KR101467228B1 - Method for preventing outflow file and device thereof - Google Patents

Abstract

A method for preventing a leak of a file and a device therefor are disclosed. The method for preventing the leak of the file performed in a computing apparatus according to one aspect of the present invention comprises the steps of storing identification information for an external device with respect to a file received from the external device connected to a wired or a wireless network; if an attempt to leak the file to the outside is performed afterwards, asking if the leak to the outside is allowed by notifying a management server preset for an input place; and allowing or blocking the leak of the file to the outside according to an allowance of the leak to the outside or not received from the management server which has determined the leak to the outside or not based on the external device.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a file outflow prevention method,

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to file leakage prevention, and more particularly, to a method and apparatus for preventing files from being leaked to the outside.

Recently, due to the development of Internet technology and communication terminals, various contents can be used anytime and anywhere, and users feel convenience. In addition, it has become possible to increase work efficiency by using personal data by using mobile devices of an individual by moving away from the existing method of using only the computer in the enterprise. However, problems due to leakage of company secret documents .

That is, in recent years, portable communication terminals such as a smart phone, a tablet PC, and the like have been widely used and are used not only for personal use but also for corporate business, .

In recent years, there has been a problem of not only malicious code that prevents some software or hardware of a computing device including a mobile device from operating properly but also malicious code that causes important internal data to leak to the outside. As a result, not only leakage of personal information but also security-important files are leaked to the outside, thereby increasing the damage.

In case of malicious code that leaks data to the outside, the process is driven by itself regardless of the user's command, and the internal data is leaked to a specific destination. As a result, not only personal information but also business-critical data can be leaked out, resulting in a security dangerous situation.

Although the malicious code can be treated by the vaccine program, in the case of the new malicious code, the vaccine may not exist and the malicious code can not be detected or cured.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made keeping in mind the above problems occurring in the prior art, and an object of the present invention is to provide a file leakage prevention method and an apparatus therefor for preventing an outflow of a security file managed by a specific organization, will be.

It is another object of the present invention to provide a file leakage prevention method and apparatus for preventing a file from being leaked to a place unsafe for security by confirming an outgoing destination.

In addition, the present invention provides a file leakage prevention method and apparatus for preventing a file that is important for security from being leaked to the outside by a malicious code.

Other objects of the present invention will become more apparent through the following preferred embodiments.

According to an aspect of the present invention, there is provided a method of preventing a file leakage performed in a computing device, the method comprising: storing identification information about the external device as information on an input destination, with respect to a file received from an external device connected by wire or wirelessly ; When it is detected that the file is attempted to be leaked out of the file in the future, And allowing or blocking the external leakage of the file according to a result of whether or not the external leakage is received from the management server that has determined the external leakage based on the external device, and executing the method Is recorded on a recording medium.

Here, by transmitting the information on the outflow destination according to the outflow to the management server, the management server can further use the outflow destination to determine whether or not the outflow is permitted.

In addition, by transmitting information on the file to the management server, the management server can use the information on the file to determine whether to allow the outflow.

The method may further include, when the external leakage is attempted regardless of a user command, processing the external leakage attempting processor as a malicious code if the external leakage is interrupted.

The method may further include the step of receiving an inquiry about permission of the outflow including information for identifying the input destination to which the file is inputted from the computing device that recognized the outflow of the file; Determining whether the file is allowed to be leaked or not by determining whether the input destination is a predetermined security target device; And transmitting to the computing device a result of the determination as to whether or not the external device is permitted to allow the computing device to make a decision to block or allow external disclosure of the file, and a program executing the method There is provided a recording medium on which the recording medium is recorded.

Here, the information on the outflow destination is received from the computing device, and it may further be used whether or not the outflow destination is a pre-designated legitimate destination in determining whether to allow the outflow.

The method further includes receiving information about the file from the computing device, determining a management class for the file, and a user class of the computing device to determine a usage right for the file in the computing device And transmit control information to the computing device to cause the computing device to delete the file if the usage right is not available.

According to another aspect of the present invention, there is provided an information processing apparatus comprising: a storage unit for storing information on at least one managed device to be managed; A communication unit for inquiring about whether or not to allow an external leak including information for identifying an input destination to which the file is inputted from a computing device that recognizes an attempt to leak the file; Determining whether the file is allowed to be leaked or not by determining whether the input destination is the security target device, determining whether the file is permitted to be leaked or not, And a control unit for controlling the communication unit to transmit the result to the computing device.

