KR101459676B1 - Apparatus for secreting information security in printed documents using user terminal and method thereof - Google Patents

Abstract

The present invention relates to an apparatus and method for securing confidential information on a print document using a user terminal, and more particularly, to an apparatus and method for securing confidential information on a print document using a user terminal, After extracting a string from a document to be analyzed, it is possible to effectively block or secure confidential information on the printed document.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a confidential information security device on a printed document using a user terminal,

The present invention relates to an apparatus and method for securing confidential information on a printed document using a user terminal, and more particularly, to an apparatus and method for securing confidential information on a printed document by using an API hooking method when printing a document through a printer directly or indirectly connected to a user terminal The present invention relates to a confidential information security device on a printed document using a user terminal and a method thereof for extracting a string from a document and analyzing the extracted string to effectively secure confidential information on the printed document.

Generally, as the information society develops, the economic value of information increases, and the collection and use of personal information is becoming more common throughout the society.

In recent years, cases of leakage and infringement of personal information have steadily increased, and companies are increasingly infiltrated with confidential information and personal information of customers, and they are suffering psychological and monetary damages to individuals through impersonation and telephone fraud.

To prevent this, companies are integrating security solutions such as Digital Rights Management (DRM), Data Loss Prevention (DLP), and Enterprise Contents Management (ECM). The security of the printed document is continuously maintained. The security methods include print document control, text log, and original log method.

As a method for controlling the print document, there are usually a method using a print processor, a control method using a virtual print, and the like.

First, a method of controlling by using the print processor controls a print output by detecting a print job in a process of sending a print job spooled from a print spooler to a printer device from a hard disk (HD).

Second, the print control method using the virtual print means that the print control module is built in each user's computer, and the print output is controlled by sensing the print job in all the applications installed in the computer.

These two control methods can know the provided printout information. However, the function of detecting and protecting the personal information contained in the printed document contents has not been studied yet.

Meanwhile, the print document text log method extracts information on a print document through the above-described print document control method, and then generates a log. By transmitting the log to the central management server and managing it, the overall print output situation can be managed through the print output information. The information of the log can be known as the print document name, date and time, output PC, etc. However, it is not known whether the document contains personal information.

The print document original log method generates a copy image of a print document at the time of a print job by the user through the print control method, and transmits the copied image to the central management server for management. This original image can identify what print job the user has done with an identifiable image of the printed document. However, it is written as a picture file, and personal information can not be detected.

As described above, conventional security methods do not identify and control personal information. A method of generating a text log or an original log may determine the absence of personal information through printing after printing without identifying the personal information at the time of printing.

That is, in the above-described conventional security methods, when a print document including personal information is exposed to the outside, there is a high possibility that information is leaked. In particular, it is necessary to take measures to protect resumes, certificates, graduation certificates, and confidential documents issued by personal information from outside the company.

SUMMARY OF THE INVENTION The present invention is conceived to solve the problems described above, and an object of the present invention is to provide a method and apparatus for extracting a character string from a document to be printed by using an API hooking method when printing a document through a printer directly or indirectly connected to a user terminal And to provide a confidential information security device on a printed document using the user terminal and a method thereof, which can effectively secure confidential information on a printed document.

According to a first aspect of the present invention, there is provided an apparatus for securing confidential information on a document printed through a printer connected to a user terminal, the apparatus comprising: application programming interface (API) hooking The document data to be printed to the document processor of the user terminal is monitored through the Hooking process, the character string information is extracted based on the printing start / end information for the document data requested to be printed, module; And at least one confidential information pattern data which is received from the monitoring module and is compared with at least one confidential information pattern data to detect confidential information, and then analyzes the type and the number of the confidential information, And a control module for controlling the document processor of the user terminal to block or secure the document data requested to be printed.

Here, in order to extract the character string information of the document data requested to be printed, the monitoring module calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal using API hooking to indicate the start and end of printing (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), ExtTextOutW (), TextOutA (), TextOutW (), and TextOutW It is preferable to extract the character string information using at least one of the PolyTextOut () or TabbedTextOut () functions.

