KR20020053045A - PC security system and the method using certificate - Google Patents

Abstract

PURPOSE: A system and a method for the security of a computer terminal using an authorized certificate are provided to secure the security in the use of a computer terminal and to protect the computer terminal from harmful information by approving the use through user authentication and limiting the use right of the computer terminal. CONSTITUTION: The system comprises the Internet(100), a computer terminal(200) to authenticate and limit the use of a computer terminal, a smart card(300) embedded with an authorized certificate, a card reader(400) connected with the computer terminal to read the information of the certificate embedded in the smart card, an authorized authentication organization(500) loaded on the Internet to perform the issuance and authentication of an authorized certificate, and a service server(600) to supply the information on the harmful sites to the computer terminal. The computer terminal includes a connection management unit(220), a harmful site information DB(Database)(230), and a communication unit(240). The connection management unit includes a certificate information reading unit, a user verification unit, a harmful site connection management unit, and an external terminal connection management unit.

Description

Computer terminal security system using public certificate and its method {PC security system and the method using certificate}

The present invention relates to a computer terminal security system and a method thereof, and more particularly, to a security system and a method capable of securing the restriction of the use of the computer terminal, personal information protection and the safety of the Internet.

In general, the Internet service provider (ISP) in the Internet environment is a method of authenticating a user and inputting a user ID and password to give permission for information retrieval and use when it matches the stored contents. I am performing authentication in a way.

However, the conventional authentication method as described above has a disadvantage in that, when a user identification code (ID) and a password (password) are leaked, anyone can easily receive an authentication approval that can have a user right according to the relevant information search and use.

In addition, even in the case of sites that need to restrict access to minors or specific persons, users who are properly registered due to false information when registering user information, stealing other users' IDs and passwords, and hacking There is a problem that authentication cannot be performed.

The present invention, in order to solve the above problems, by using the user authentication of the computer terminal, and by restricting the use rights of the computer terminal for the purpose of securing the stability of the user's use of the computer terminal and protection from harmful information do.

1 is a simplified configuration diagram of a computer terminal security system using a certificate in accordance with the present invention

2 is a block diagram showing a detailed configuration of the connection management unit of FIG.

Figure 3 is an exemplary view of the configuration of a smart card used in a computer terminal security system using a public certificate in accordance with the present invention

Figure 4 is a flow chart for explaining the login process to the Windows operating system in a computer terminal security method using a certificate according to the present invention

5 is a flowchart illustrating a service flow for blocking harmful sites in a computer terminal security method using a certificate according to the present invention.

Explanation of symbols on the main parts of the drawings

100: internet network 200: computer terminal

210: web browser 220: access management

230: harmful site information DB240: communication

300: smart card 400: card reader

500: accredited certification authority 600: service server

610: Member Information DB620: Hazardous Information DB

630: service provider 640: service management

In order to achieve the above object, the present invention is an Internet network; To perform data communication with a web browser for accessing the Internet network, a connection management unit for performing user authentication and access management, a harmful site information DB having information on a harmful site, and an external device. Computer terminal having a communication unit for; A smart card with a built-in certificate; A card reader connected to the computer terminal for acquiring the authentication information embedded in the smart card; An accredited certification authority which is loaded on the Internet network and performs issuance and certification of accredited certificates; A member information DB loaded on the Internet network and storing member information, a harmful information DB storing information about harmful sites, a service provider for providing harmful site information to the members, and We propose a computer terminal security system using an accredited certificate including a service server having a service management unit for performing management of each component.

Here, the access management unit, a certificate information acquisition unit for acquiring the public certificate information input through the card reader, a user verification unit for performing user authentication using the public certificate and the information entered by the user, and the harmful A harmful site access management unit for blocking access to a site registered in the site information DB, an external terminal connection management unit for managing access to the computer terminal of an external device, and encrypting and decrypting files and folders stored in the computer terminal. And a file / folder management unit, a terminal usage record storage unit for generating and storing the computer terminal usage record, and an administrator setting unit for setting functions and ranges of the respective components.

In addition, the information stored in the harmful site information DB and harmful information DB is characterized in that the URL or IP address.

