SQL through the unique information or the user information of the dedicated tool; Determining whether to execute the SQL by identifying a right; e) executing, by the private information management server, SQL corresponding to a request for retrieving the personal information from the dedicated tool only for a user who is allowed to execute the SQL; And f) the personal information management server responding with the search result for the SQL to the dedicated tool.

In this case, the access management method is the personal information management server receives the search results for the SQL, and if the inquiry of the data corresponding to the predetermined object is not permitted according to the access authority of the search results, the corresponding data is received. The method may further include masking, and in operation f), the search result including the masked data may be responded to the dedicated tool.

An access management system and method including a dedicated tool for accessing a personal information database according to an embodiment of the present invention is configured to use a dedicated tool for retrieval and manipulation of personal information data in a database and to make access to the database unique. By managing the execution result of the search and operation using the dedicated tool in the access management system, the access to personal information data is unified to increase the security of personal information.

An access management system and method including a dedicated tool for accessing a personal information database according to an embodiment of the present invention is to collect SQL before the operation during the operation of the personal information data in the database, SQL of the operation and data after the operation. By executing SQL sequentially in the same session, it is possible to accurately grasp the state before and after the operation during the operation, so that the operation history of personal information can be clearly understood.

An access management system and method including a dedicated tool for accessing a personal information database according to an embodiment of the present invention parses a corresponding SQL statement when searching and manipulating personal information data in a database and uses the dictionary information of the database accordingly. By checking the access authority and executing the SQL statement, the execution of the SQL statement can be precisely controlled according to the access authority, and the details of the personal information data resulting from the search can be controlled such as masking. It is effective to increase the sex.

According to an embodiment of the present invention, an access management system and method including a dedicated tool for accessing a personal information database provides a unique access SQL sequence when a dedicated tool provides a SQL request to a private information management server. By identifying whether the dedicated tool of the connection is checked based on the hash information of the access SQL sequence, the identification of the dedicated tool is facilitated, and the security of the personal information data is further enhanced by facilitating the identification and version checking of the dedicated tool.

Access management system and method including a dedicated tool for accessing the personal information database according to an embodiment of the present invention to the user terminal by configuring a keyboard lock function to prevent the use of the screen capture or the clipboard in a dedicated tool installed on the user terminal It is possible to prevent the download of personal information data of the very effective to reduce the possibility of unauthorized leakage of personal information data.

1 is a block diagram of a personal information management system including an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention.
2 is a software block diagram of a user terminal according to an embodiment of the present invention.
3 is a block diagram of a personal information management system including an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention.
4 is a block diagram of an access right management unit according to an embodiment of the present invention.
5 is a block diagram of a request execution unit according to an embodiment of the present invention.
6 is a diagram illustrating a first screen of a dedicated tool according to an embodiment of the present invention.
7 is an exemplary view of a second screen of a dedicated tool according to an embodiment of the present invention.
8 is a flow chart of an access management method of an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention.

The present invention as described above will be described in detail with reference to the accompanying drawings and embodiments.

1 is a block diagram of a personal information management system including an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention.

The personal information management system is a system for supporting inquiry, storage, and transmission of personal information, and provides a path for handling virtualized personal information, and controls and manages the flow of personal information.

To this end, the personal information management system is a dedicated tool (10, 11) for access to the personal information database 210 according to an embodiment of the present invention to unify the way to access personal information to enable complete control And access management systems, including 12).

The personal information is preferably managed in the form of a database 210 in the database server 200 under any operating system 202, the database server 200 includes a database management system 201 for managing it.

The access management system includes the dedicated tool 10, a database management system 201 in the database server 200, and a private information management server 100 that provides a connection path thereof.

In addition, the user terminal (50, 60, 70) of the personal information management server 100 of the access management system, in more detail the personal information management server 100 of the access management system to query or manage the personal information; Dedicated tools 10, 11, and 12 that can be connected to the personal information control unit 20 are provided.

The dedicated tool 10 may transmit SQL to search or manipulate personal information of the database server 200 to the personal information management server 100 or may be managed by the personal information management server 100. It is possible to search or manipulate (add, delete, update) the personal information file according to the access authority.