Preferably, the monitoring module stores the processed document data as one file and transmits the same to the control module.

Preferably, the control module may detect confidential information from the processed document data from the monitoring module and then perform a checksum to minimize data errors.

Preferably, the control module blocks printing of the document data requested to be printed when the number of the confidential information detected is greater than a preset reference value according to a preset security policy, and if the number of the detected confidential information is preset If the number is less than the reference value, the character processor can control the document processor of the user terminal to mask confidential information by masking a part of characters of the confidential information with a predetermined specific character.

Preferably, the confidential information may be at least one of a resident registration number, a telephone number, a card number, a corporation number, a business registration number, an account number, an email address, a passport number, a mobile phone number, or a driver's license number.

According to a second aspect of the present invention, there is provided a method for securing confidential information on a document printed through a printer connected to a user terminal using a device including a monitoring module and a control module, the method comprising the steps of: (a) Monitoring document data requested to be printed by the document processor of the user terminal using API (Application Programming Interface) hooking and extracting character string information based on printing start / end information for the document data requested to be printed Processing the document data in units of a post-page; (b) comparing the document data processed in the step (a) with at least one predetermined confidential information pattern data through the control module and detecting confidential information; And (c) analyzing the type and number of confidential information detected in the step (b) through the control module to block or secure the document data requested to be printed according to a pre-established security policy, And a method for securing confidential information on a print document using a user terminal.

Preferably, in the step (a), the monitoring module calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal by using the API hooking to extract the string information of the document data requested to be printed (), DrawTextW (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), and ExtTextOutW (), which are related to a string, The string information can be extracted by using at least one string related function among the TextOutA (), TextOutW (), PolyTextOut (), or TabbedTextOut () functions.

Preferably, after the step (a), the monitoring module may further store the processed document data as one file and transmit the stored document data to the control module.

Preferably, after step (b), the control module may further include detecting confidential information from the processed document data from the monitoring module and then performing a checksum to minimize data errors .

Preferably, in the step (c), if the number of the confidential information detected is greater than a predetermined reference value according to a security policy set in advance, the control module blocks printing of the document data requested to be printed, When the number of confidential information is smaller than a preset reference value, a part of characters of the confidential information may be masked with a predetermined specific character to control the document processor of the user terminal to secure the confidential information.

Preferably, the confidential information may be at least one of a resident registration number, a telephone number, a card number, a corporation number, a business registration number, an account number, an email address, a passport number, a mobile phone number, or a driver's license number.

A third aspect of the present invention is to provide a recording medium on which a program for executing a confidential information security method on a printed document using the above-described user terminal is recorded.

The confidential information security method on the printed document using the user terminal according to the present invention can be implemented by a computer readable code on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

For example, the computer-readable recording medium includes a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory, , And optical data storage devices.

According to the confidential information security apparatus and method of the present invention, when a document is printed through a printer directly or indirectly connected to the user terminal, printing is performed using an API hooking method There is an advantage of extracting a string from a document and analyzing it to effectively secure confidential information on a printed document.

FIG. 1 is an overall block diagram of a confidential information security device on a print document using a user terminal according to an exemplary embodiment of the present invention.
2 is a conceptual diagram illustrating a process of extracting character string information from document data requested to be printed through a confidential information security device on a printing document using a user terminal and controlling the document processor according to an embodiment of the present invention.
3 is a flowchart illustrating an exemplary method of securing confidential information on a print document using a user terminal according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a method for extracting character string information from a confidential information security method on a printed document using a user terminal according to an exemplary embodiment of the present invention.
FIG. 5 is a flowchart illustrating a process of detecting confidential information in a confidential information security method on a print document using a user terminal according to an exemplary embodiment of the present invention. Referring to FIG.
6 is a diagram showing some types of confidential information pattern data applied to an embodiment of the present invention.
FIG. 7 and FIG. 8 are flowcharts for explaining a process of blocking and securing printing of document data including confidential information among confidential information security methods on a print document using a user terminal according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the following embodiments of the present invention may be modified into various other forms, and the scope of the present invention is not limited to the embodiments described below. The embodiments of the present invention are provided to enable those skilled in the art to more fully understand the present invention.