In addition, the computer terminal security method using a public certificate according to the present invention proposed as described above is the step of issuing a public certificate issued by the public certification authority and stored in the smart card; The certificate information acquisition unit requesting the public certificate; Inserting a smart card into the card reader to provide public certificate information, and inputting an electronic signature password of the public certificate; Transmitting the certified certificate information and the electronic signature password to the authorized certification authority to perform validation; Receiving the validity authentication result to the computer terminal and blocking the use of the computer terminal when disapproved, and accepting the use of the computer terminal when the validity authentication is approved; Checking the presence of the smart card in the card reader and if the smart card is removed, the computer terminal security method using an authorized certificate comprising the step of blocking the use of the computer terminal, harmful to the harmful information DB of the service server Inputting a URL or IP address for a website; Transmitting data of the harmful information DB to the computer terminal, and storing the harmful information information in the harmful site information DB; Requesting a website using the web browser; Matching the address of the requested website with a URL or IP address stored in the harmful site information DB; Interrupting access to the requested website if there is a URL or IP address corresponding to the address, and performing access to the website if there is no URL or IP address corresponding to the address; It presents a computer terminal security method using a certificate.

In addition, the step of retrieving the use rights of the authorized certificate stored in the smart card in response to a website request of the web browser; The method further comprises the step of performing a connection to the requested website according to the retrieved authority, and outputting a separate message when the connection to the website is interrupted. Suggest.

Encrypting a file or folder through the file / folder manager; Inputting the authorized certificate information and the electronic signature password; Further comprising the step of decrypting the encrypted file or folder, the encryption proposes a computer terminal security method using a public certificate, characterized in that the symmetric key encryption algorithm or public key encryption algorithm.

Hereinafter, a computer terminal security system using a public certificate according to the present invention and a method thereof will be described with reference to the accompanying drawings.

1 is a simplified configuration diagram of a computer terminal security system using a certificate in accordance with the present invention, the Internet network 100; A computer terminal 200 for accessing the Internet network and for authenticating and limiting the use of the computer terminal by the user; Smart card 300 with a built-in certificate; A card reader 400 connected to the computer terminal for acquiring the authentication information embedded in the smart card; An accredited certification authority (500) loaded on the Internet network to perform issuance and certification of accredited certificates; The computer terminal is provided with a service server 600 for providing information harmful site information.

The Internet network 100 provides an Internet access service through a wired or wireless network, and includes an Internet service provider (ISP). In addition, although the present invention has been described by way of example, the present invention can be applied to a local network that is not actually loaded in the Internet environment.

The computer terminal 200 is configured in detail as shown in FIG. 2, and includes a web browser 210 for performing access to the Internet network, a connection manager 220 for performing user authentication and access management, and And a harmful site information DB 230 having information on harmful sites, and a communication unit 240 for performing data communication with an external device, and the connection manager 220 includes the card reader 400. Certificate information acquisition unit 221 for acquiring the public certificate information input through the user, the user verification unit 222 for performing user authentication using the public certificate and the information input by the user, and the harmful site information DB A harmful site connection management unit 223 for blocking access to a site registered in the network, an external terminal connection management unit 224 for managing the connection of the computer terminal to an external device, and the computer terminal stored in the computer terminal. A file / folder management unit 225 for encrypting and decrypting files and folders, a terminal usage record storage unit 226 for generating and storing the computer terminal usage record, and a function and range for setting the respective components. It has a configuration that further includes an administrator setting unit 227.

Looking at the configuration, the web browser 210 is an application that allows the user to view all the information on the World Wide Web (WWW) by performing a connection to the Internet network 100 using the computer terminal 200 The program is Microsoft's Internet Explorer or Netscape.

The access management unit 220 is a kind of program that is automatically executed during the booting process of the computer terminal 200. The computer terminal 200 user authentication, harmful site access blocking, firewall function, encryption / decryption of files and / or folders. In order to achieve this, a certificate information acquisition unit 221 for acquiring the authentication certificate information input through the card reader 400 and the authentication certificate and the user's input are provided. A user verification unit 222 which performs user authentication using information, a harmful site access management unit 223 for blocking access to a site registered in the harmful site information DB 230, and the computer terminal of an external device. (200) an external terminal connection management unit 224 for managing access, a file / folder management unit 225 for encrypting and decrypting files and folders stored in the computer terminal 200, and the computer. Is composed of emitter terminal 200 and the terminal history storing unit 226 that stores the generated history, the administrator setting unit 227 for setting the respective constituent parts and functional range.