In addition, the SQL for retrieval or manipulation is parsed through the dictionary-based information of the database 210 in the personal information management server 100, so that it is possible to control according to more sophisticated access rights and access rights as necessary. The non-licensed information may be masked to respond to the dedicated tool 10.

In addition, when executing the SQL for the operation, the dedicated tool 10 generates the SQL before the operation and the operation separately in addition to the SQL so that the personal information management server 100 performs the SQL before the operation within the same session. By operating SQL and SQL after the operation sequentially, it is possible to more precisely manage the operation history of the manipulated personal information data.

In addition, the dedicated tool 10 is preferably configured to access the file system of the access management system, and to disable screen capture or use of the clipboard so that the execution result of SQL cannot be extracted to the outside.

In addition, the dedicated tool 10 is configured to provide a unique access SQL sequence, and the private information management server 100 to identify whether the dedicated tool by referring to the hash information of the access SQL sequence and to check its version More preferably.

On the other hand, the personal information management server 100 is not the user terminal 50 of the personal information that is retrieved from the database server 200 or uploaded using the dedicated tool 10 in the server 100 Stored as a file inside to be managed.

That is, the personal information management server 100 configures a virtual space capable of processing personal information and manages 21 information related to personal information in the form of a file.

At this time, the access method for accessing the personal information management server 100 is standardized, and a method of downloading a personal information file from the virtual space for file management is unified, and a history of accessing personal information and a history of providing personal information are provided. To ensure complete control over personal information.

Accordingly, the dedicated tool 10 may view a personal information file corresponding to the corresponding content in the personal information management server 100 when the personal information is inquired, but may not download or capture an image.

In addition, the personal information management server 100 provides an approval or payment procedure 22 in the process of extracting and transmitting personal information by using the dedicated tool 10 to receive personal information authorized by policy. Inquire, save and send.

At this time, the personal information management server 100 is the personal information through the first payment procedure for performing SQL for extracting personal information and the second payment procedure for querying the personal information data resulting from the execution of the SQL. It can also be very secure.

In addition, the personal information management server 100 is not only personal information managed in the personal information database 210, but also data in the form of a file including personal information created externally and uploaded by the dedicated tool 10. Manage by the same procedure.

In addition, the personal information management server 100 is linked to the alarm notification server 400 for notifying the user of the alarm through a communication means such as e-mail or SMS (24) to execute SQL related to important personal information or the importance If you search for or manipulate high personal information files, you can notify them in charge of management.

In addition, the personal information management server 100 configures a directory for each user when managing the file of the personal information, and then grants an access right to a predetermined user for each directory to search for a corresponding file according to the access right. Allow operation.

At this time, the personal information file is encrypted and stored so that the user who is not authorized to access the access from any location and tries to look up the personal information through the file is preferably configured to maintain the security.

In addition, it is more preferable to store the access or search history for the personal information file in the personal information control unit 20 or through the database management system 201 to manage.

That is, the personal information management server 100 may unify and manage access to personal information and manage personal information file management and search history through access rights, and may provide it to the user in the form of a report (23). Configure an integrated personal information management channel.

As an embodiment of the preferred configuration of the access management system, the dedicated tool 10 and the personal information management server 100 is preferably configured in a web manner.

For example, the personal information management server 100 may include a web server, a Java virtual machine 28, a Java server page (JSP) 25, and a Java class 26, and the dedicated tool 10. ) Is configured as a Java applet to connect to the personal information management server 100 via a web browser operating on the operating system of the user terminal 50 as shown in Figure 2 to facilitate the maintenance Do.

As such, the access management system is configured to use the dedicated tool 10 when searching and manipulating the personal information data in the database, and configures only access to the database 210 to search and manipulate the private tool 10. By managing the execution result of the access management system to unify access to personal information data can increase the security of personal information.

In addition, after configuring a user-specific directory in the personal information management server 100 and setting access rights for each directory, operations such as copying, moving, inquiring, and deleting personal information are performed in the personal information management server 100. Since the personal information data is prevented from leaking to the outside of the access management system in advance, the access can be differentiated for each user so that the security of the personal information can be further improved.

3 is a block diagram of a personal information management system including an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention, and FIG. 4 is an access right management unit according to an embodiment of the present invention. 5 is a block diagram of a request execution unit according to an embodiment of the present invention.

