KR102305680B1 - System for storing security information using a plurality of storages - Google Patents

Abstract

The present invention relates to a security information storage system and method, and more particularly, in a state in which at least one main storage and at least one sub-storage are connected, an encrypted security area (hereinafter referred to as “secure disk” or "safe") and can only be used within the security policy when the sub storage and main storage are connected alone, and create and change files on the secure disk only when the plurality of main storage and sub storage are all connected And it relates to a security information storage system and method using a plurality of storage that can be deleted and security settings can be performed.

Description

Security information storage system using a plurality of storages {System for storing security information using a plurality of storages}

The present invention relates to a security information storage system and method, and more particularly, in a state in which at least one main storage and at least one sub-storage are connected, an encrypted secure area (hereinafter referred to as "secure disk" or "Safety"), can be used only within the security policy when the sub storage and the main storage are connected alone And it relates to a security information storage system and method using a plurality of storage that can be deleted and security settings can be performed.

By the spread of high-speed Internet and the grafting of wireless communication technology to the masses, a cloud computing environment has been established in which various services can be provided by accessing the Internet network anytime, anywhere.

And as various computers such as desktop computers, personal computers, notebook computers, tablet computers, smart devices such as smart phones and smart pads are popularized, most users store and use important information in their computers.

The dissemination of such computers and the construction of a cloud computing environment assist people to facilitate their work, provide enjoyment, and provide convenience in various fields.

However, storing and managing important information in such a computer and using a cloud computing environment provides an environment in which one's terminal can be hacked by anyone at any time, anywhere, It provides an environment where important information can be easily exposed and leaked.

Due to these problems, various security systems are being applied to computers. Examples of such security systems include a login-type security system that inputs an ID/password when booting a computer, and the entire storage device of a computer or a partial area of the storage device, such as in the prior patent publication [10-2009-0067649]. An encryption-type storage device security system that encrypts data or encrypts only selected specific files, and allows use of some areas or files only through a specific authentication procedure, and a secure storage system that hides specific disk areas, folders, and files from view, etc. There is this.

The storage device security system has been used in places where multiple people use multiple computers, such as PC rooms and corporations, but has recently been extended to individuals due to the spread of portable computers.

However, most of the storage device security systems are configured to use the encrypted security area only by input of an ID and password or password, as in the above-mentioned prior patent publications, so there is a problem in that security is poor.

That is, the conventional storage device security system has a problem in that all information of the computer may be leaked if only the ID and password or password is exposed.

In addition, the conventional storage device security system can know that there is a separate encrypted area in the storage device even if the ID and password are not known, so that an expert by a hacker or the like can cause an attempt to hack the ID and password in an arbitrary area, ID and password could be hacked by such an attempt, and there was a problem that information could be leaked.

In addition, in a conventional secure storage system that hides a specific disk area, folder, and file, when a user has malicious intention and uses the secure storage to which the conventional secure storage system is applied to hide and then extracts important security information, the security administrator can remove the hidden area. Since it cannot be confirmed, there is a problem that information leakage using a secure storage system may occur. That is, the conventional security information storage system has a problem in that it can be reversed by hackers and spies.

Patent Publication No. 10-2009-0067649

Therefore, an object of the present invention is to create an encrypted secure disk in the connected storages while at least one main storage and at least one sub storage are connected, and when the sub storage and the main storage are connected alone, within the security policy Security information storage system and method using a plurality of storage that can be used only in is to provide.

Another object of the present invention is to provide a security information storage system and method using a plurality of storages for backing up data stored in main storage and sub storage to storage of other computer devices connected through a network when a preset mirroring condition is satisfied. is in

In addition, another object of the present invention is to allow the files stored in the secure disk of the main storage to be exported or shared to the outside through any one or more of e-mail, web hard, and cloud services, but to the agent, which is a dedicated program. Security information using a plurality of storages so that the file can be used only within the security policy by including the file in the agent and attaching the agent to any one of e-mail, web hard, and cloud so that it can be exported or shared to the outside To provide a storage system and method.

A security information storage system using a plurality of storages according to the present invention for achieving the above object includes: a main storage; removable sub-storage; and at least one of the main storage and one or more sub-storages as components, respectively, to obtain the number and storage identification information, and to the main storage and the sub-storage in a state in which the main storage and the sub-storage of the obtained storage identification information are connected. Create a secure disk, create a disk security application including an encryption module for encrypting a file stored in the secured disk, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage, and create By executing the disk security application, the properties of the files stored in the secure disk are set differently according to whether the main storage and sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and at least one and a storage encryption device that controls to change and delete files stored in the secured disks of the main storage and the sub storage when connecting the sub storage of the .

The number of the main storage is one, a hard disk configured inside the storage encryption device, the number of the sub storage is two, and it is an asynchronous serial bus memory.

The storage encryption device includes: a kernel layer unit for mounting the secured disks of the main storage and the sub storage as drives and processing a file output to the secured disk and a file input from the secured disk; Acquire storage identification information of the main storage and sub storage, and create a secure disk in the main storage and the sub storage in a state in which the main storage and the two sub storages of the obtained storage identification information are connected, and store in the secure disk a secure disk generation unit for generating a disk security application including an encryption module for encrypting a file to be used, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage; and by executing the created disk security application, different properties of the files stored in the secured disk are set according to whether the main storage and sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and When at least one sub-storage is connected, files stored on the secured disk of the main storage and the sub-storage are controlled to be changed and deleted, and when both the sub-storage is connected, the secured disk setting information of the secured disk is controlled to be changed It is characterized in that it includes a disk security application unit.

The secured disk generating unit provides a user with a secured disk setting user interface means, receives the selection of the main storage through the secured disk setup user interface means, and receives the selection of the two sub-storages, the number of the main storage and the sub-storage and a secure disk setting unit configured to obtain and store the storage identification information. A component complete inspection unit that performs a component complete inspection that checks whether the main storage and sub storage of storage identification information for one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected ; a sub-secured disk generation unit that creates a secured disk in the sub-storage when it is determined that all components are configured through the component complete inspection unit; and when it is determined through the component complete inspection unit that all components are configured, a secured disk is created in the sub storage, and then the sub secured disk creation unit instructs the sub secured disk to be created, and creates a secured disk of the sub storage Then, an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and a main secure disk generating unit for generating a disk security application including storage identification information of the main storage and sub storage comprising: characterized in that

The main secure disk generation unit, when it is determined that all components are configured through the component complete inspection unit, creates a secured disk in the sub storage and then instructs the sub secured disk generation unit to create a sub secured disk. disk creation processing unit; and an encryption module for encrypting a file stored in the secured disk, a decryption module for decrypting the encrypted file, storage identification information of the main storage and sub storage, and an encryption method of the file and activation and deactivation of the secured disk and a main disk security application unit for generating a disk security application including a security policy including security identification information for

The main secure disk generation processing unit includes a secure data area for storing files, a digital key and a destruction key, and encryption method information for encrypting the secure disk when it is determined that all components are configured through the component complete inspection unit a secured disk configuration unit for generating a secured disk including a digital key area including policy information including; and an encryption unit generating an encryption module for encrypting a file and a decryption module for decrypting the encrypted file according to the encryption method of the policy information of the digital key, wherein the disk security application unit includes the digital key, It is characterized in that the position of the secured disk is found by the digital key, and the secure disk is activated and deactivated.

The sub-secured disk generation unit may include: a sub-secured disk generation processor configured to create a secured disk in the sub storage and set the secured disk as a read attribute when it is determined that all components are configured through the component complete inspection unit; and a decryption module for decrypting a file encrypted and stored in the secure disk of the sub storage, and a sub disk security application that is stored in the sub storage by creating a sub disk security application including storage identification information of the main storage and the sub storage It is characterized in that it includes a part generator.

The sub-disk security application is stored in a booting area of the USB memory, which is the sub-storage, and is configured to be automatically executed by the computer when the USB memory is inserted into the computer.

The sub-disk security application is stored in an area other than the secured disk of the sub-storage and is configured to be executed when a user's execution request occurs through a computer to which the sub-storage is connected.