Herein, the information about the outflow destination is received from the computing device, and the control unit can further use whether or not the outflow destination is a pre-designated legitimate destination in the determination of the outflow allowance.

According to the present invention, it is possible to prevent an outflow of a security file managed by a specific organization such as a corporation by an individual computing device.

In addition, according to the present invention, it is possible to identify an outgoing destination and prevent a file from being leaked to a place unsecured for security.

In addition, according to the present invention, it is possible not only to prevent leakage of a security-important file to the outside by a malicious code, but also to identify the malicious code.

1 is a block diagram schematically illustrating an overall system for preventing file leakage according to an embodiment of the present invention;
2 is a flowchart illustrating a file leakage prevention process performed by a user terminal according to an exemplary embodiment of the present invention.
3 is a flowchart illustrating a malicious code search process performed by a user terminal according to an exemplary embodiment of the present invention.
4 is a block diagram showing the configuration of a management server according to an embodiment of the present invention;
5 is a flowchart illustrating a file leakage prevention process performed in a management server according to an embodiment of the present invention.
6 is a flowchart illustrating a process of checking a usage right for a security file performed in a management server according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout the specification and claims. The description will be omitted.

1 is a block diagram schematically showing an overall system for preventing file leakage according to an embodiment of the present invention.

Referring to FIG. 1, an overall system according to the present embodiment includes at least one security target device 10, a user terminal 20, and a management server 30.

The security target device 10 is a device having a storage means for storing files, and may be a simple storage medium such as an external hard disk, as well as a computer, a server device, and the like as shown in the drawings.

A user can input and use a file from a security target device 10 connected through a wired or wired network such as a cable, wifi, Bluetooth, or wired / wireless communication via a network using his or her own user terminal 20. As an easy example, if the security target device 10 is a computer used by a company and the user terminal 20 is a smart phone, a user can transfer files stored in the computer to a smart phone that is always carried and stored, .

Here, the user terminal 20 may be a tablet PC, a notebook computer, or a general computer as well as a smart phone as shown in the drawing. Hereinafter, it is assumed that the user terminal 20 is a mobile device such as a smart phone, for convenience of description, but it will be apparent to those skilled in the art that the present invention can also be performed in the case of a general computer .

The security target device 10 is managed by the management server 30. That is, the management server 30 manages information on the security target device 10 as member information. The information on the security target device 10 includes unique identification information for identifying each device, And the like. As the identification information of the security target device 10, for example, a unique serial number assigned to each electronic device or a MAC address may be used. It will be obvious to those skilled in the art that the respective pieces of unique identification information are given to the electronic apparatuses, so that a detailed description thereof will be omitted.

The management server 30 functions to prevent the user terminal 20 from leaking a file input from the security target device 10 to the outside. In other words, after the user terminal 20 receives a file (hereinafter, referred to as a [security file] for identification with a general file) from the security target device 10, the user terminal 20 uses the e-mail, FTP, And a leakage preventing function for preventing the leakage of the security file to an external communication terminal through the user terminal 20 in cooperation with the user terminal 20.

Hereinafter, a file leakage prevention process performed by the user terminal 20 will be described in detail.

FIG. 2 is a flowchart illustrating a file leak prevention process performed by a user terminal according to an exemplary embodiment of the present invention. FIG. 3 is a flowchart illustrating a malicious code search process performed by a user terminal according to an exemplary embodiment of the present invention. to be.

Referring to FIG. 2, when a security file is input from an external device connected by wire or wireless, the user terminal 20 stores identification information of the external device as information on the input destination (S210). The information on the input destination may be stored in a storage medium provided in the user terminal 20 itself or may be stored in a separate device (for example, a separately provided server device or a management server 30) . Here, the user terminal 20 can recognize the file received from the security target device 10 as a security file and store the input destination information. Alternatively, the user terminal 20 can store the input destination information .

Thereafter, the user terminal 20 recognizes a process for externally attempting to leak a security file (S220). For example, a process of attempting to leak a security file to the outside via a cable, a short-range wireless communication, a local network, or the Internet.