First, 'Secreting information' mentioned throughout the present invention refers to information related to an individual (eg, resident registration number, telephone number, mobile phone number, email address, driver's license number, personal card number, ), As well as information related to the business (eg, corporate number, business registration number, corporate card number, corporate account number, etc.), and may be inclusive of all information that must be secured by other individuals and enterprises.

Meanwhile, a general printing processing process between a printer connected directly or indirectly with a user terminal such as a computer will be described.

First, when the user terminal receives a print command from the outside, the user terminal generates document information indicating a document name, a document start, a document end, a page start, and a page end of a document to be printed, The generated document information is recorded in the header of the data and is transmitted to the printer.

Accordingly, the user terminal detects the document name of the document to be printed, document start, end of document, start of page, and end of page, and detects the document name, Generates new document information for the page number being printed, converts the new document information into a language recognizable by the printer, spools the converted document information, and outputs the spooled document information to the printer.

A process of generating document information on the document name, the total number of pages, and the page number being printed in the document to be printed will be described in detail through a print architecture.

If the document name is given as a parameter when the StartDoc () function is called from a GDI (Graphics Device Interface) function (for example, GDI32.DLL) in an application program which is a document processor provided in the user terminal, For example, the DrvStartDoc () function in the case of Windows NT, and delivers the document name to the printer driver.

In the printer driver, the document name is changed into a form recognizable by a PDL (Printer Description Language) translation program and is stored in a spooler.

The GDI calls the StartPage () function of the printer driver, for example, the DrvStartPage () function in the case of Windows NT, The printer driver counts a page number every time this function is called, changes the page number into a form recognizable by the PDL translation program, and stores the page number in the spooler.

When the EndDoc () function is called from the GDI function in the application program, the printer driver obtains the total number of pages of the document through the page number counted up to that time, changes the format to a format recognizable by the PDL translation program, .

Meanwhile, when the printer receives new document information from the user terminal, the printer recognizes the document name of the currently printing document, the total number of pages, the page number being printed, the document name of the document waiting to be printed, The number of pages is displayed on the liquid crystal panel.

That is, the printer extracts data corresponding to the document name, the total number of pages, and the number of pages under printing from the PDL data transmitted from the user terminal, converts the extracted data into an image to be printed through the PDL translation program, The controller sends the converted image to the print engine to print the document.

As described above, the general printing process between the user terminal and the printer is performed by the document processor in the form of a picture in DC (Device Context) using GDI32.DLL at the time of printing. At this point, the character string is converted into a picture form.

Therefore, in an embodiment of the present invention, before the character string of the document data requested to be printed is changed to the graphic form, the start / end of printing of the document data requested to be printed using the API (Application Programming Interface) There are key features in extracting string information based on information.

FIG. 1 is a block diagram of an overall conceptual concept of a confidential information security device on a print document using a user terminal according to an exemplary embodiment of the present invention. FIG. 2 is a block diagram A conceptual diagram for explaining a process of extracting character string information from document data requested to be printed through a confidential information security device in a document and controlling a document processor.

1 and 2, a confidential information security apparatus on a print document using a user terminal according to an embodiment of the present invention includes a document (hereinafter referred to as " document ") printed through a printer 200 directly or indirectly connected to the user terminal 100 And includes a monitoring module 300, a control module 400, and the like.

Here, the user terminal 100 is typically a computer such as a desktop PC or a notebook PC. However, the user terminal 100 is not limited to this, and may be connected to the printer 200 via wire / wireless communication to print various document data Lt; RTI ID = 0.0 > wired / wireless < / RTI >

For example, the user terminal 100 may be a palm personal computer (PDA), a personal digital assistant (PDA), a smart phone, or the like capable of communicating with the printer 200 via wire / A wireless application protocol phone (WAP phone), a mobile game machine (mobile play-station), and the like.