The disk security application unit may include: a setting information storage unit having a component identification information storage unit for storing storage identification information of the main storage and sub storage, which are the components, and a policy information storage unit for storing the policy information; and different properties of the files stored in the secure disk according to whether the main storage and sub-storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected and the number of connections to the sub-storage, and at least one main storage and Control to change and delete files stored in the secured disk of the main storage and the sub storage when at least one sub storage is connected, and control to change the secure disk setting information of the secured disk when both sub storages are connected and a main secured disk activation control unit having a main secured disk service execution unit.

The main secure disk service execution unit may include: a component complete inspection unit that checks whether all of the components are connected or only some are connected according to the stored storage identification information; an input/output file setting unit for setting attributes of files stored in one or more secure disks of the connected main storage and sub-storage according to the result of the component completeness inspection performed by the component complete inspection unit; an encryption unit for encrypting a file stored in the secure disk and decrypting a file read from the secure disk; And when the secure disk application is executed, the main storage and sub storage having the secure disk are found, the secure disk is found in the connected storage, the found secure disk is mounted on the drive to activate it, and when a deactivation request occurs, the mounted drive is removed. and a secure disk activation unit for inactivating the secure disk.

The main secure disk service execution unit, through the component complete inspection unit when a file attachment event to attach to any one of e-mail, web hard, and cloud of a file stored in one of the main storage and the sub storage on the secure disk occurs When the main storage and at least one sub-storage are connected, the encrypted file to be attached, a decryption module for decrypting the file, an encryption module for re-encrypting the decrypted file, and a security policy limiting the use of the file After generating the agent, it characterized in that it further comprises a file export processing unit for attaching the created agent to any one of e-mail, web hard, and cloud.

The security policy may include at least one of a timestamp policy allowing the file to be used only for a certain period of time and a usage frequency limiting policy allowing the file to be used only a certain number of times.

The main secure disk service execution unit checks whether a preset mirroring condition is satisfied, and when the mirroring condition is satisfied, the files stored in the secure disk of at least one connected storage among the main storage and the sub-storage are backed up to the mirroring system connected through the network. It characterized in that it further comprises a mirroring processing unit for configuring the same files as the files stored in the secure disk in the mirroring system.

The mirroring condition is characterized in that it includes a predetermined period, whether a predetermined time has passed since the time when the file stored on the secure disk is stored, the storage of a new file, and an increase in the capacity of a predetermined predetermined capacity unit.

The disk security application unit may include: a setting information storage unit having a component identification information storage unit for storing storage identification information of the main storage and sub storage, which are the components, and a policy information storage unit for storing the policy information; and different properties of the files stored in the secure disk according to whether the main storage and sub-storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected and the number of connections to the sub-storage, and at least one main storage and When at least one sub-storage is connected, files stored on the secured disk of the main storage and the sub-storage are controlled to be changed and deleted, and when both the sub-storage is connected, the secured disk setting information of the secured disk is controlled to be changed and a main secured disk activation control unit having a main secured disk service execution unit.

The disk security application unit may include: a setting information storage unit including a component identification information storage unit for storing storage identification information of the main storage and sub storage, which are the components; and the decryption module, wherein the main secure disk activation control unit is called when the main storage, which is a component corresponding to the storage identification information of the setting information storage unit, is connected, and if the main storage is not connected, stored in the secure disk and a sub-secured disk activation control unit having a sub-secured disk service execution unit for decrypting and executing the read attribute file by the decryption module.

A security information storage system using a plurality of storages according to the present invention for achieving the above object: acquires at least one main storage and one or more sub-storage as components, and obtains each number and storage identification information, An encryption module for generating a secure disk in the main storage and the sub storage in a state in which the main storage and the sub storage of the storage identification information are connected, and encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and a secure disk creation process of creating a disk security application including storage identification information of the main storage and the sub storage; and by executing the created disk security application, different properties of the files stored in the secured disk are set according to whether the main storage and sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and and a process of using a secured disk to control files stored in the secured disks of the main storage and the sub storage to be changed and deleted when at least one sub-storage is connected.

In the secure disk creation process, at least one main storage and one or more sub-storages are used as components to obtain each number and storage identification information, and the main storage and sub-storage of the obtained storage identification information are connected to the main storage and sub-storage. Secure disk creation step of creating a secure disk in the storage and sub-storage; and an application generating step of generating a disk security application including an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage characterized.

In the secure disk creation step, a secure disk setting user interface means is provided to the user, the main storage is selected through the secure disk setting user interface means, and the two sub-storages are selected, and the main storage and the sub-storage are selected. a secure disk setting step of acquiring and storing the number and the storage identification information; Component complete inspection to perform a component complete inspection to check whether the main storage and sub storage of storage identification information for one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected step; a main storage secured disk creation step of instructing the sub secured disk creation unit to create a sub secured disk after creating a secured disk in the sub storage when it is determined through the component complete inspection unit that all components are configured; and a sub-storage secure disk creation step of creating a secure disk in the sub-storage.

The step of creating the main storage secured disk includes: a digital key allocating step of allocating a digital key area for identifying the secured disk area; a digital key generation step of generating a digital key including a key and information for activating a secure disk and storing the digital key in the digital key area; an encryption step of encrypting files in a secure data area other than the digital key area of the secure disk; and an application creation step of creating and storing a main disk security application including the digital key, an encryption module for encrypting a file stored in the secure data area, a decryption module for decrypting the encrypted file, and unique identification information of storages. characterized by including.

The main storage secured disk creation step includes a sub storage identification information allocation step of generating and recording unique sub storage identification information in the sub storage if the sub storage is a portable memory that does not have unique storage identification information when the secured disk is created. Further comprising, characterized in that the main disk security application including the sub-storage identification information allocated in the application creation step is created.

The sub-storage secured disk creation step includes: a digital key allocating step of allocating a digital key area for identifying the secured disk area; a digital key generation step of generating a digital key including a key and information for activating a secure disk and storing the digital key in the digital key area; an encryption step of encrypting files in a secure data area other than the digital key area of the secure disk; and an application creation step of generating a sub-disk security application including the digital key, a decryption module for decrypting the file encrypted and stored in the secure data area, and sub-storage identification information and storing it in the sub-storage characterized.

The sub-storage secure disk creation step includes a sub-storage identification information allocating step of creating and recording unique sub-storage identification information in the sub-storage if the sub-storage is a portable memory that does not include unique storage identification information when the secured disk is created. Further comprising, characterized in that the sub-disk security application including the main storage identification information and the sub-storage identification information allocated in the application creation step is created.

The process of using the secured disk may include: an application determination step of determining whether the disk security application is a main disk security application when the disk security application is driven; Main storage secure disk activation step of activating the main storage secure disk if the main disk security application; a sub-storage connection check step of determining whether at least one sub-storage connected when the secure disk is created is connected; an encryption/decryption module driving step of driving an encryption module and a decryption module if the sub-storage connected when the secure disk is created is connected; a file attribute setting step of setting read/write attributes for files stored in the secured disks of the main storage and the sub storage; and a file input/output processing step of encrypting and decrypting files input/output to and from the secured disks of the main storage and the sub-storage.

The process of using the secured disk may include: driving a decryption module for driving a decryption module if the sub storage connected when the secure disk is created in the sub storage connection check step is not connected; a file property setting step of setting files of the secured disk of the main storage as read properties; and a file output processing step of decoding and processing a file output from the secured disk of the main storage.

The secure disk use process may include: a file write monitoring step of checking whether a file input processing request is generated by a file write command while the file output processing step is performed; and a sub-storage insertion request step of displaying a message requesting insertion of the sub-storage when the file write command is generated, wherein when the sub-storage is inserted, a process subsequent to the operation of the encryption/decryption module is performed do it with

The secure disk use process may include a sub storage secure disk activation step of activating the secure disk of the sub storage if the application driven in the application determination step is a sub disk security application; a main storage connection check step of determining whether the main storage connected when the secure disk is created is connected;

an encryption/decryption module driving step of driving an encryption module and a decryption module if the main storage connected when the secure disk is created is connected; a file attribute setting step of setting read/write attributes for files stored in the secured disks of the main storage and the sub storage; and a file input/output processing step of encrypting and decrypting files input/output to and from the secured disks of the main storage and the sub-storage.