Referring to FIG. 3, the access management system is a system for managing access to the personal information database management system 201 that manages the personal information database 210. The access management system is installed in the user's terminal for manipulation of the personal information. Dedicated tool 10 for configuring the SQL for collecting the state before the manipulation of the personal information, the SQL for the manipulation, and the SQL for collecting the state after the manipulation of the personal information when the personal information is manipulated in the same session and a preset connection. A database connection unit 180 for connecting to the personal information database management system 201 through an environment, and a dedicated tool connection unit 110 for identifying the dedicated tool 10 as preset unique information by connecting with the dedicated tool 10. To receive the operation of the personal information through the SQL transmitted from the dedicated tool 10 to collect the state before the operation of the personal information in the same session An operation result of the SQL through the request execution unit 150 and the database connection unit 180 which sequentially execute SQL, SQL corresponding to the request for manipulation of the personal information, and SQL for collecting the state after the manipulation of the personal information. It includes a personal information management server 100 having a query response unit 160 in response to the response to the dedicated tool (10).

Preferably, the inquiry response unit 160 responds to the dedicated tool 10 with an execution result of SQL collecting the pre-operation state and SQL collecting the post-operation state.

In addition, the personal information management server 100 receives a request for the manipulation of personal information through the SQL transmitted from the dedicated tool 10, the SQL to the SQL grammar according to the type of the database (210) previously identified. After parsing using the stored metadata, the SQL parsing unit 155 parses and parses some of the tokens of the SQL classified according to the predetermined object of the dictionary information by using the dictionary information of the database 210. And information about the access right according to a preset classification according to the criteria including the predetermined object, and the user's information on the SQL through the unique information of the dedicated tool 10 or the user information transmitted from the dedicated tool. An access right management unit 165 may be further provided to identify access rights and determine whether to execute the SQL.

The manipulation may be one of addition, deletion, and update of personal information data in the database 210.

In addition, the manipulation may be one of controlling user authority in the database 210 or creating, deleting, and changing the predetermined object of the database 210.

A user may access the database 210 in which personal information data is stored using the dedicated tool 10, and may search or manipulate the personal information data through SQL in the dedicated tool 10.

In this case, the access management system stores the search results in the personal information management server 100 so that the searched personal information cannot be stored in the user terminal.

In addition, it is preferable to store the information before and after the change when the predetermined personal information is changed.

In addition, if a predetermined column of a predetermined table is set as important information control by using the dedicated tool 10 as a preferred embodiment, then control is performed through the access authority system when retrieving or manipulating all personal information data related to the corresponding column. Can be set to

Meanwhile, the dedicated tool 10 provides a unique connection SQL sequence as the unique information to the dedicated tool connection unit 110, and the dedicated tool connection unit 110 connects the connection based on the hash information of the connection SQL sequence. You can also check the version by identifying whether or not it is a proprietary tool.

That is, the dedicated tool 10 provides a unique access SQL sequence so that the SQL sequence provided for establishing the session connection is different from commercial database tools, and the dedicated tool connection unit 110 identifies and verifies the version based on the unique connection SQL sequence. Check it.

The personal information dedicated management server 100 identifies whether the dedicated tool of the connection based on the hash information of the access SQL sequence and checks the version so that the identification and version of the dedicated tool 10 is easy to identify and the personal information data. The security of the can be further increased.

The SQL parser 155 parses a predetermined SQL using pre-stored metadata and dictionary information.

In this case, the use of the metadata and the dictionary information is preferably performed after identifying the type and version of the database so as to be possible according to the type and version of the various databases.

According to a preferred embodiment, the operation of the SQL parser 155 is as follows.

Table 1 shows an example of an SQL statement created by the dedicated tool 10, and Table 2 shows an example of parsing the SQL statement based on dictionary information in the SQL parser 155.

user name: scott
SELECT last_name, job_id, departments.department_id, department_name
FROM employees, departments
WHERE employees.department_id = departments.department_id
ORDER BY last_name, job_id;