When the user terminal 20 recognizes the outflow of the security file, the outbound outflow is temporarily held, the management server 30 notifies the input destination, and inquires about the outflow permission (S230). Herein, the user terminal 20 is a data to be used by the management server 30 to determine whether or not to allow the external leakage, and includes information about the security file and information about a destination from which the security file is leaked . For example, when data is transmitted through a communication network, a source address (an address of a subject that transmits data (IP address, etc.) and a destination address (an address of a receiver to receive the data) are included as header information of a packet. The outflow destination can be confirmed by confirming this. The manner in which the management server 30 utilizes the above-described file information and the outflow destination will be described later.

The management server 30 judges whether or not the external destination is permitted by checking whether the input destination is the security target device 10. For example, the management server 30 determines whether the security target device 10 is a security target device 10, it can be determined that the outflow is not allowed.

When the user terminal 20 receives a result of the determination as to whether or not to allow the outflow from the management server 30, the user terminal 20 permits or blocks the outflow that has been held according to the reception result (S240).

According to the present embodiment, in the security management of the enterprise, the employees use a file in the company (a file stored in the security target device 10 managed by the enterprise) using a personal terminal such as a smart phone, Can be prevented.

According to another embodiment, the user terminal 20 can also check whether the outflow of the security file is caused by a malicious code.

Referring to FIG. 3 illustrating an embodiment of the present invention, when the user terminal 20 determines that the attempted outflow of the attempted security file is to be blocked (S310), it determines whether or not the process (S320).

The user terminal 20 includes input means such as a keyboard, a touch screen, and a mouse. The user terminal 20 receives and processes various commands from the user through the input means. In addition to the process by the user's command, the user terminal 20 may attempt to leak data to the outside through the communication network due to the process by the malicious code.

If the external leakage attempt is not based on a user command, the user terminal 20 processes the processor that executed the process of attempting the external leakage as a malicious code (S330). Here, a process that is processed by malicious code may be limited to an outflow of the outflow through the communication network. As an easy example, leakage through a cable or the like, leakage to an external device connected to a local network, and the like may not be handled as a malicious code. As will be described later, it may be determined whether or not the malicious code is processed according to the outflow destination. For example, if the outbound destination is an unknown destination that is not to be managed (e.g., user terminal 20 or management server 30), the processor may be treated as a malicious code.

Hereinafter, the configuration of the management server 30 and the process of performing the external leakage prevention in the management server 30 will be described.

FIG. 4 is a block diagram illustrating a configuration of a management server according to an embodiment of the present invention, and FIG. 5 is a flowchart illustrating a file leakage prevention process performed in a management server according to an embodiment of the present invention.

4, the management server 30 includes a communication unit 410, a storage unit 420, and a control unit 430. The control unit 430 includes an outflow permission determination unit 431 and an authority verification unit 433. [ . ≪ / RTI >

The communication unit 410 is a means for communicating with terminal devices such as the user terminal 20 via a network. The management server 30 receives a file from a computing device that recognizes an attempt to leak a file through the communication unit 410 And receives an outflow allowance inquiry including information for identifying the input destination to which the input is received.

The storage unit 420 stores information on at least one security target device 10 managed. In addition, the storage unit 420 may also store information about the security file to be managed. For example, the security file management unit manages a file in which security is important, as a security file, among the files stored in the security target apparatuses 10. Therefore, only the subsequent security files can be blocked and managed by the user terminal 20 to the outside. And, according to an example, a managed security file can be granted a usage right, and it can be given an authorization level for users who can use the security file easily. For example, if the security level of an arbitrary security file is "A", only the security level "A" or higher is allowed to use the security file.

The control unit 430 performs overall control functions of the respective components of the management server 30. In particular, the control unit 430 determines whether or not the user terminal 20 It is judged whether or not the leakage is permitted. That is, the control unit 430 determines whether the file to which the file is attempted to be leaked is the security target device 10, thereby determining whether the file is permitted to be leaked out of the file, and if the computing device blocks the outflow of the security file And controls the communication unit to transmit a result of the determination as to whether or not the external leakage is permitted to the computing device so as to allow the determination.

The leakage permission determination unit 431 of the control unit 430 performs a function of determining whether to allow or prohibit the outflow of the security file as described above. As an easy example, the outflow may be determined to be blocked if the destination is the security target device 10, a security file that is important to the security to be managed, or the outflow destination is not a pre-registered secure location.