The process of using the secured disk may include: driving a decryption module for driving a decryption module if it is determined in the main storage connection check step that the main storage connected when the secure disk is created is not connected; a file attribute setting step of setting read attributes for files stored in the secured disk of the sub storage; and a file processing step of processing a file stored in the secure disk to be readable by performing a decryption process upon an open request for the file.

The secure disk use process includes an encrypted file attachment requested when an event of attaching a file to any one of e-mail, web hard, and cloud for a file stored in the secure disk occurs during the file input/output processing of the file input/output processing step. It includes, as an executable application program, sets the properties of the file to read/write only by execution, decrypts and encrypts the file, and creates an agent that enables editing of the file, e-mail, web hard and cloud It characterized in that it further comprises the step of exporting the file attached to any one.

The step of exporting the file may include: a file attachment event monitoring step of monitoring whether a file attachment event requesting attachment of an e-mail file to a file stored in the secure disk occurs during the file input/output process; a sub-storage connection check step of checking whether the sub-storage connected when the secure disk is created is connected when a file attachment event occurs; a security policy setting step of setting a security policy for a selected file when the sub storage is connected; It includes the file, encryption module, decryption module, and security policy, and drives the encryption module and decryption module by execution as an executable application program, and sets read/write properties to the file in the security policy to set the file an agent creation step of creating an agent that enables editing of ; and a file attachment step of attaching the generated agent to any one of email, web hard, and cloud.

According to the present invention, a secure disk can be created in the main storage and the sub-storage only when there is at least one main storage and at least one sub-storage directly connected to the storage encryption device, and at least one main storage connected when the secure disk is created. And since it is possible to change and delete files on the secure disk of the storage only when at least one or more sub-storage is connected, a third party connects any sub-storage to the storage encryption device and saves the files stored in the secure disk of the main storage. Even if it is copied, it has the effect of restricting its use.

In addition, even if the file in the main storage is leaked by connecting the sub-storage where the secure disk is created according to the present invention, conversely, even if the security identification information is known from the outside, it has only limited properties, so use in other storage is restricted. This has the effect of increasing security.

In addition, the present invention includes the encryption of the file and the encrypted file when it is necessary to export information, that is, a file to the outside, and creates and attaches an agent that allows the use of the file only within the security policy, so that the mail can be attached. It has the effect of minimizing information leakage while improving work efficiency by leaving a record of file export by transmission and allowing the agent to use the file included only within the security policy.

In addition, the present invention is a storage encryption device that backs up the data stored in the secured disk area of the main storage when the mirroring condition is satisfied, so that security information can be safely preserved in case a third party damages the secured disk area of the main storage. have an effect

1 is a diagram showing the configuration of a security information storage system using a plurality of storage according to the present invention.
2 is a diagram showing the configuration of a storage encryption device of a security information storage system using a plurality of storage according to the present invention.
3 is a view showing the detailed configuration of the main and sub secured disk generation units of the secured disk generation unit of the storage encryption apparatus according to the present invention.
4 is a view showing a detailed configuration of the main secure disk activation control unit of the disk security application unit of the storage encryption device according to the present invention.
5 is a diagram showing the detailed configuration of the sub-secure disk activation control unit of the disk security application unit of the storage encryption device according to the present invention.
6 is a diagram showing the configuration of an agent execution device according to the present invention.
7 is a diagram illustrating a mirroring system of a security information storage system using a plurality of storages according to an embodiment of the present invention.
8 is a flowchart illustrating a method for storing security information using a plurality of storages according to the present invention.
9 is a flowchart illustrating a secure disk creation method of a secure information storage method using a plurality of storages according to the present invention.
10 is a flowchart illustrating a component complete inspection method of the secure disk creation method according to the present invention.
11 is a flowchart illustrating a main storage secured disk creation method of the secured disk creation method according to the present invention.
12 is a flowchart illustrating a method for creating a sub-storage secured disk in the method for creating a secured disk according to the present invention.
13 is a flowchart illustrating a secure disk setting method of a secure information storage method using a plurality of storages according to the present invention.
14 is a flowchart illustrating a method of using a secure disk in a method of storing secure information using a plurality of storages according to the present invention.
15 is a flowchart illustrating a secure disk activation method of the secure information storage method using a plurality of storages according to the present invention.
16 is a flowchart illustrating a method of exporting a file from a secured disk in the method for storing security information using a plurality of storages according to the present invention.
17 is a flowchart illustrating a method of using a file exported by a method of exporting a secured disk file to the outside of a method of storing security information using a plurality of storages according to the present invention.

Hereinafter, the configuration and operation of a security information storage system using a plurality of storages according to the present invention will be described with reference to the accompanying drawings, and a security information storage method in the system will be described.

1 is a diagram showing the configuration of a security information storage system using a plurality of storage according to the present invention.

The security information storage system 1000 using a plurality of storages according to the present invention includes at least one sub storage 100 , at least one main storage 200 , and a storage encryption device 300 .

The main storage 200 is a storage device having main storage identification information and a storage space of a predetermined capacity. The main storage 200 may be a hard disk, a high-speed semiconductor mass storage device (Solid Stage Disk: SSD), a Universal Serial Bus (USB), etc., but the storage encryption device 300 is used Since it is a storage device that uses

The sub-storage 100 is a storage device having a storage space of a certain capacity, and may be a hard disk or SSD having sub-storage identification information, or an asynchronous serial bus (USB) memory that does not have sub-storage identification information. It could also be a portable mass storage device. However, the sub storage 100 is a storage device that acts like a key according to the present invention, and it is preferable that it be a removable and portable storage device such as a USB memory.

The storage encryption device 300 has a capacity set in each of the main storage 200 and the sub-storage 100 when a secure disk creation request occurs while at least one or more of the main storage 200 and the at least one or more sub-storage 100 are connected. Creates a secure disk with a secure data area for The capacity of the secure disk may be the total capacity of the main storage or the sub storage, or may be a part of the capacity.

The secure disk includes a digital key area and a secure data area. The secure disk configuration and creation method is disclosed in Republic of Korea Patent No. 10-1442539 (September 15, 2014) (hereinafter referred to as "Prior Art 1") and Patent Registration 10-1476222 (December 18, 2014) (hereinafter referred to as "Prior Art 2"). Since it is described in detail in [Storage system and method having a secure storage device], a detailed description thereof will be omitted.

In the prior art 1 and the prior art 2, the secure disk is configured to be invisible when it is deactivated. However, in the present invention, the secured disk may be mapped to an arbitrary file visible when the secured disk is deactivated and stored in the corresponding storage. That is, the secure disk is mapped to the A.doc file and saved. That is, the secure disk is created with the name A.doc. By configuring in this way, it will be possible to prevent the secure disk from leaking the created storage without the security administrator's knowledge. Since the technique of configuring the disk area by mapping the arbitrary file itself is well known to those of ordinary skill in the art, a detailed description thereof will be omitted.

According to the present invention, when the secure disk is created in the main storage 200 and the sub storage 100, when the main storage 200 and the sub storage 100 have unique identification information, the storage encryption device 300 is the main It acquires and manages storage identification information that is unique identification information of the storage 200 and the sub storage 100, and when there is no storage identification information in at least one of the main storage 200 and the sub storage 100, unique storage identification information Creates, allocates, stores, and manages the storage. The generated storage identification information may be stored in the general area of the corresponding storage or in the digital key area of the secure disk. .

In addition, the storage encryption device 300 may activate or deactivate the secure disk, set a secure disk security policy, store the set security policy, and may include at least one of an encryption module and a decryption module, A disk security application is created to manage changes and deletions of files stored or stored in the secured data area of the secured disk according to the security policy. The disk security application may be configured to operate in both the main storage mode and the sub storage mode, or may consist of one application operating only in the main storage mode and two sub disk security applications operating only in the sub storage mode.

When secured disks are created in the main storage 200 and the sub storage 100 and a disk security application is created, the storage encryption device 300 changes the file stored in the secured disk by the disk security application or In the case of deletion, when the component is complete by performing a component complete inspection to check whether at least one main storage 200 and at least one sub storage 100 that were connected when the secure disk is created are connected, Allows you to change or delete files stored on the secure disk.

If the components are not complete and only the main storage 200 is connected, the storage encryption device 300 can be used within a preset security policy. That is, the storage encryption device 300 is capable of creating a new file, but sets only the read attribute for the files stored in the secure disk, and manages the file to be read only.