<select-list>
[0xb759b8cc] [00001] [SCOTT.EMPLOYEES.LAST_NAME] [] [0xb759b760] [0xb759bb98] [(nil)]
[0xb759bb98] [00001] [SCOTT.DEPARTMENTS.LAST_NAME] [] [(nil)] [(nil)] [(nil)]
[0xb759b958] [00001] [SCOTT.EMPLOYEES.JOB_ID] [] [0xb759b760] [0xb759bbf8] [(nil)]
[0xb759bbf8] [00001] [SCOTT.DEPARTMENTS.JOB_ID] [] [(nil)] [(nil)] [(nil)]
[0xb759b9e4] [00001] [SCOTT.DEPARTMENTS.DEPARTMENT_ID] [] [(nil)] [(nil)] [(nil)]
[0xb759ba70] [00001] [SCOTT.EMPLOYEES.DEPARTMENT_NAME] [] [0xb759b760] [0xb759bc64] [(nil)]
[0xb759bc64] [00001] [SCOTT.DEPARTMENTS.DEPARTMENT_NAME] [] [(nil)] [(nil)] [(nil)]
<from-clause>
[0xb759b7e8] [00002] [SCOTT.EMPLOYEES] [] [(nil)] [(nil)] [0xb759b838]
[0xb759b838] [00002] [SCOTT.DEPARTMENTS] [] [(nil)] [(nil)] [(nil)]
<select-where-clause>
[0xb759bafc] [00001] [SCOTT.EMPLOYEES.DEPARTMENT_ID] [] [(nil)] [(nil)] [0xb759bb44]
[0xb759bb44] [00001] [SCOTT.DEPARTMENTS.DEPARTMENT_ID] [] [(nil)] [(nil)] [(nil)]

As such, when parsing based on the dictionary information of the database, even if you use columns without joining tables in the SELECT clause while joining multiple tables, there is an advantage that you can accurately analyze the table name to which the columns belong.

Therefore, in the embodiment of the present invention, based on the metadata and dictionary information stored in advance according to the grammar of various database management systems such as Oracle, DB2, MS SQL Server, Sybase, MySQL, and the like, the table and column information that the user wants to use is precisely selected. If the table and column correspond to personal information data, the usage can be clearly controlled according to the access authority.

The access right management unit 165 may control access rights to a predetermined object including personal information in the corresponding database 210 for each user through parsing, and may not control the execution of unauthorized SQL. .

In this case, the access right management unit 165 may classify and set the standard for the access right according to a reference including at least one of a database account, a table, a column, and an SQL statement.

Alternatively, the access right management unit 165 may manage personal information control attributes for each table or column of the database and classify the access rights of users into classes, thereby managing the operation of the table or column.

As a preferred embodiment, referring to FIG. 4, the access right management unit 165 may include a dictionary linkage unit 166 linking dictionary information as described above and an access right attribute of a predetermined object of the dictionary information in parsed SQL. It may include an object attribute identification unit 166 for identifying and an authority reference management unit 168 for managing a criterion of authority according to a predetermined classification.

In addition, through the access right management unit 165, if there is no authority, some information may be masked in the extraction process.

According to a preferred embodiment of the search for personal information through the dedicated tool, the access authority system may be configured through a dedicated tool 10 installed in a terminal of a user for searching for the personal information and a preset access environment. A dedicated tool connection unit for connecting to the database connection unit 180 connected to the 210 and the dedicated tool 10 to identify the dedicated tool 10 as preset unique information and receiving user information from the dedicated tool 10 ( 110) After receiving a request for retrieval of personal information through the SQL transmitted from the dedicated tool 10, after analyzing the SQL using the pre-stored metadata according to the SQL grammar according to the type of the database, Accordingly, when a portion of the classified tokens of SQL correspond to a predetermined object of the dictionary information by using the dictionary information of the database 210. SQL parsing unit 155 for parsing, and stores the information of the access authority according to the predetermined classification according to the criteria including the predetermined object, and the unique information or the user information of the dedicated tool 10 for the SQL The access right management unit 165 for identifying the access rights of the user to determine whether to execute the SQL, the personal information from the dedicated tool 10 through the database connection unit 180 only for the user allowed to execute the SQL The query execution unit 160 that receives a search result for the SQL through the request execution unit 150 and the database connection unit 180 that executes the SQL corresponding to the search request of the response tool to the dedicated tool 10. It can be configured to include a personal information management server 100 provided.