At this time, the wired / wireless communication may be a wired / wireless network or the Internet, and the Internet may include various services existing in the TCP / IP protocol and higher layers such as HTTP (Hyper Text Transfer Protocol) Open worldwide, providing File Transfer Protocol (FTP), Domain Name System (DNS), Simple Mail Transfer Protocol (SMTP), Simple Network Management Protocol (SNMP), Network File Service (NFS) Refers to a computer network structure and provides an environment in which the user terminal 100 can be connected to the printer 200. [ Meanwhile, the Internet may be a wired or wireless Internet, or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet.

The monitoring module 300 is provided in the user terminal 100 and monitors document data requested to be printed by the document processor of the user terminal 100 through application programming interface (API) hooking, Extracts the character string information based on the print start / end information for the data, and processes the document data on a page basis.

That is, in order to extract the string information of the document data requested to be printed, the monitoring module 300 calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal 100 using API hooking, (Eg, DrawTextA (), DrawTextW (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), and ExtTextOutW (), which monitor the StartDoc , TextOutA (), TextOutW (), PolyTextOut (), TabbedTextOut (), etc.).

In addition, the monitoring module 300 preferably stores the processed document data as one file and transmits the same to the control module 400.

The control module 400 is provided in the user terminal 100 and receives the processed document data from the monitoring module 300. The control module 400 compares the at least one confidential information pattern data with the predetermined confidential information pattern data, And performs a function of detecting confidential information.

In addition, the control module 400 controls the document processor of the user terminal 100 so as to block or secure the document data requested to be printed according to a predetermined security policy by analyzing the type and number of the detected confidential information .

In addition, the control module 400 may detect confidential information from the processed document data from the monitoring module 300 and then perform a checksum to minimize data errors.

In addition, if the number of the confidential information is greater than a predetermined reference value, the control module 400 blocks printing of the document data requested to be printed according to a predetermined security policy, If it is smaller than the set reference value, the character processor can control the document processor of the user terminal 100 to mask confidential information by masking a part of character strings of the confidential information with a predetermined specific character (e.g., #, *, etc.).

Hereinafter, a method for securing confidential information on a document printed through a printer connected directly or indirectly with a user terminal using a confidential information security device on a printed document using a user terminal according to an embodiment of the present invention will be described in detail .

3 is a flowchart illustrating an exemplary method of securing confidential information on a print document using a user terminal according to an exemplary embodiment of the present invention.

Referring to FIGS. 1 to 3, when a print request is received from a document processor included in the user terminal 100, the monitoring module 300, which is applied to an exemplary embodiment of the present invention, Switch.

That is, the monitoring module 300 monitors the document data requested to be printed by the document processor of the user terminal 100 in real time using API (Application Programming Interface) hooking (S100).

Thereafter, the monitoring module 300 extracts the character string information based on the print start / end information for the document data requested to be printed, and then processes the document data in units of pages (S200).

FIG. 4 is a flowchart for explaining a process of extracting character string information from a confidential information security method on a printed document using a user terminal according to an exemplary embodiment of the present invention. First, a character string is required to detect confidential information. In order to extract such a character string, it is necessary to know the information of the start and end of printing and the point at which the character string is written in the DC (Device Context).

That is, in order to extract the string information of the document data requested to be printed, the monitoring module 300 calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal 100 using API hooking, (Eg, DrawTextA (), DrawTextW (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), and EndToc () (), ExtTextOutW (), TextOutA (), TextOutW (), PolyTextOut (), TabbedTextOut (), etc.) (For example, DocName.txt) and transfers the same to the control module 400, and switches to the normal mode.

Then, the control module 400 compares the document data processed in step S200 with at least one confidential information pattern data to detect confidential information (S300).