The authority checking unit 431 of the control unit 430 checks the authority level of the corresponding file according to the file information received from the user terminal 20 attempting to lease the file to the outside and the usage right of the user terminal 20 And determines whether the user of the user terminal 20 is authorized to actually use the file. This is to prevent users who do not have permission to use security files. According to the security level of the security file, if the usage right of the user terminal 20 can not be used, the management server 30 can transmit a control command to delete the file to the user terminal 20. [ Accordingly, the user terminal 20 deletes the file as well as blocking the outflow of the corresponding file that attempted the outflow according to the control command.

Hereinafter, the external leakage prevention process in the management server 30 will be described.

Referring to FIG. 5, the management server 30 receives an external leakage allowance inquiry from any computing device (i.e., the user terminal 20) (S510). In step S520, the management server 30 determines whether the external destination is permitted to be leaked by checking whether the input destination of the attempted file is the security target device 10 by checking the information on the received destination.

The management server 30 provides information on whether or not the external device can be allowed to flow out, determined in the computing device, as a response to the external flow allowance inquiry (S530). Accordingly, the computing device permits or blocks the outflow of the file according to the determination.

As described above, the usage right of the user terminal 20 with respect to the file that is attempted to be leaked out can be confirmed and the processing corresponding thereto can be performed. Referring to the drawings, a description will be made of a processing procedure therefor.

FIG. 6 is a flowchart illustrating a process of checking a usage right for a security file performed in the management server according to an exemplary embodiment of the present invention.

Referring to FIG. 6, when the management server 30 determines that the outflow is impossible as a result of the determination as to whether or not the outflow is allowed by the computing device (S610), the management server 30 transmits information about the file and the computing device And confirms the usage right (S620). Since this has been described in detail with reference to FIG. 5, a duplicate description will be omitted.

If the computing device does not have the right to use the file, the management server 30 transmits a deletion command for the file to the computing device (S630).

The above-described file leakage prevention method according to the present invention can be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that various modifications and changes may be made.

10: Security Target Device
20: User terminal
30: Management server

Claims (10)

A method of preventing a file leakage performed in a computing device,
Storing identification information on the external device as input destination information so as to correspond to the file when the file is received from an external device connected by wire or wirelessly;
If it is detected that the file is attempted to be leaked out later, inquiring about whether or not the file is permitted to leak to the predetermined management server by providing the input destination information to the predetermined management server; And
The method comprising the steps of: allowing the external device to identify the external device according to the input destination information, and allowing or blocking external leakage of the file according to a result of the external leakage permission received from the management server, .
The method according to claim 1,
Wherein the management server transmits the information on the outflow destination according to the outflow to the management server so that the management server further uses the outflow destination to determine whether the outflow is permitted or not.
The method according to claim 1,
Wherein the information about the file is transmitted to the management server so that the management server uses information about the file to determine whether the file is allowed to be leaked.
The method according to claim 1,
Further comprising the step of, when the outflow is attempted irrespective of a user command, and if the outflow is blocked, processing the processor that has attempted the outflow as a malicious code.
A method of preventing a file leakage from a management server,
A file from a computing device that stores identification information about the external device as input destination information in correspondence with the file received from an external device connected by wire or wireless, Receiving;
Determining whether the file is permitted to be leaked out by determining whether the external device according to the input destination information received from the computing device is a predetermined security target device; And
Sending a result of the determination as to whether or not the outflow is allowed to the computing device to make a determination that the computing device blocks or permits the outflow of the file.
The method of claim 5,
Wherein the information about the outflow destination is received from the computing device, and whether the outflow destination is a legitimate destination is further used for determining whether the outflow is allowed or not.
The method of claim 5,
Further comprising receiving information about the file from the computing device, determining a management class for the file and a user class of the computing device to determine a usage right for the file at the computing device, ,
And if the usage right is not available, sending the control information to the computing device to cause the computing device to delete the file.
8. A recording medium in which a program for performing the method of any one of claims 1 to 7 is recorded so as to be read by a computer.
A storage unit for storing information on at least one security target device managed;
A file from a computing device that stores identification information about the external device as input destination information in correspondence with the file received from an external device connected by wire or wireless, A communication unit for receiving the data; And
Determining whether or not the file is allowed to be leaked out by determining whether the external device according to the input destination information received from the computing device is the security target device, And a control unit for controlling the communication unit to transmit a result of the determination as to whether or not the external leakage is permitted to the computing device so as to allow the determination.
The method of claim 9,
Receiving information about an outflow destination from the computing device,
Wherein the control unit further uses whether the outflow destination is a predetermined legitimate destination or not in determining whether the outflow is permitted or not.

Images