At this time, the personal information management server 100 receives the search results for the SQL through the database connection unit 180, the inquiry of the data corresponding to the predetermined object is permitted in accordance with the access authority of the search results If not, the apparatus may further include a masking unit 170 for masking the corresponding data, and the inquiry response unit 160 may be configured to respond to the dedicated tool 10 a search result including the masked data.

In addition, the personal information management server 100 further includes a virtual file management unit 130 for storing and managing the search results as a file according to a preset storage rule, the inquiry response unit 160 is the search results It is also possible to combine the data of the file with respect to the dedicated tool 10 to respond.

As such, the access management system parses the corresponding SQL statement when retrieving and manipulating the personal information data in the database 210 and executes the SQL statement after checking the access authority according to the dictionary information of the database 210. Therefore, the execution of the SQL statement can be precisely controlled according to the access authority, and the detailed information of the personal information data resulting from the search can be controlled, such as masking, to enhance the security of personal information.

In addition, the personal information database management system 201 preferably stores and manages the history of the search for personal information in the database 210.

This is to log the information related to the history or approval of access to a predetermined personal information file or database, and if a specific personal information is leaked later, it is possible to track who has accessed the information.

The access history or search history may be managed in the form of a file in the virtual file manager 130 or may be stored and managed in the database 210.

In addition, the virtual file manager 130 manages a directory in which files of personal information are stored for each user of the dedicated tool 10, and sets access rights for each directory so that only a user authorized for the directory is included in the directory. It is highly desirable to have access to the file.

In more detail, the personal information is transmitted only within the virtual file manager 130 when the personal information is transmitted to each other. For example, when the personal information is transmitted, the actual personal information data file is not transmitted. The file management unit provides the location information of the corresponding personal information file, and the person who receives the information can use the information of the corresponding personal information file in the virtual file manager 130.

That is, the virtual file management unit 130 controls the environment of access management, payment, personal information file management, history management of access or retrieval so that personal information is generated and transmitted only in the virtual file management unit 130. ) Is built only within.

Meanwhile, referring to FIG. 5, the request execution unit 150 checks whether the SQL statement is a syntax for manipulating personal information data, the SQL inspecting unit 151, SQL for collecting a state before manipulation of the personal information, and the personal information. SQL management unit 152 for managing the SQL to collect the state after the operation of the operation and SQL to collect the state before the operation of the personal information in the same session, SQL corresponding to the operation request of the personal information and after the operation of the personal information It can be configured to include a SQL execution unit 153 that sequentially executes the SQL collecting the state.

It should be noted that the request execution unit 150 sequentially executes the SQL statements before and after the operation according to each operation SQL statement if necessary when a plurality of operation SQL statements are executed in the same session or the same transaction.

Especially in the case of personal information with high importance, it is preferable to store the data before and after the change when the change occurs. However, the existing method is completely different from the session of the database storing the data before and after the change. Information cannot be managed.

Or, in the past, if the SQL is not processed because of complexity, or if multiple update SQL statements are executed in one transaction, accurate before and after information cannot be recorded.

However, in the case of using the dedicated tool 10 according to an embodiment of the present invention, it is possible to configure and perform SQL that records and manages pre and post information in the same session, thereby managing clear pre and post information in actual situations. can do.

As described above, the dedicated tool 10 sequentially executes SQL for collecting data before the operation, SQL for the operation, and SQL for collecting the data after the operation in the same session. It is possible to accurately grasp the state before and after the operation, so that the operation history of personal information can be clearly understood.

In this case, the inquiry response unit 160 may cause the dedicated tool 10 to respond to the execution result of the SQL collecting the pre-operation state and the SQL collecting the post-operation state.

Meanwhile, the virtual file manager 130 of the personal information management server 100 stores and manages the result of the operation as a file according to a preset storage rule, and the inquiry response unit 160 controls the operation result. The data of the file may be combined to respond to the dedicated tool 10.

In addition, the dedicated tool 10 operates on a web browser basis, and the personal information dedicated management server 100 further includes a web server. ) Can be accessed.

In addition, the dedicated tool 10 is configured to further include a keyboard lock function to prevent the use of screen capture or clipboard to prevent the download of personal information data to the user terminal to prevent the possibility of unauthorized leakage of personal information data Can be very low.

On the other hand, the personal information management server 100 receives a security interlocking request for personal information from the database security server 300 that manages the security of the personal information database management system 201, the security rule by the predetermined security rule It is preferable to further include a security interlocking unit 190 to interoperate with the database security server 300.

