KR101393911B1 - System for preventing information outflow from inside using agent and network device cooperation - Google Patents

Abstract

Discloses a system for preventing information leakage through interworking between an agent and a network device. According to an aspect of the present invention, there is provided a method of preventing information leakage through interworking between an agent and a network device, comprising: monitoring data transmitted from a client terminal in the intranet to the outside of the intranet; Transmitting data extracted from data transmitted to the outside to an agent installed in the client terminal when data transmitted to the outside of the intranet is detected; Receiving a search result from the agent; And determining whether to allow external transfer of data transmitted outside the intranet according to the search result.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a system for preventing information leakage through interworking between an agent and a network device,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for preventing internal information leakage through a communication network, and a system for preventing information leakage through interworking of an agent and a network device.

The irrational outflow of information or personal information of a company has a large ripple effect, which causes huge economic loss. Recently, as the damage related to information leaks has increased, a variety of techniques have been sought to prevent data leakage including important information.

The internal information leakage preventing solution according to the related art can be classified into an endpoint method, a network method, and a storage method according to a leakage prevention position.

The endpoint approach is to use software that prevents the leakage of information from inside the personal computer. The network method uses hardware that detects traffic on the network and prevents internal information from being leaked. The storage method uses software that prevents leakage of internal information at a location where documents such as a file server are concentrated. At this time, the internal information may be information managed within the enterprise such as an intranet.

Although it is possible to prevent internal information leakage through various methods, it can not prevent important information leaked through the body of the e-mail or the body of the web page, not in the form of a file, or effectively prevent leakage of important information contained in a large- .

In addition, the independent operation of each of the endpoint method, the network method and the storage method may not effectively prevent leakage of important information.

An object of the present invention is to provide a method and system for preventing leakage of information that can effectively prevent leakage of personal information or important information inside the company.

An object of the present invention is to provide an information leakage prevention method and system capable of reducing the construction cost of a security solution and monitoring various types of personal information leakage paths through interworking of an agent installed in a personal terminal and a network device.

In addition, the present invention intends to solve the problem of degradation of search speed as to whether or not the load concentration problem of the network equipment and the important information of the outflow data through the interworking of the agent and the network apparatus installed in the terminal.

According to an aspect of the present invention, there is provided a method of preventing information leakage through interworking between an agent and a network device, comprising: monitoring data transmitted from a client terminal in the intranet to the outside of the intranet; Transmitting data extracted from data transmitted to the outside to an agent installed in the client terminal when data transmitted to the outside of the intranet is detected; Receiving a search result from the agent; And determining whether to allow external transfer of data transmitted outside the intranet according to the search result.

According to an aspect of the present invention, there is provided an apparatus for preventing information leakage through interworking between an agent and a network device, comprising: a monitoring unit for monitoring data transmitted from a client terminal in the intranet to the outside of the intranet; A data extracting unit for extracting a file name or a hash value from data transmitted to the outside if data transmitted to the outside of the intranet is detected; A transmitting and receiving unit transmitting a search request for data transmitted to the outside through an agent installed in the client terminal and receiving a search result from the agent; And a management unit for determining whether to allow external transfer of data transmitted to the outside of the intranet according to the search result.

The present invention can efficiently prevent leakage of personal information or important information inside the company.

The present invention can reduce the cost of constructing a security solution and monitor various types of personal information outflow paths through interworking of an agent installed in a personal terminal and a network device.

In addition, the present invention can solve the problems of the load concentration problem of the network equipment and the degradation of the search speed as to whether or not it is important information of the outflow data through interworking of the agent and the network apparatus installed in the terminal. In other words, according to the present invention, it is possible to solve a resource shortage problem for processing a high capacity data file, a compressed file and the like without performing a content based analysis in the Network DLP, and it is possible to alleviate the problem of degrading the network transmission speed in the Network DLP.

FIG. 1 is a diagram for explaining the information leakage prevention concept of Agent DLP (Data Loss Protection) according to the related art.
FIG. 2 is a diagram for explaining the concept of information leakage prevention based on the Network DLP (Data Loss Protection) scheme according to the related art.
3 is a view for explaining an information leakage prevention system through interworking of an agent and a network device according to an embodiment of the present invention.
FIG. 4 is a diagram showing an example of the configuration of the Agent interlocking device in FIG.
5 is a flowchart illustrating a method of preventing an information leakage through interworking between an agent and a network device according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram for explaining the information leakage prevention concept of Agent DLP (Data Loss Protection) according to the related art.