FIG. 5 is a flowchart for explaining a process of detecting confidential information in a confidential information security method on a print document using a user terminal according to an exemplary embodiment of the present invention. In the control module 400, In order to detect the confidential information, a predetermined file (e.g., DocName.txt) is stored in which the processed document data is stored in the monitoring module 300 after loading predetermined confidential information pattern data (e.g., Pattern.ini file) ).

Thereafter, the control module 400 compares one file stored with the processed document data with predetermined confidential information pattern data, and detects confidential information corresponding to the confidential information pattern. In this manner, when confidential information corresponding to the confidential information pattern is detected, the checksum can be checked to minimize the error detection rate and the excessive detection rate. It is desirable to store the detection result in the form of 'ini' file.

6 is a diagram showing some types of confidential information pattern data applied to an embodiment of the present invention. The definition of the confidential information pattern data, that is, the type of detection of confidential information, includes, for example, a [JUMIN] '#' Indicates the location of the personal information (for example, ###### - ###### (820917-1111111)).

And, the key value of 'jumin6' is space space. This is for extracting irregular strings. Since the format of resident registration number may be different for each document, it is desirable to provide various types. Likewise, other personal information can also be organized into types that are appropriate for each format.

Thereafter, the control module 400 analyzes the type and the number of confidential information detected in the step S300, and controls the document processor of the user terminal 100 to block or secure the document data requested to be printed according to a preset security policy (S400).

FIG. 7 and FIG. 8 are flowcharts for explaining a process of blocking and securing printing of document data including confidential information among confidential information security methods on a print document using a user terminal according to an exemplary embodiment of the present invention. The control module 400 loads the confidential information detection result file and analyzes the type and number of the confidential information to interrupt the printing if the security policy is violated.

That is, if the number of confidential information detected in step S300 is greater than a predetermined reference value according to a predetermined security policy, printing of requested document data is blocked.

For example, if the security policy is set to block printing only when 10 or more resident registration numbers are included, control is made so that printing is blocked if the number of resident registration numbers in the result log file is 10 or more, Allows printing on the back side.

In this case, the EndDoc () function normally calls the EndDoc () function to return a failure (Return Fail) to the document processor without returning success (Return).

On the other hand, in order to secure confidential information after allowing printing according to the security policy, the confidential information string is masked with specific characters (e.g., #, *, etc.) as shown in FIG.

That is, when the number of confidential information detected in step S300 is less than a preset reference value, the control module 400 masks a part of the characters of the confidential information with a predetermined character to secure the confidential information And controls the document processor of the user terminal 100.

DrawTextA (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), ExtTextOutW (), TextOutA (), and TextOutA (), TextOutW (), PolyTextOut (), TabbedTextOut (), etc.) is called, make sure the string contains confidential information. If confidential information is included, mask it and store it in the previous string area.

From the second or more calls, the previous string value and the current string value are combined to determine whether confidential information is present or absent. This is because confidential information can not be identified if confidential information is called in the print call process. When the mask is complete, it returns a string.

It is preferable that the confidential information includes at least one of a resident registration number, a telephone number, a card number, a corporation number, a business registration number, an account number, an e-mail address, a passport number, a mobile phone number or a driver's license number.

In addition, after step S200, the monitoring module 300 may further include storing the processed document data as one file and transmitting the stored document data to the control module 400. [

In addition, after step S300, the control module 400 may further include a step of detecting confidential information from the processed document data from the monitoring module 300 and then performing a checksum to minimize a data error have.

Meanwhile, the confidential information security method on the printed document using the user terminal according to an embodiment of the present invention can also be implemented as a computer-readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

For example, the computer-readable recording medium includes a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory, , And optical data storage devices.

In addition, the computer readable recording medium may be distributed and executed in a computer system connected to a computer communication network, and may be stored and executed as a code readable in a distributed manner.

Although the preferred embodiment of the confidential information security device and the method thereof on the printed document using the user terminal according to the present invention has been described above, the present invention is not limited to this, And the present invention also belongs to the present invention.