The access management system is configured to interwork in the security interlocking unit 190 for data corresponding to personal information processed by the database security system 300 interoperating with the database 210, all data related to personal information Can be processed in the access management system is also ensured interoperability with the built-in database security system 300.

In addition, the personal information management server 100 classifies the importance of the search request of the personal information according to a predetermined security rule, so as to notify an alarm for the search request of the personal information to the user set according to the importance. It is more preferable to further include an alarm notification unit 300 in conjunction with the alarm notification server 400 for notifying the alarm by e-mail or SMS.

In addition, the personal information management server 100 preferably further includes a payment unit 140 for approving the payment of the execution of the SQL or the query of the result file when searching or manipulating the personal information data.

6 is a diagram illustrating a first screen of a dedicated tool according to an embodiment of the present invention, and FIG. 7 is a diagram illustrating a second screen of a dedicated tool according to an embodiment of the present invention.

Referring to FIG. 6, the dedicated tool 10 provides a user with a dedicated SQL editor 11 for executing a syntax of SQL.

In addition, FIG. 7 illustrates a screen provided only to a user having authority to change an attribute, and the user having authority to change the attribute according to a predetermined object type 15 or sentence type 13 of the database through the dedicated tool. SQL control can be set, and in case of personal information data, it can be set as Privacy Control (14: Privacy Control).

8 is a flowchart illustrating an access management method of an access management system including a dedicated tool for accessing a personal information database according to an embodiment of the present invention.

The access management method includes a personal information database management system 201 that manages a personal information database, a personal information management server 100 that manages access to the personal information, and a dedicated device installed on a user's terminal for manipulation of the personal information. An access management method of an access management system including a tool 10, the personal information management server 100 accessing the personal information database management system 201 through a preset connection environment, the personal information management only Identifying, by the server 100, the dedicated tool 10 as preset unique information in connection with the dedicated tool 10 (S100, S110), and when the dedicated tool 10 manipulates the personal information, the individual. Configuring SQL for collecting the pre-operational state of information, SQL for the operation and SQL for collecting the post-operational state of the personal information in the same session (S128), The private information management server 100 is SQL to receive the operation of the personal information through the SQL transmitted from the dedicated tool 10 to collect the state before the operation of the personal information in the same session, the operation of the personal information Sequentially executing the SQL corresponding to the request and the SQL collecting the state after the manipulation of the personal information (S130, S151, S152, S153) and the personal information management server 100 for the operation result of the SQL; Responding to the dedicated tool 10 in response to the response (S154, S170).

In addition, in the access management method, the personal information management server 100 analyzes the SQL using pre-stored metadata according to an SQL grammar according to the type of the database that has been previously identified, and then classifies the SQL. Parsing some of the tokens in correspondence with a predetermined object of the dictionary information by using the dictionary information of the database (S132), and classifying the personal information management server 100 according to the criteria including the predetermined object. Whether to execute the SQL by storing the information on the access right according to the user's access right to the SQL through the unique information of the dedicated tool 10 or the user information transmitted by the dedicated tool 10. Determining step (S133) may further include.

In addition, in the access right identification step (S133), it is preferable to classify and set the standard for the access right according to a criterion including at least one of a database account, a table, a column, and an SQL statement.

Alternatively, the access right identification step (S133) may manage the personal information control attribute for each table or column of the database and classify the access rights of users into classes, thereby managing the operation of the table or column.

On the other hand, in the access management method, the dedicated tool 10 provides a unique connection SQL sequence as the unique information to the private information management server 100 and the private information management server 100 provides the access. The method may further include determining whether a dedicated tool of the corresponding connection is checked based on the hash information of the SQL sequence and checking the version.

The manipulation may be one of adding, deleting, and updating personal information data in the database.

Alternatively, the operation may be one of controlling user authority in the database or creating, deleting, and changing the predetermined object in the database.

The access management method further includes the step (S162) of storing and managing the result of the operation as a file by the personal information management server 100 according to a preset storage rule, and the response step (S170) is the operation. The data in the file can be combined to respond to the dedicated tool 10 for results.

In addition, the access management method may further comprise the step (S120, S125) the personal information management server 100 receives a request for payment of the execution of the SQL from the dedicated tool before executing the SQL. .