Referring to FIG. 1, an Agent DLP (Data Loss Protection) system includes application programs 111 and 121 through agent modules 113 and 123 installed in respective personal computers 110 and 120, To monitor data that is created or loaded.

In FIG. 1, reference numeral 130 denotes a network equipment such as a switch or a router, and 140 denotes a firewall system. The personal computers (Client PCs) 110 and 120 may be connected to the switch or router 130 via the Network Adapters 115 and 125. Reference numeral 180 denotes an external server connected via a communication network such as the Internet.

Agent modules (113, 123) can monitor the network connection of the application programs (111, 121). At this time, Network filter driver or Win32 Socket API Hooking method can be used for network connection monitoring.

The search engines 117 and 127 check the data stored in the client PCs 110 and 120 to generate Index Data 119 and 129 and generate Index Data 119 and 129 using the generated Index Data 119 and 129, The destination information can be retrieved.

The agent modules 113 and 123 analyze packet streams transmitted from the client PCs 110 and 120 to the network to detect personal information and block data to be blocked. Therefore, when a large-capacity file is transmitted, it may inconvenience a user to wait until the analysis of all the data included in the large-capacity file is completed.

Further, in order to detect data transmitted to the outside of the internal network 100 according to a protocol of the application programs 111 and 121, data of a part or a substantial part of the data may be transmitted to the outside.

As a result, it may be difficult to effectively monitor the main information in the network 100 or prevent leakage of internal information by using only the Agent DLP (Data Loss Protection) method.

On the other hand, when traffic is monitored at the network filter driver level, it is necessary to assemble the packets at the driver level, so that it is impossible to monitor the contents of a large file or text in the file.

FIG. 2 is a diagram for explaining the concept of information leakage prevention based on the Network DLP (Data Loss Protection) scheme according to the related art.

2, the Network DLP (Data Loss Protection) method is a method in which an agent module is not installed in each of the personal computers (Client PCs) 210, 220 and 230 and is installed at the rear end of a switch or router 240 And monitors the traffic of all the personal computers (Client PCs) 210, 220 and 230 through the Network DLP equipment 250. [

2, reference numeral 260 denotes a firewall, and reference numeral 280 denotes an external server connected through a communication network such as the Internet.

The Network DLP equipment 250 may include a Packet Analyzer 251, a Protocol Emulator 253, and a Search Engine 255.

The Packet Analyzer 251 detects and analyzes packets transmitted from the inside 200 of the network to the outside, and the Protocol Emulator 253 emulates the detected packets by protocol, and determines whether the main information is included or not through the search engine 255 Lt; / RTI >

Since the Index data used in the Agent DLP method can not be used at this time and the Packet Analyzer 251 decodes and analyzes packets received from the client PC in real time in real time, the Network DLP method has a disadvantage have.

In addition, in the network DLP method, there is a problem that the performance of the Network DLP equipment 250 decreases as the number of client PCs increases.

In addition, since the Network DLP equipment 250 is expensive equipment, the Network DLP method has a disadvantage that the installation cost is much larger than that of the Agent DLP method.

In addition, the Network DLP scheme can be defenseless against information leakage when the Client PC is connected to the outside via the 3G, Wibro or LTE network, that is, connected to the external network without going through the Network DLP equipment 250.

The embodiments of the present invention solve the shortcomings of the Agent DLP scheme and the Network DLP scheme and propose a system that can effectively prevent information leakage.

3 is a view for explaining an information leakage prevention system through interworking of an agent and a network device according to an embodiment of the present invention.

3, an information leakage prevention system through interworking between an agent and a network device includes a plurality of client terminals 310, 311, and 313, a switch or a router 240, and a Network DLP device 330. Referring to FIG. 3, reference numeral 340 denotes a firewall, and reference numeral 350 denotes an external server connected through a communication network such as the Internet.

Each of the plurality of client terminals 310, 311, and 313 may have an Agent module installed therein. That is, at least one of the client terminals 310, 311, and 313 may have the same configuration as the client PCs 110 and 120 of FIG.

At this time, the Agent module is not installed in the client terminal 310, and the Agent module may be installed only in the client terminal 311 and the client terminal 313. In addition, any one of the client terminal 311 and the client terminal 313 having the Agent module may be a predetermined client terminal for interworking with the Network DLP equipment 330.

The Network DLP equipment 330 includes an Agent interworking unit 331 for interworking with the Agent module.