100: user terminal,
200: printer,
300: Monitoring module,
400: control module

Claims (12)

An apparatus for securing confidential information on a document printed through a printer connected to a user terminal,
The user terminal monitors the document data requested to be printed by the document processor of the user terminal by hooking API (Application Programming Interface), and outputs start / end information of printing for the document data requested to print A monitoring module for extracting string information and processing document data in page units; And
The control unit compares the processed document data received from the monitoring module with at least one confidential information pattern data to detect confidential information, analyzes the types and the number of the confidential information, And a control module for controlling the document processor of the user terminal to block or secure the document data requested to be printed.
The method according to claim 1,
The monitoring module calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal using the API hooking to extract the string information of the document data requested to be printed and displays StartDoc ( ), And EndDoc () functions in real-time, and it is possible to monitor the function in real-time by using the DrawTextA (), DrawTextW (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), ExtTextOutW (), TextOutA (), TextOutW ) Or the TabbedTextOut () function to extract the character string information using at least one of the character string related functions.
The method according to claim 1,
Wherein the monitoring module stores the processed document data as one file and transfers the stored document data to the control module.
The method according to claim 1,
Wherein the control module detects confidential information from the document data processed by the monitoring module and performs a checksum to minimize data errors.
The method according to claim 1,
The control module interrupts printing of the document data requested to be printed when the number of the confidential information detected is greater than a preset reference value according to a security policy set in advance and the number of the confidential information detected is less than a preset reference value Wherein the control unit controls the document processor of the user terminal to secure the confidential information by masking a part of the characters of the confidential information with a predetermined specific character.
The method according to claim 1,
Wherein the confidential information comprises at least one of a resident registration number, a telephone number, a card number, a corporation number, a business registration number, an account number, an e-mail address, a passport number, a mobile phone number or a driver's license number Confidential information security device on printed documents.
A method for securing confidential information on a document printed through a printer connected to a user terminal using a device including a monitoring module and a control module provided in a user terminal,
(a) monitoring document data requested to be printed to a document processor of the user terminal by using an API (Application Programming Interface) hooking through the monitoring module, and printing start / end information Extracting the character string information based on the character string and processing the document data in units of pages;
(b) comparing the document data processed in the step (a) with at least one predetermined confidential information pattern data through the control module and detecting confidential information; And
(c) analyzing the type and number of confidential information detected in the step (b) through the control module to control the document processor of the user terminal to block or secure the document data requested to be printed according to a pre- The method comprising the steps of: (a)
8. The method of claim 7,
In the step (a), the monitoring module calls the GDI32.DLL file related to the print output of the document processor provided in the user terminal using API hooking to extract the string information of the document data requested to be printed, (), DrawTextExA (), DrawTextExW (), ExtTextOutA (), ExtTextOutW (), and TextOutA (), which are related to a string, , TextOutW (), PolyTextOut (), or TabbedTextOut () functions to extract string information using at least one string-related function.
8. The method of claim 7,
The method of claim 1, further comprising the step of, after the step (a), storing the processed document data as one file and transmitting the stored document data to the control module.
8. The method of claim 7,
Further comprising: after the step (b), the control module detects confidential information from the processed document data from the monitoring module and then performs a checksum to minimize data errors. A method for securing confidential information on a printed document using a terminal.
8. The method of claim 7,
In the step (c), if the number of the confidential information detected is greater than a preset reference value, the control module blocks printing of the document data requested to be printed according to a security policy preset, Wherein the control unit controls the document processor of the user terminal so as to secure the confidential information by masking a part of characters of the confidential information string with a predetermined specific character when the number is smaller than a predetermined reference value. Confidential information security method.
8. The method of claim 7,
Wherein the confidential information comprises at least one of a resident registration number, a telephone number, a card number, a corporation number, a business registration number, an account number, an e-mail address, a passport number, a mobile phone number or a driver's license number How to secure confidential information on printed documents.

Images