On the other hand, in a preferred embodiment of the access management method at the time of search, the access management method is the step of accessing the personal information database management system 201 through the preset access environment, the personal information management server 100 (S100) In step S110, the personal information management server 100 is connected to the dedicated tool 10 to identify the dedicated tool 10 as preset unique information and receives user information from the dedicated tool 10 (S110). The private information management server 100 receives a request for retrieval of personal information through SQL transmitted from the dedicated tool 10, and stores the SQL according to the SQL grammar according to the type of the database. After analyzing using the data, a portion of the classified tokens of the SQL correspond to a predetermined object of the dictionary information by using the dictionary information of the database. Parsing (S130 and S132), the personal information management server 100 stores the information of the access right according to a predetermined classification according to the criteria including the predetermined object, and unique information of the dedicated tool 10. Or determining whether to execute the SQL by identifying the user's access authority to the SQL through the user information (S131, S133), and the personal information management server 100 allows the user to execute the SQL. Only to execute the SQL corresponding to the request for retrieving the personal information from the dedicated tool (10) (S152) and the private information management server 100 receives the search results for the SQL to the dedicated tool It may include responding (S154, S170).

In the access management method, when the personal information management server 100 receives the search result for the SQL and the inquiry of the data corresponding to the predetermined object is not permitted according to the access right among the search results. The method may further include masking the corresponding data (S160 and S161), and the response step (S170) may cause the dedicated tool 10 to respond to the search result including the masked data.

Alternatively, the access management method further includes the step of storing (S162) the search result as a file in the personal information management server 100 according to a preset storage rule, and the response step (S170) The data of the file may be combined with the search result to respond to the dedicated tool 10.

In addition, the access management method may further include the step (S140, S145) of notifying the alarm for the result of the execution or search and operation of the SQL to the alert notification server 400.

In addition, the access management method preferably further comprises the step (S180) of the personal information management server 100 to manage the history of the search or operation for the personal information data.

The foregoing embodiments and advantages are merely exemplary and are not to be construed as limiting the present invention. However, the present invention is not limited to the above-described embodiments, and various changes and modifications may be made by those skilled in the art without departing from the scope of the present invention. .

10: dedicated tool 100: private information management server
110: dedicated tool connection unit 120: alarm notification unit
130: virtual file management unit 140: payment unit
150: request execution unit 151: SQL checker
152: SQL management unit 153: SQL execution unit
155: SQL parser 160: query response unit
165: access authority management unit 166: dictionary information interworking unit
167: object attribute identification unit 168: authorization criteria management unit
170: masking unit 180: database connection unit
190: security interlocking unit 200: database server
201: database management system 210: database
300: database security server 400: alarm notification server

Claims (20)