The disk security application may be stored in an arbitrary area of the main storage 200 and may be stored in a booting area of the sub storage 100 . This is to automatically execute the disk security application when the main storage 200 and the sub storage 100 are portable storage devices such as a USB memory device when connected to any computer device.

The security policy includes whether or not security identification information authentication is applied for activating the secure disk of the main storage 200 and the sub storage 100 and security identification information according to the application, whether to allow export of files through e-mail, external files It includes the timestamp and usage limit policy for the file when exporting is allowed, and the properties (read/write) of the file.

The timestamp is set for each folder or file, and information about the period of use of the folder and file is stored.

2 is a diagram showing the configuration of a storage encryption device of a security information storage system using a plurality of storage according to the present invention.

Referring to FIG. 2 , the storage encryption device 300 includes a secure disk generation unit 400 , a disk security application unit 500 , and a kernel layer unit 600 .

The secure disk generating unit 400 may be configured in the storage encryption device 300 , and the disk security application unit 500 may be configured in both the storage encryption device 300 and the general computer device. However, when configured in a computer device, only the disk security application unit including only the sub secured disk activation control unit 530 will be configured. That is, when the sub storage 100 such as a USB memory is connected to an external computer, the sub secure disk activation control unit 530 of the disk security application unit 500 is stored in the sub storage 100 according to the present invention. It will be activated by running the sub disk security application.

The secured disk generation unit 400 includes a secured disk setting unit 410 , a component complete inspection unit 420 , a main secured disk generation unit 430 , and a sub secured disk generation unit 440 .

The secured disk setting unit 410 provides a secure disk creation setting user interface means to the user to create a secured disk, the capacity of the secured disk for each main storage 200 and sub storage 100, encryption method, security identification information, etc. and set the security policy.

The component completeness inspection unit 420 performs a component completeness inspection to check whether the components for constituting the security information storage system according to the present invention are connected. In order to configure the security information storage system according to the present invention, at least one main storage 200 and at least one sub storage 100 must be connected to the storage encryption device 300 . The number of the main storage 200 and the sub storage 100 may be configured to be specified in the secure disk setting unit 410 .

In the case where the component completeness inspection unit 420 has one main storage 200 and two sub-storages 100 , for example, when one main storage 200 and one sub-storage 100 are connected And, it will be determined that the components are complete when one main storage 200 and two sub storage 100 are all connected.

The main secured disk generating unit 430 creates a secured disk in the main storage 200 according to the main secured disk setting information set in the secured disk setting unit 410 and encrypts the data of the secured disk. In addition, the main secured disk generation unit 430 creates a main disk security application after the secure disk is created. At this time, the generated main disk security application may be configured to be executed by the user, may be configured to be automatically executed, and may be configured to be automatically executed every time the user boots.

The sub secured disk generating unit 440 creates a secured disk in the sub storage 100 according to the sub secured disk setting information set in the secured disk setting unit 410 and encrypts data of the secured disk. The sub secured disk creation unit 440 will also create a sub disk security application after the secure disk is created and store it in one of the boot area, the general data area, and the secured disk of the sub storage 100 .

When stored in the boot area, whenever the sub storage 100 is connected to the storage encryption device 300 or any computer device, the sub disk security application will be executed by the connected device.

The disk security application unit 500 includes a main secured disk activation control unit 510 and a sub secured disk activation control unit 530 .

The main secure disk activation control unit 510 is driven when the main disk security application is executed to control the activation and deactivation of the main storage 200 and the sub storage 100 according to the present invention, and when activated, it is connected when the secure disk is created. , defines the properties of data stored in the secure data area of the secure disk, ie, files, depending on whether the sub storage 100 is connected or not. When a secured disk is created while one main storage 200 and two sub storage 100 are connected, the main secured disk activation control unit 510 determines that when no sub storage 100 is currently connected, the By giving only the read attribute to the files of the secured disk, creation of new files is possible, but it is controlled so that changes and deletions are impossible, and when one or more sub storage 100 is connected, the files of the secured disk By giving read and write properties, it controls so that files stored in the secure disk can be modified, changed, or deleted, and when two sub-storage 100 are connected, file creation, change, and deletion are possible, It controls to change the secured disk settings such as policy, security identification information, and secured disk capacity.

The sub-secured disk activation control unit 530 is a sub-storage stored in the sub-storage 100 when the sub-storage 100 in which the secured disk is created is connected to the storage encryption device 300 or connected to a general computer as described above. It is configured on the device by the execution of the security application.

The sub secured disk activation control unit 530 controls activation and deactivation of the secured disk of the sub storage 100, decrypts a file stored in the secured data area of the secured disk upon activation, and controls so that only reading is possible in the configured device.

The kernel layer unit 600 is configured between the disk security application unit 500 , the main storage 200 and the sub storage 100 , and performs connection management of storages, and an input/output request generated from the disk security application unit 500 . data to be stored in the corresponding storage and data input/output processing for input/output of stored data is performed.

3 is a view showing the detailed configuration of the main and sub secured disk generation units of the secured disk generation unit in the storage encryption device according to the present invention.

As described above, the secured disk generation unit 400 includes a main secured disk generation unit 430 and a sub secured disk generation unit 440 .

The main secured disk generation unit 430 includes a main secured disk generation processing unit 431 and a main disk security application generation unit 432 .

The main secured disk generation processing unit 431 includes a secured disk configuration unit 4311 that creates a secured disk in the main storage 200 according to the prior art 1 and the prior art 2, and an encryption module that encrypts data of the created secured disk. , and an encryption unit 4312 including a decryption module for decrypting the encrypted data.

The main disk security application generation unit 432 activates and deactivates the secured disk of the main storage 200, whether authentication by security identification information for activating and deactivating the secured disk, registration, change and Performs secure disk settings such as deletion, whether external export is allowed through email, security policy setting when external export is allowed, and whether or not a mirroring system is applied, security identification information authentication according to the settings, file export operation via email, mirroring Create a main disk security application that performs operations such as

The main disk security application may include a digital key for searching for a secured disk and activating and deactivating the secured disk as the above-described prior art 1 and prior art 2 are applied. Also, the main disk security application will include a destruction key to destroy the secured disk. Since this is applied in the same manner as in Prior Art 1 and Prior Art 2, detailed description thereof will be omitted.

The sub secured disk generation unit 440 also includes a sub secured disk generation processing unit 441 and a sub disk security application generation unit 442 .

The sub secured disk generation processing unit 441 creates a secured disk in the sub storage 100 .

The sub-disk security application generating unit 442 generates a sub-disk security application and stores the generated sub-disk security application in the sub storage 100 . The sub-disk security application may include only a decryption module, may have security identification information, and receive security identification information from the user and compare it with the security identification information it has in advance and after authentication, the security disk of the sub storage 100 enable and disable

4 is a view showing a detailed configuration of the main secure disk activation control unit of the disk security application unit of the storage encryption device according to the present invention.

The main secure disk activation control unit 510 is configured by executing the main disk security application and the sub disk security application stored in the main storage 200 connected to the storage encryption device 300, and the main secure disk service execution unit 511 ) and a setting information storage unit 512 .

The main secured disk service execution unit 511 includes a secured disk activation unit 5111, a secured disk setting unit 5113, an encryption/decryption unit 5114, a component complete inspection unit 5115, an input/output file setting unit 5116, a file It includes an external export processing unit 5117 and a mirroring processing unit 5118 .

The secured disk activation unit 5111 receives the security identification information as in the prior art 1 and the prior art 2 when a secure disk activation request of the connected main storage 200 and the sub storage 100 is requested, and preset security identification information When matching with , the secure disk of the main storage 200 and the sub storage 100 is activated, and when deactivation is requested, the secured disk is deactivated. Activation in Prior Art 1 and Prior Art 2 means making it appear as a drive, and deactivation means deleting the secure disk from the drive and configuring it so that there is no data stored in the secure disk and secure disk in the system capacity information. In the present invention, deletion only from the drive, the capacity information may be configured to reflect the used capacity of the secured disk, or it may be configured to delete from the drive, set the secured disk to a specific file and not be able to access it. Of course, the present invention may also be configured as in Prior Art 1 and Prior Art 2, and optionally, one of the above-described multiple activation and deactivation methods may be selectively configured.