The agent interworking unit 331 detects packets transmitted to the outside from the client terminals 310, 311 and 313 in the intranet 300 in real time and extracts the detected packets, To the client module that transmitted the request.

At this time, the search request may be transmitted not to the client terminal that transmitted the file or the packet, but to the predetermined client terminal or the client terminal that is less in use of the current resource.

Therefore, the information leakage prevention system according to the embodiment of the present invention can prevent the deterioration of the detection speed and reduce the performance degradation.

The search request can use a method of transmitting the hash value extracted from the file to the Agent module. Therefore, traffic transmitted between the client terminal and the Network DLP equipment 330 can be reduced.

The agent module that receives the search request can search for the inclusion of important information at a high speed using a hash value or index data. That is, the Agent module can search the file having the same Hash value as the Index data by using the Index data for the file requested to be searched, and transmit the search result to the Network DLP equipment 330. [

In particular, in the case of a client terminal transmitting a file, since all the data is already searched by the Agent module and Index data may be generated in advance, quick searching is possible.

The agent module that performs the search can transmit Full File Path information, information related to logging, search result and user information to the agent interworking unit 331 of the Network DLP equipment 330.

At this time, the search result may include whether or not personal information is included and the detected quantity, whether or not information classified as important information is included, and the detected quantity. In addition, the user information may include a user ID and a destination IP address of the corresponding file.

Unlike FIG. 1, since the Agent module performs only the search and does not monitor the network connection, resources required for monitoring can be reduced.

Fig. 4 is a diagram showing an example of the configuration of the agent interlocking device 331 in Fig.

Referring to FIG. 4, the agent interworking unit 331 includes a monitoring unit 410, a data extracting unit 420, a transceiver unit 430, and a management unit 440.

The monitoring unit 410 monitors data transmitted from a client terminal in the intranet to the outside of the intranet. That is, the monitoring unit 410 monitors whether data transmitted to the outside is generated.

The data extracting unit 420 may extract a file name or a hash value from the data transmitted to the outside when data transmitted to the outside of the intranet is detected.

The data extracting unit 420 generates information indicating the search request message, the identifier of the file data, and the hash value, and outputs information indicating the search request message, the identifier of the file data, and the hash value And the like.

[Table 1]

The Agent module can generate a Response XML message for the Request XML message as shown in [Table 2]. Referring to Table 2, the search result may include "whether personal information or important information is included", "the number of personal information or important information", and "user ID or IP address".

[Table 2]

The transceiver 430 transmits a search request for the data transmitted to the outside to the agent installed in the client terminal, and receives the search result from the agent. At this time, agent means Agent module.

The management unit 440 determines whether data to be transmitted to the outside of the intranet is allowed to be transmitted in accordance with the received search result.

The management unit 440 may determine a pre-stored information protection policy according to the "user ID or IP address" and determine whether the external transfer is permitted based on the determined information protection policy.

For example, if the information protection policy specifies that only a user belonging to a specific group is allowed to perform external transfer, the user ID can determine whether the user belongs to a specific group.

In addition, when the transmission of the specific destination IP address is not permitted, the destination of the file may be determined by referring to the IP address.

5 is a flowchart illustrating a method of preventing an information leakage through interworking between an agent and a network device according to an embodiment of the present invention.

The method shown in Fig. 5 can be performed by the information leakage preventing system shown in Fig. 3, in particular, the Agent interlocking device 331.

In step 510, the agent interworking device 331 monitors data transmitted from the client terminal in the intranet to the outside of the intranet.

In step 520, when data transmitted to the outside of the intranet is detected, the agent interworking device 331 transmits information extracted from the external data to the agent installed in the client terminal.

The data transmitted to the outside may be file data, and the information extracted from the data transmitted to the outside may be a file name of the data transmitted to the outside or a hash value extracted from the data.

At this time, in step 520, an XML message including the information indicating the search request message, the identifier of the file data, the hash value, the information indicating the search request message, the identifier of the file data, and the hash value is generated And sending the XML message to the agent.

At this time, in step 520, the agent interworking device 331 can transmit the extracted information to the client terminal that has generated the data transmitted to the outside among the client terminals in the intranet.

The agent interworking unit 331 searches for a client terminal installed with the agent among the client terminals in the intranet, selects one client terminal in consideration of the resource of the client terminal installed in the agent, And can transmit the extracted information.

In step 530, the agent interworking device 331 receives the search result from the agent. At this time, the search result may be a search result based on the hash table or the index data previously stored in the agent.