In a system for managing access to a personal information database management system for managing a personal information database,
Installed in the terminal of the user for manipulation of the personal information, SQL for collecting the state before the manipulation of the personal information, the SQL for the operation and SQL for collecting the state after the manipulation of the personal information when the personal information is manipulated Dedicated tools configured in the same session; and
A database connection unit for accessing the personal information database management system through a preset connection environment, a dedicated tool connection unit for connecting the dedicated tool to identify the dedicated tool as preset unique information, and personal information through SQL transmitted from the dedicated tool. A request to sequentially execute SQL for collecting the state before the manipulation of the personal information, SQL corresponding to the request for the manipulation of the personal information, and SQL for collecting the state after the manipulation of the personal information in the same session And a personal information management server having an inquiry response unit which receives a result of the manipulation of the SQL through a database unit and a database connection unit, and responds to the dedicated tool.
The personal information management server,
After receiving a request for manipulation of personal information through the SQL transmitted from the dedicated tool, the SQL is analyzed using pre-stored metadata according to the SQL grammar according to the type of the database, and then classified accordingly. An SQL parsing unit for parsing some tokens of the at least one of the tokens in correspondence with a predetermined object of the dictionary information by using the dictionary information of the database;
Storing access rights information according to a predetermined classification according to the criteria including the predetermined object, and identifying the access rights of the user to the SQL through the unique information of the dedicated tool or the user information transmitted from the dedicated tool Access management system including a dedicated tool for access to the personal information database further comprising an access authority management unit for determining whether to execute the SQL.
The method of claim 1, wherein the inquiry response unit
And a dedicated tool for accessing the personal information database further comprising responding to the dedicated tool a result of executing the SQL collecting the pre-operation state and the SQL collecting the post-operation state.
delete The method of claim 1, wherein the access right management unit
The access management system including a dedicated tool for access to the personal information database, characterized in that for setting the criteria for the access rights based on the criteria including one or more of database accounts, tables, columns and SQL statements.
The method of claim 4, wherein the access right management unit
It includes a dedicated tool for access to the personal information database, characterized in that to manage the personal information control attributes for each table or column of the database and to classify the access rights of users by class, thereby managing the operation of the table or column accordingly. Access management system.
The method of claim 1,
The dedicated tool provides a unique connection SQL sequence to the dedicated tool connection as the unique information.
The dedicated tool connection unit includes a dedicated tool for access to the personal information database, characterized in that to check the version by identifying whether the dedicated tool of the connection based on the hash information of the access SQL sequence.
The method of claim 1, wherein the manipulation is
Access management system including a dedicated tool for access to the personal information database, characterized in that one of the addition, deletion, update of the personal information data in the database.
The method of claim 1, wherein the manipulation is
And a dedicated tool for accessing the personal information database, wherein the user authority is controlled in the database or creation, deletion, and modification of a predetermined object in the database.
The method of claim 1, wherein the personal information management server
And a virtual file manager which stores and manages the result of the operation as a file according to a preset storage rule.
And the inquiry response unit combines the data of the file with respect to the operation result and responds to the dedicated tool.
The method of claim 1,
The dedicated tool operates on a web browser basis and the personal information dedicated management server further includes a web server, wherein the dedicated tool accesses the personal information database on a web basis. Access management system with dedicated tools for the system.
The method of claim 1,
The dedicated tool access management system including a dedicated tool for accessing a personal information database, characterized in that it further comprises a keyboard lock function to prevent the use of screen capture or clipboard.
delete delete A personal information database management system for managing a personal information database, a personal information management server for managing the access of the personal information and access management method of the access management system including a dedicated tool installed on the user's terminal for the operation of the personal information In
a) connecting the personal information management server to the personal information database management system through a preset access environment;
b) the personal information dedicated management server is connected to the dedicated tool to identify the dedicated tool as preset unique information;
c) configuring, by the dedicated tool, SQL for collecting the pre-operational state of the personal information when the personal information is manipulated, SQL for the operation, and SQL for collecting the post-operational state of the personal information in the same session;
d) the personal information management server is requested to manipulate the personal information through the SQL transmitted from the dedicated tool to collect the pre-operation status of the personal information in the same session, corresponding to the request for the operation of the personal information Sequentially executing SQL and SQL for collecting a state after manipulation of the personal information; And
e) receiving a result of the manipulation of the SQL by the private information management server and responding to the dedicated tool; including a dedicated tool for access to the personal information database, including:
f) The personal information management server analyzes the SQL using the pre-stored metadata according to the SQL grammar according to the type of the database that has been previously identified, and then analyzes some of the tokens of the SQL classified accordingly. Parsing the dictionary information by using a dictionary information in correspondence with a predetermined object of the dictionary information; And
g) the personal information management server stores the information of the access right according to the preset classification according to the criteria including the predetermined object, and transmits the information to the SQL through the unique information of the dedicated tool or the user information transmitted by the dedicated tool. Determining whether to execute the SQL by identifying an access right of the user to the access management system of the access management system including a dedicated tool for accessing the personal information database.
delete The method of claim 14, wherein g) is
The access management method of the access management system including a dedicated tool for accessing the personal information database, characterized in that the criteria for the access rights are classified and set according to the criteria including one or more of database accounts, tables, columns, and SQL statements. .
The method of claim 16, wherein g)
It includes a dedicated tool for access to the personal information database, characterized in that to manage the personal information control attributes for each table or column of the database and to classify the access rights of users by class, thereby managing the operation of the table or column accordingly. Access management method of access management system.
15. The method of claim 14, wherein said manipulation is
Access management method of the access management system including a dedicated tool for access to the personal information database, characterized in that one of the addition, deletion, update of the personal information data in the database.
delete delete

Images