The secured disk setting unit 5113 sets options such as registration and change of security identification information for activating/deactivating the secured disk, changing the capacity of the secured disk, setting and changing the data encryption method of the secured disk, and whether to allow external file export. and secure disk setting user interface means such as change, security policy setting and change, and the like, and stores the security setting information input through the secure disk setting user interface means in the setting information storage unit 512 .

The encryption/decryption unit 5114 encrypts data stored in the secured disks of the main storage 200 and the sub storage 100 and decrypts data read from the secured disk.

The component complete inspection unit 5115 loads the unique identification information of the currently connected main storage 200, loads the unique identification information of the sub storage 100, and is connected when configuring the security information storage system according to the present invention. Comparing the component identification information registered for the main storage 200 and the sub-storage 100, performing a component complete inspection to check whether all components that were connected when configuring the security information storage system are connected, The test results are provided.

The input/output file setting unit 5116 is configured to store the files stored in the secure disk of the main storage 200 and the secure disk of the sub storage 100 according to the result of the component complete inspection performed by the component complete inspection unit 5115 . set the properties for

When the security information storage system is created, one main storage 200 and two sub-storages 100 are connected as an example. When only the main storage 200 is connected, the input/output file setting unit 5116 is , set to the read attribute so that only the file stored in the activated secure disk of the main storage 200 can be read.

And when the main storage 200 and one sub storage 100 are connected, the input/output file setting unit 5116 reads the files stored in the secure disk of the main storage 200 and the sub storage 100, Set the read and write properties to be writable.

And when the main storage 200 and the two sub-storage 100 are connected, that is, when the components are complete, the input/output file setting unit 5116 sets the main storage 200 and the sub-storage 100 files of the secure disk. The read and write attributes are set in the fields, and the secure disk setting unit 5113 is set to be driven. That is, only when all the components are complete, various settings of the secured disk may be set and changed through the secured disk setting unit 5113 .

The file export processing unit 5117 receives from the user in a state in which at least one sub-storage 100 is connected through the component complete inspection unit 5115 to one secured disk of the main storage 200 and the sub-storage 100. When a file export request for a stored file occurs, an agent program (hereinafter referred to as "agent") containing the file, encryption/decryption module, and security policy is created and allowed to be exported. The file can be used only by the execution of the agent, and is managed by the agent program to limit use within the security policy of the file.

The file export processing unit 5117 allocates unique identification information when creating the agent, agent identification information, the date and time the agent was created, an attached target (at least one of e-mail, web hard, and cloud), and attaches It may be desirable to store and manage the requested user information in the agent export history storage unit 5124 .

The mirroring processing unit 5118 is connected through a local network and a broadband network if the mirroring condition is satisfied among all the data or some files stored in the secure disk of the connected main storage 200 and the sub storage 100. A mirroring process is performed to transmit and store data to a mirroring system (2000 in FIG. 6). The mirroring condition may be a predetermined time interval, storage of a new file, storage of a new file of a new predetermined capacity or more, or a case in which data on the secure disk increases by more than a predetermined capacity.

The setting information storage unit 512 stores the secure disk setting information set by the secure disk setting unit 5113 . In particular, the setting information storage unit 512 includes a digital key storage unit 5121 that stores a digital key that plays an important role in activating and deactivating the secure disk and encrypting and decrypting the secure disk, and a main storage connected when configuring the security information system. 200 and a component identification information storage unit 5122 for storing unique identification information of the sub storage 100, a policy information storage unit 5123 for storing policy information, and an agent export history storage unit 5124 do.

5 is a diagram showing the detailed configuration of the sub-secure disk activation control unit of the disk security application unit of the storage encryption device according to the present invention.

The sub-secured disk activation control unit 530 is configured by executing the sub-disk security application generated by the sub-disk security application generating unit 442 of the sub-secured disk generating unit 440, and the storage encryption device 300 of the present invention. It may be configured by executing the sub-disk security application executed after connecting the sub-storage to a non-general computer.

The sub-secured disk activation control unit 530 includes a sub-secured disk service execution unit 531 and a sub-secured disk information storage unit 532 .

The sub-secure disk information storage unit 532 includes a digital key storage unit 5321 for storing a digital key, a unique identification information storage unit 5322 for storing unique identification information, and a general computer alone connection of the sub-storage 100 to secure and a policy information storage unit 5323 for storing policy information for processing a file stored on the disk as a read attribute. The sub secure disk information storage unit 532 may be configured in the sub storage 100 .

The sub secured disk service execution unit 531 includes a secured disk activation unit 5311 , a mount processing unit 5312 , and a decryption unit 5313 .

The secure disk activation unit 5311 provides a sub-storage activation means, and when security identification information is input through the sub-storage activation means, authentication is performed by the security identification information, and when authentication is performed, the secured disk of the sub storage 100 is activated. In order to activate, a mount request signal is output to the mount processing unit 5312 .

In addition, the secure disk activation unit 5311 determines whether it is connected to the storage encryption device 300 , and when it is determined that it is connected to the storage encryption device 300 , sends a main disk security application driving request signal to the storage encryption device 300 . and the main secure disk activation control unit 510 will be driven.

When a mount request signal is received from the secure disk activation unit 5311 , the mount processing unit 5312 mounts the secure disk of the sub storage 100 as a drive.

The decryption unit 5313 decrypts the encrypted and stored file when an open command for the file stored in the secure disk of the sub storage 100 is generated.

6 is a diagram showing the configuration of the agent execution device according to the present invention, and shows the configuration of the agent execution device configured in the computer running the agent downloaded from any one or more of mail, web hard, and cloud.

The agent execution device 700 according to the present invention includes an agent control unit 710 and an agent storage unit 720 .

The agent storage unit 720 includes an export file storage unit 721 for storing an externally exported file included in the agent, and a policy information storage unit 722 for setting a file policy for an externally exported file.

The agent control unit 710 decrypts and outputs a file encrypted and stored in the exported file storage unit 721, or an encryption unit 711 that encrypts and stores a changed file and a newly stored file, and the exported file storage unit ( 721) includes a policy application information collecting unit 712 that collects policy application information for applying a file policy to a file stored in the file, and controls overall operation of the exported file according to the present invention. The policy application information may be time information counted by a timer of a computer configured with the agent execution device, and the number of uses stored in the policy information storage unit 720 .

7 is a diagram illustrating a mirroring system of a security information storage system using a plurality of storages according to an embodiment of the present invention.

The storage encryption device 300 of the security information storage system 1000 of the present invention is a mirroring system 2000 set in advance when the mirroring condition is satisfied. All files stored in the secure disk of the main storage 200, newly created A mirroring service of transferring a file or a changed file and storing it in the mirroring system 2000 for backup is performed. The mirroring condition may be a certain period, may be a change of more than a certain capacity of the secure disk, may be a certain time out of a file unit, may be the creation of a new file, or may be a change of a file. will be.

As such, by backing up the data of the secure disk in the mirroring system 2000, there is an advantage in that data of the secure disk can be easily restored in case of damage or theft of the main storage 200 connected to the storage encryption device 300. Even if the main storage is stolen, the data stored in the secure disk of the main storage 200 may not be utilized because the secured disk is encrypted by a digital key and an arbitrary encryption method.

In the above description, the configuration of the security information storage system according to the present invention has been described. Hereinafter, a method for storing security information will be described with reference to FIG. 8 .

8 is a flowchart illustrating a method for storing security information using a plurality of storages according to the present invention.

Referring to FIG. 8 , the secure information storage method using a plurality of storages according to the present invention includes a secure disk creation process ( S111 ) and a secure disk use process ( S113 ).

Hereinafter, a secure disk creation process will be described in detail with reference to FIGS. 9 to 12 .

9 is a flowchart illustrating a secure disk creation method of a secure information storage method using a plurality of storages according to the present invention.

First, the secured disk creation unit 400 of the storage encryption device 300 provides a secure disk creation setting user interface means to the user through the secured disk setting unit 410 (S211), and the secured disk creation setting user interface means When a secure disk creation request is generated through (S213), the secure disk creation setting information input through the secure disk creation setting means is stored (S215). The secure disk creation setting information may be security identification information of the secure disk, secure disk encryption method, main storage designation, the number of sub-storages and the start sector of the secure disk for each storage, the capacity of the secure disk, and the like.