In step 540, the agent interworking device 331 determines whether external transfer of data to be transmitted outside the intranet is permitted according to the search result.

At this time, the search result includes "whether personal information or important information is included", "the number of personal information or important information" and "user ID or IP address" Determining a pre-stored information protection policy based on the determined information protection policy, and determining whether the external transmission is permitted based on the determined information protection policy.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

Monitoring data transmitted from a plurality of client terminals in the intranet to the outside of the intranet, wherein an agent is installed in some client terminals of the plurality of client terminals;
Transmitting data extracted from the external data to an agent installed in the client terminal when data transmitted to the outside of the intranet is detected;
Receiving a search result from the agent installed in the client terminal; And
And determining whether to allow external transfer of data to be transmitted outside the intranet according to the search result
A method for preventing information leakage through interworking of an agent and a network device. The method according to claim 1,
Wherein the step of transmitting information extracted from the data transmitted to the outside to the agent installed in the client terminal comprises:
Extracting a hash value extracted from the file name or data of the data transmitted to the outside from the data transmitted to the outside;
Transmitting the extracted file name or the hash value to an agent installed in the client terminal
The method comprising the steps of: 3. The method of claim 2,
Wherein the step of transmitting, to the agent installed in the client terminal,
Generating a hash value and an identifier of the file data; And
Generating an XML message including information indicating the search request message, an identifier of the file data, and the hash value; And
And sending the XML message to the agent
A method for preventing information leakage through interworking of an agent and a network device. The method according to claim 1,
The search result is a search result based on the hash table or index data previously stored in the agent
A method for preventing information leakage through interworking of an agent and a network device. 5. The method of claim 4,
The search result includes "whether personal information or important information is included", "quantity of the personal information or important information", and "user ID or IP address"
The step of determining whether the external transfer is permitted
Determining a pre-stored information protection policy according to the "user ID or IP address" And
And determining whether the external transfer is permitted based on the determined information protection policy
A method for preventing information leakage through interworking of an agent and a network device. The method according to claim 1,
Wherein the step of transmitting information extracted from the data transmitted to the outside to the agent installed in the client terminal comprises:
Determining whether an agent is installed in a client terminal that has generated data to be transmitted to the outside among the plurality of client terminals in the intranet;
Wherein when an agent is installed in a client terminal that has generated data to be transmitted to the outside of the plurality of client terminals, information extracted from the data transmitted to the outside is transmitted to the client terminal ; And
When the agent is not installed in the client terminal that has generated the data transmitted to the outside, the client terminal is selected in consideration of the resources of some of the client terminals installed in the agent, Transmitting the extracted information to the client terminal
The method comprising the steps of: A monitoring unit for monitoring data transmitted from a plurality of client terminals in the intranet to the outside of the intranet; an agent installed in a part of the client terminals of the plurality of client terminals;
A data extracting unit for extracting a file name or a hash value from data transmitted to the outside if data transmitted to the outside of the intranet is detected;
A transmitting and receiving unit transmitting a search request for data transmitted to the external to an agent installed in the client terminal and receiving a search result from the agent installed in the client terminal; And
And a management unit for determining whether or not to permit external transmission of data transmitted to the outside of the intranet according to the search result
An apparatus for preventing information leakage through interworking of an agent and a network device. 8. The method of claim 7,
The data extracting unit extracts,
Generates an identifier of the file data, the hash value, and generates an XML message including information indicating the search request message, the identifier of the file data, and the hash value
An apparatus for preventing information leakage through interworking of an agent and a network device. 8. The method of claim 7,
The search result includes "whether personal information or important information is included", "quantity of the personal information or important information", and "user ID or IP address"
The management unit determines a pre-stored information protection policy according to the "user ID or IP address ", and determines whether the external transfer is permitted based on the determined information protection policy
An apparatus for preventing information leakage through interworking of an agent and a network device. The method comprising the steps of: monitoring data transmitted from a plurality of client terminals in an intranet to the outside of the intranet, the plurality of client terminals including a first client terminal and a second client terminal, An agent is not installed in the second client terminal;
Transmitting information extracted from the second data to an agent installed in the first client terminal when second data transmitted from the second client terminal to the outside of the intranet is detected;
Receiving a search result for the second data from the agent installed in the first client terminal; And
Determining whether the second data transmitted to the outside of the intranet is permitted to be transmitted according to the search result
The method comprising the steps of:

Images