When the secure disk creation setting information is stored, the secure disk creation unit 400 checks whether the components for configuring the secure information storage system are complete through the component complete inspection unit 420 (S217). Whether or not the components are complete may be checked by whether all of the main storage 200 and the sub-storage 100 set in the secure disk creation setting are connected to the storage encryption device 300 .

When the components are complete, the secured disk generation unit 400 of the storage encryption device 300 creates a secured disk in the main storage 200 according to the secured disk generation setting information through the main secured disk generation unit 430 ( S219).

When the secured disk of the main storage 200 is created, the secured disk generation unit 400 creates a secured disk in the sub storage 100 according to the secured disk creation setting information through the sub secured disk generation unit 440 ( S221).

10 is a flowchart illustrating the component completeness inspection method of the secure disk creation method according to the present invention, and is a detailed flowchart illustrating the component completeness inspection method of S217 of FIG. 9 and S611 of FIG. 12 to be described later.

First, the secured disk generation unit 400 checks whether a secured disk creation event is generated (S311). As described above, the secure disk creation event may be generated when a secure disk creation request is made, or may be generated when the secured disk is reset.

When a secured disk creation event occurs, the secured disk creation unit 400 checks whether the number of main storage 200 and sub storage 100 set in FIG. 8 are connected through the component complete monitoring unit 420 ( S313), it is determined whether the set storages are normally connected (S315).

As a result of the inspection, if the set storages are not normally connected, the secured disk generating unit 400 displays a storage connection request message of a set number of requests to correctly connect at least one of the set number of main storage and sub-storage (S317) , it is determined whether the storages are normally connected based on the storage identification information of the main and sub storages, which are pre-registered components.

If the set storages are normally connected, the secure disk creation unit 400 will perform the following process.

In addition, if the set storages are not normally connected for a certain number of times or for a certain period of time, the secured disk generating unit 400 may be configured to end the secured disk creation process.

11 is a flowchart illustrating a main storage secured disk creation method of the secured disk creation method according to the present invention.

Referring to FIG. 11 , the main secure disk generating unit 430 generates a unique encryption key and a destruction key ( S411 , S413 ).

When the encryption key and the destruction key are generated, the main secure disk generating unit 430 assigns the encryption key and the destruction key to the digital key of the secured disk (S415), and after generating the digital key (S417), the digital key area Store the digital key in (S419).

When the digital key is stored in the digital key area, the main secure disk generating unit 430 encrypts the secure data area except for the digital key area of the secure disk by the set encryption method (S421).

Since the description of the unique encryption key, the destruction key, the digital key and the digital key area is described in detail in the prior art 1 and the prior art 2 of the applicant of the present application, the description of the present invention will be briefly described.

When the secure data area is encrypted, the secure disk generating unit 430 generates unique identification information of all main storage 200 and sub-storage 100 among digital key, destruction key, and secure disk generation setting information, and encryption of the encryption method. A disk security application including a module and a decryption module is created (S423).

When the disk security application is generated, the secured disk creation unit 430 stores the disk security application (S425). The disk security application may be stored in an area other than the secured disk of the main storage 200 or in any one of the main storage 200 and the connected sub storage 100, in a state connected to the storage encryption device 300 It will work normally.

In addition, as in the prior art 1 and prior art 2 of the applicant of the present application, a key application for activating the secure disk, including a digital key and a destruction key, an encryption module and a decryption module for the encryption method, and the secure disk creation setting information Both the disk security application including the unique identification information of all the main storage 200 and the sub storage 100 is created, and the main secured disk activation control unit 510 activates the secured disk by driving the key application, , it may be configured to run the disk security application on the activated secured disk to perform a component complete inspection and security information storage operation using a plurality of storages.

12 is a flowchart illustrating a method for generating a sub storage secured disk of the method for creating a secured disk according to the present invention, and is a flowchart specifically illustrating the method for creating a sub storage secured disk in S219 of FIG. 9 .

In general, the sub storage 100 may be a portable memory such as a USB memory. In the case of the portable memory, the sub-secured disk generation unit 440 does not have unique device identification information, so to manage the portable memory as the sub-storage 100, unique identification information for the sub-storage 100 is generated, The generated unique identification information (or referred to as "sub storage identification information") is recorded in the sub storage 100 (S511).

When the sub-storage identification information is recorded in the sub-storage 100 , the sub-secured disk generation unit 440 uses the sub-storage identification information to store storage information, which is a security information system component managed by the main secured disk activation control unit 510 . It is stored in the storage area of the main storage 200 (S513).

The sub-secured disk generation unit 440 generates a unique encryption key and a destructive key in the same way as when the main secured disk is created (S514, S515).

When the encryption key and the destruction key are generated, the sub-secured disk generation unit 440 allocates a digital key area (S517), generates a digital key including the encryption key and the destruction key (S519), and then the assigned digital It is stored in the key area (S521).

When the digital key is stored, the sub secure disk generating unit 440 generates a sub disk security application including a decryption module including a digital key and a destruction key, and an encryption key (S523).

When the sub-disk security application is generated, the sub-secured disk generation unit 440 stores the created sub-disk security application in the sub storage 100 (S525).

13 is a flowchart illustrating a secure disk setting method of a secure information storage method using a plurality of storages according to the present invention, which is performed by the main secure disk activation control unit 510 of the disk security application unit 500 .

Referring to FIG. 13 , the main secured disk activation control unit 510 performs a component complete inspection through the component complete inspection unit 5115 of the main secured disk service execution unit 511 ( S611 ).

If it is determined in the component complete inspection that all components are normally connected, the main secured disk service execution unit 511 provides a secure disk setting user interface means to the user (S613).

After the secure disk setting user interface means is provided, the main secure disk service execution unit 511 checks whether a secure disk setting storage request is generated (S615).

When a secure disk setting storage request is generated, the main secured disk service execution unit 511 updates the existing secured disk setting information by reflecting the secured disk setting information input through the secure disk setting user interface means (S617).

14 is a flowchart illustrating a method of using a secure disk in a method for storing secure information using a plurality of storages according to the present invention, and is a flowchart performed by the disk security application unit 500 .

When the disk security application is driven (S711), the secured disk application unit 500 activated by the disk security application determines whether the driven disk security application is the main disk security application (main storage mode), or whether the sub disk security application (sub storage mode) mode) is determined (S713, S715).

If the driven disk security application is the main disk security application, the disk security application unit 500 drives the main secured disk activation control unit 510 , and the main secured disk activation control unit 510 activates the secured disk of the main storage 200 . to do so (S714).

When the secured disk is activated, the main secured disk activation control unit 510 checks whether the sub storage 100 is connected (S717).

If the sub-storage 100 is not connected, the main secure disk activation control unit 510 drives the decryption module (S719) and sets the properties of the files stored in the secure disk of the main storage 200 as read properties. (S721).

When the file attribute of the files stored in the secure disk is set to the read attribute, the main secure disk activation control unit 510 checks whether an open command for any file is generated (S723). File open may occur when a file is created or a file is read, but according to the present invention, the sub-storage 100 registered in advance as a key serving as a key is not connected, so it will occur only when a file is read. This may be because the files stored on the secure disk of the main storage 200 can be read only with the read attribute.

When the file open occurs, the main secure disk activation control unit 510 opens the file with the read attribute of the corresponding file (S725).

When the file is opened, the main secure disk activation control unit 510 checks whether a file writing request is generated (S727).

When a file write command is generated, the main secured disk activation control unit 510 displays a message requesting to connect the sub storage 100 corresponding to the sub storage identification information registered as a component (S729).

After the display, the main secure disk activation control unit 510 checks whether the sub storage is connected (S730).

If the sub storage 100 is not connected, the main secure disk activation control unit 510 checks whether a secure disk release event occurs (S731), and if the secure disk release event does not occur, the file cannot be written and read We will continue to mark it as an attribute.

And when the secured disk release event occurs, the main secured disk activation control unit 510 will deactivate the secured disk (S732).

On the other hand, if it is determined that the disk security application is a sub disk security application and the sub storage 100 of the registered component is connected, the main secured disk activation control unit 510 activates the secured disk of the sub storage 100 (S733) ), drives both the encryption module and the decryption module (S734), and sets the files stored in the secure disk of the main storage 200 and the sub storage 100 as read/write properties (S735).

After setting the properties of the files of the Boin disk, the main secured disk activation control unit 510 reads a file for commands such as open, close, and save among the files of the secured disk of the main storage 200 and the sub storage 100 and write processing, and perform encryption and decryption on read and write-processed files (S737). In addition, if a command to copy and move the file of the secured disk occurs at this time, the main secured disk activation control unit 510 will allow the copy and move of the file.

The main secure disk activation control unit 510 checks whether a secure disk release event occurs during file input/output processing such as reading, writing, copying, and moving files as described above (S739).

When the secured disk release event occurs, the main secured disk activation control unit 510 will deactivate the secured disks of the main storage 200 and the sub storage 100 .

Although the case in which even the secured disk of the sub storage 100 is activated has been described here, the secured disk of the sub storage 100 may not be activated or may be configured to be selectively activated.

In addition, when the disk security application is driven in the sub storage 100 ( S715 ), the disk security application unit 500 drives the sub secured disk activation control unit 530 to activate the secured disk of the sub storage 100 . (S743).

When the secured disk of the sub storage is activated, the sub secured disk activation control unit 530 checks whether the main storage 200 of the previously registered component is connected (S745).

When the main storage 200 is connected, the sub-secure disk activation control unit 530 drives the encryption module and the decryption module (S747). When it is determined that the main storage 200 is connected, the sub-secured disk activation control unit 530 may be configured to activate the secured disk of the main storage 200, and control the operation of the main disk security application. The main storage 200 and the sub-storage 100 are connected by the main secured disk activation control unit 510 so that the main secured disk activation control unit 510 is driven by the driving of the main disk security application. It may be possible to perform the same control operation as when.

The sub-secured disk activation control unit 530 sets read/write attributes to the files stored in the secure disk of the sub-storage 100 after the encryption module and the decryption module are driven (S749), and then the sub-storage 100 Among the files of the secure disk, read and write processing of a file for commands such as open, close, and save, and encryption and decryption processing of a file for performing reading and writing processing of the file are performed (S750).

If the main storage 200 is not connected (S745), the sub-secured disk activation control unit 530 drives the decryption module (S755), and sets read properties for files stored in the secure disk of the sub-storage 100 (S745) and (S757), a decryption process is performed on the opened file (S758).

15 is a flowchart illustrating a secure disk activation method of a secure information storage method using a plurality of storages according to the present invention.

Since the method of activating the secured disk itself can be applied in the same manner as in Prior Art 1 and Prior Art 2 previously applied to the present applicant, a brief description will be given.

The main secured disk activation control unit 510 or the sub secured disk activation control unit 530 requests to input security identification information (S811).

After the security identification information input request, the main secured disk activation control unit 510 checks whether security identification information is input (S813), and when the security identification information is input, compares it with the security identification information of the previously registered secured disk setting information to determine whether authentication succeeds according to whether or not the matching is performed (S815).

If the security identification information authentication is successful, the digital key stored in the digital key area of the secure disk is compared with the digital key stored in the digital key storage unit 5121 of the setting information storage unit 512, and the digital key according to the match Key authentication is performed and digital key authentication is performed (S817).

The main secured disk activation control unit 510 or the sub secured disk activation control unit 530 determines whether the digital key authentication is successful (S819), and if successful, allocates a drive to the secured disk through the kernel layer unit 600 to mount it in the explorer and activate it (S821).

16 is a flowchart illustrating a method of exporting a file from a secured disk in the method for storing security information using a plurality of storages according to the present invention.

According to the present invention, only read-only files can be brought to the outside through the pre-registered sub storage 100 so that the files stored on the secure disk of the main storage 200 are not leaked to the outside.

However, when a specific person in charge needs to change the contents of the file from the outside, the file stored in the sub-storage 100 cannot be changed and the file must be newly created, which can be very inconvenient.

In order to improve this point, if external file changes are required, a method of exporting the file to the outside through e-mail with records so that both reading and writing is possible is proposed. File export of the secured disk through any one or more of email, web hard and cloud is performed only in the storage encryption device 300, is processed only by the main secured disk activation control unit 510, and the sub secured disk activation control unit 530 It would be desirable to be configured so that export processing cannot be performed through the .

Referring to FIG. 16 , when the secured disk of the main storage 200 is activated by the main secured disk activation control unit 510 ( S911 ), the file export processing unit 5117 checks whether a file attachment event occurs ( S913 ). ). The file attachment event may be generated when an attempt is made to attach a file stored in the secure disk to any one of mail, web hard, and cloud as it is meant to be, or may be generated by a command to create an external secure file agent.

When the event occurs, the file export processing unit 5117 performs the component complete check of FIG. 9 , and when the component is complete ( S915 ), requests to select a file to be attached ( S917 ).

After the request for selecting the file to be attached, the file export processing unit 5117 monitors whether a file is selected (S919), and when the file is selected, provides a policy setting user interface means to the user to request to set a policy (S921) .

After the policy setting request, the file export processing unit 5117 checks whether a policy setting completion command is input (S923), encrypts the file to be attached when the policy setting completion command is input, and encrypts the file and the file An agent including an encryption module/decryption module capable of decryption and policy information is created (S925). Preferably, the agent includes security identification information set by the user.

The agent may be an executable file, and the file containing the included file according to the security identification information set by the user is decrypted and displayed by the decryption module. It could be an application that controls it.

When the outbound secure file agent is created, the outbound secure file agent 5117 attaches to any one of mail, web hard, and cloud (S927).

17 is a flowchart illustrating a method of using a file exported by a method of exporting a secured disk file to the outside of a method of storing security information using a plurality of storages according to the present invention.

Referring to FIG. 17, when an external security file agent transmitted to any one or more of mail, web hard and cloud is downloaded and executed (S1011), the computer on which the agent is executed (hereinafter referred to as "agent execution device") ( The agent control unit 710 of 700) restores the encrypted file through the encryption unit 711 and stores it in the export file storage unit 721 of the agent storage unit 720 of the agent execution device (S1013).

When the file is restored, the agent control unit 710 collects file policy application information through the policy application information collection unit 712 (S1015). The file policy application information may be the current time and the number of times of use. The time may be obtained from a timer counted by the agent execution device 700 itself, and the number of uses may be obtained from the policy information storage unit 722 of the agent storage unit 720 .

After collecting the file policy application information, the agent control unit 710 checks whether the restored file is opened (S1017). The file open request may be generated by other processors such as a word processor of the agent execution device 700 .

When the file open is requested, the agent control unit 710 determines whether the file policy application information satisfies the file policy set in the policy information storage unit 722 (S1019).

As a result of the determination, if the file policy application information does not satisfy the set file policy, the restored file is deleted and a request is made to delete the agent from the upper operating system (OS) (S1021).

On the other hand, if the set file policy is satisfied, the agent control unit 710 decrypts the file through the encryption unit 711 (S1023), sets the read/write attribute to the file (S1025), and the processor uses the file make it open At this time, it may be configured to prevent copying to another computer or other storage device by the processor.

When the file is opened, the agent control unit 710 checks whether an encryption request event is generated (S1027).

The encryption request event may be generated when an encryption request is generated through an agent user interface means or when the processor closes the file.

When the encryption request event occurs, the agent control unit 710 updates the file policy application information of the policy information storage unit 722 (S1031). For example, increase the number of times a file is used by 1.

On the other hand, it is common knowledge in the art that the present invention is not limited to the typical preferred embodiment described above, but can be improved, changed, replaced or added in various ways within the scope of the present invention without departing from the gist of the present invention. Those who have will be able to understand it easily. If implementation by such improvement, change, substitution, or addition falls within the scope of the appended claims below, the technical idea should also be regarded as belonging to the present invention.

100: sub storage
200: main storage
300: storage encryption device
400: secure disk creation unit
410: secure disk setting unit
420: component completeness inspection unit
430: main secure disk creation unit
440: sub secure disk creation unit
411: secure disk setting unit
412: storage connection monitoring unit
413: main secure disk creation processing unit
414: main disk security application creation unit
430: main secure disk creation unit
431: main secure disk creation processing unit
432: main disk security application creation unit
440: sub secure disk creation unit
441: Sub secure disk creation processing unit
442: sub disk security application creation unit
500: disk security application unit
510: main secure disk active control unit
511: main secure disk service execution unit
512: setting information storage unit
530: sub secure disk active control unit
531: sub secure disk service execution unit
532: sub secure disk information storage unit
600: kernel layer
700: agent execution device
1000: security information storage system
2000: Mirroring system

Claims (10)

main storage;
removable sub-storage; and
At least one or more of the main storage and one or more sub-storages are used as components to obtain each number and storage identification information, and secure to the main storage and sub-storage in a state in which the main storage and sub-storage of the obtained storage identification information are connected. Creates a disk, creates an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and creates a disk security application including storage identification information of the main storage and sub storage, and the generated By executing the disk security application, the properties of the files stored in the secured disk are differently set according to whether the main storage and the sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and at least one or more A storage encryption device that controls to change and delete files stored in the secured disks of the main storage and the sub storage when the sub storage is connected,
The storage encryption device,
a kernel layer unit for mounting the secured disks of the main storage and the sub storage as drives and processing a file output to the secured disk and a file input from the secured disk;
Acquire storage identification information of the main storage and sub storage, and create a secure disk in the main storage and the sub storage in a state in which the main storage and the two sub storages of the obtained storage identification information are connected, and store in the secure disk a secure disk generation unit for generating a disk security application including an encryption module for encrypting a file to be used, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage; and
By executing the created disk security application, the properties of the files stored in the secured disk are differently set according to whether the main storage and sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and at least one main storage and at least one Control to change and delete files stored on the secured disk of the main storage and the sub storage when one or more sub storages are connected, and control to change the secured disk setting information of the secured disk when both sub storages are connected including a disk security application unit;
The secure disk generating unit,
Provide a user with a secure disk setting user interface means, receive the selection of the main storage through the secure disk setting user interface means, select the two sub-storages, and display the number of the main storage and the sub-storage and the storage identification information Secure disk setting unit to obtain and store;
A component complete inspection unit that performs a component complete inspection that checks whether the main storage and sub storage of storage identification information for one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected ;
a sub-secured disk generation unit that creates a secured disk in the sub-storage when it is determined that all components are configured through the component complete inspection unit; and
When it is determined through the component complete inspection unit that all components are configured, a secured disk is created in the sub storage, and then the sub secured disk creation unit is instructed to create a sub secured disk, and after the secured disk is created in the sub storage An encryption module for encrypting a file stored in the secured disk, a decryption module for decrypting the encrypted file, and a main secured disk generating unit for generating a disk security application including storage identification information of the main storage and sub storage. A security information storage system using a plurality of storages.
delete According to claim 1,
The main secure disk generating unit,
a main secured disk generation processor instructing the sub secured disk creation unit to create a sub secured disk after creating a secured disk in the sub storage when it is determined that all components are configured through the component complete inspection unit; and
An encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, storage identification information of the main storage and sub storage, and an encryption method of the file and activation and deactivation of the secure disk A security information storage system using a plurality of storages, comprising a main disk security application unit for generating a disk security application including a security policy including security identification information.
4. The method of claim 3,
The main secure disk generation processing unit,
When it is determined through the component completeness inspection unit that all components are configured, a security data area for storing files and a digital key area including policy information including digital, destructive key, and encryption method information for encrypting a secure disk A secure disk configuration unit for generating a secure disk comprising a; and
An encryption unit for generating an encryption module for encrypting a file according to an encryption method of the policy information of the digital key and a decryption module for decrypting the encrypted file,
The disk security application unit,
The security information storage system using a plurality of storages comprising the digital key, wherein the digital key locates the secure disk and activates and deactivates the secure disk.
According to claim 1,
The sub secure disk generating unit,
a sub-secured disk creation processor configured to create a secured disk in the sub storage and set the secured disk as a read attribute when it is determined through the component complete inspection unit that all components are configured; and
A decryption module for decrypting a file encrypted and stored in the secure disk of the sub storage, and a sub disk security application unit that generates a sub disk security application including storage identification information of the main storage and the sub storage and is stored in the sub storage including a generator,
The security information storage system using a plurality of storages, characterized in that the sub-disk security application is stored in an area other than the secured disk of the sub-storage and is configured to be executed when a user's execution request occurs through a computer to which the sub-storage is connected.
main storage;
removable sub-storage; and
At least one or more of the main storage and one or more sub-storages are used as components to obtain each number and storage identification information, and secure to the main storage and sub-storage in a state in which the main storage and sub-storage of the obtained storage identification information are connected. Creates a disk, creates an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and creates a disk security application including storage identification information of the main storage and sub storage, and the generated By executing the disk security application, the properties of the files stored in the secured disk are differently set according to whether the main storage and the sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and at least one or more A storage encryption device that controls to change and delete files stored in the secured disks of the main storage and the sub storage when the sub storage is connected,
The storage encryption device,
a kernel layer unit for mounting the secured disks of the main storage and the sub storage as drives and processing a file output to the secured disk and a file input from the secured disk;
Acquire storage identification information of the main storage and sub storage, and create a secure disk in the main storage and the sub storage in a state in which the main storage and the two sub storages of the obtained storage identification information are connected, and store in the secure disk a secure disk generation unit for generating a disk security application including an encryption module for encrypting a file to be used, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage; and
By executing the created disk security application, the properties of the files stored in the secured disk are differently set according to whether the main storage and sub storage, which are the components, are connected and the number of connections to the sub storage, and at least one main storage and at least one main storage and at least one Control to change and delete files stored on the secured disk of the main storage and the sub storage when one or more sub storages are connected, and control to change the secured disk setting information of the secured disk when both sub storages are connected including a disk security application unit;
The disk security application unit,
a setting information storage unit having a component identification information storage unit for storing storage identification information of the main storage and sub storage, which is the component, and a policy information storage unit for storing policy information; and
The properties of the files stored in the secure disk are set differently according to whether the main storage and the sub storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected and the number of the sub storages connected, and at least one main storage and at least one main storage and at least one Main controlling to change and delete files stored in the secured disk of the main storage and the sub storage when one or more sub storages are connected, and to change the secured disk setting information of the secured disk when both the sub storages are connected A security information storage system using a plurality of storages, comprising a main secured disk activation control unit having a secured disk service execution unit.
7. The method of claim 6,
The main secure disk service execution unit,
a component complete inspection unit that checks whether all of the components are connected or only some are connected by the stored storage identification information;
an input/output file setting unit for setting attributes of files stored in one or more secure disks of the connected main storage and sub-storage according to the result of the component completeness inspection performed by the component complete inspection unit;
an encryption unit for encrypting a file stored in the secure disk and decrypting a file read from the secure disk;
When the secure disk application is executed, the main storage and sub-storage having the secure disk are found, the secure disk is found in the connected storage, the found secure disk is mounted on the drive to activate it, and when a deactivation request occurs, the mounted drive is removed. A security information storage system using a plurality of storages, characterized in that it includes a secure disk activation unit for inactivating the secure disk.
8. The method of claim 7,
The main secure disk service execution unit,
When an event of attaching a file to any one of email, web hard, and cloud of a file stored in one secure disk of the main storage and sub storage occurs, the main storage and at least one sub storage through the component complete inspection unit is connected, after creating an agent including the encrypted file to be attached, a decryption module for decrypting the file, an encryption module for re-encrypting the decrypted file, and a security policy limiting the use of the file, the Further comprising a file export processing unit for attaching the generated agent to any one of email, web hard, and cloud,
wherein the security policy includes at least one of a timestamp policy that allows the file to be used only for a certain period of time and a use frequency limit policy that allows the file to be used only a certain number of times. information storage system.
9. The method of claim 7 or 8,
The main secure disk service execution unit,
It is checked whether a preset mirroring condition is satisfied, and when the mirroring condition is satisfied, the files stored in the secured disk of one or more connected storage among the main storage and the sub-storage are backed up to the mirroring system connected through the network, and the files stored in the secured disk and the Security information storage system using a plurality of storage, characterized in that it further comprises a mirroring processing unit to configure the same files in the mirroring system.
delete

Images