The certificate information acquiring unit 221 may be a driver module or an adapter module for controlling the operation of the card reader 400 as to acquire the certificate information stored in the smart card 300, the computer terminal At boot of 200 or

When the smart card 300 is inserted into the card reader 400, the smart card 300 and the computer terminal 200 are checked. When the smart card 300 is inserted, the smart card 300 is embedded in the smart card 300. The certificate information will be read. In addition, the presence of the smart card is periodically checked, and when the smart card is removed, the use of the computer terminal 200 is restricted.

The user verification unit 222 requests authentication to the authorized certification authority 500 by using the acquired official certificate information and the public certificate password entered by the user, and receives the authentication result for the use of the computer terminal 200. Determine the range. That is, when the authentication for the public certificate is successful (valid), the computer terminal 200 is allowed to be used, and when the authentication is failed (invalid), the use of the computer terminal 200 is restricted.

The harmful site access management unit 223 performs the blocking by using the harmful information stored in the harmful site information DB 230, and controls, monitors, and analyzes the packets transmitted and received through the computer terminal 200. Set the blocking policy through filtering. The above method may also be used to prevent hacking into the computer terminal 200. Microsoft's specification for a general device driver for NIC, which is hardware and protocol independent, is NDIS (Network Driver Interface Specification). Use As a method of controlling the packet, a protocol hooking driver is used in the Windows 95/98 platform according to the Windows platform, and an intermediate driver is used in the remaining Windows platforms.

The blocking of the packet refers to a function of blocking or allowing a specific packet by using a packet filter, and is a technique used for blocking by local ports, blocking remote IPs, and blocking harmful sites.

Monitoring and analysis of the packet is a method of capturing and monitoring or analyzing all packets received through a network interface card (NIC) to determine whether to block.

The packet filtering is a method of analyzing a packet header part to allow or block a specific packet by analyzing a characteristic of a received packet.

These methods are all stored as a log (log) file for tracking in the future when problems occur, each method is already used in the art, detailed description thereof will be omitted.

The external terminal access management unit 224 prevents hacking into the computer terminal 200 through an external terminal using the method described in the harmful site access management unit 223.

The file / folder manager 225 provides a function for the user to encrypt a specific file or folder of the computer terminal 200 or to decrypt the encrypted file or folder again. According to the type of (Key), the symmetric key encryption algorithm with the same encryption key and decryption key and the public key encryption algorithm with different encryption key and decryption key are classified into the block encryption algorithm. The above functions are provided by being divided into an algorithm and a stream encryption algorithm.

The above encryption methods are already widely used, but briefly described, the symmetric key encryption algorithm is called a secret key encryption algorithm or a single key encryption algorithm, and is a method in which a sender and a receiver perform encryption and decryption using the same key. . In addition, the public key encryption algorithm is a cryptographic system that is difficult to know the key that is different from each other and symmetrical to the encryption key and the decryption key, and generates two keys through a key generation algorithm and discloses one of them. Is used as a private key, and encryption is used as a public key and decryption is used as a private key.

By encrypting the file or folder of the computer terminal 200 by the conventional encryption methods as described above, the part using the official certificate to release the encryption can be used.

The terminal usage record storage unit 226 stores a record of the use of the computer terminal 200, the record is inquired and managed by a separate administrator.

The manager setting unit 227 sets a function such as a function limit, a use time limit, a user limit, a use range limit, etc. of the computer terminal 200 by a user having an administrator card in the smart card 300. Provides a function to perform system management of the computer terminal 200.

The harmful site information DB 230 stores a URL and / or an IP address of a web page or website to block access. The harmful site information is performed through an online update or an offline update through diskette delivery.

The communication unit 240 refers to a device and a program such as a len card, a modem, a protocol adapter, and the like that enable data communication between the computer terminal 200 and an external device.

The smart card 300 is a contact or contactless, or a combination card (contact / contactless), a Java Open Platform (JAVA Open Platform) card according to the standard of ISO7816 / 14443, and stores the certificate in the built-in memory . The ISO7816 is a standard following the ISO7810, which is a standard for credit and debit cards established by the International Organization for Standardization (ISO) in 1985, and was established in 1987. It is a standard.

The smart card 300 will be described in more detail. As shown in the application number 10-2001-0073374 (multiple authentication system using a smart card) filed by the same applicant, in FIG. And the control unit 320, examples of data stored in the memory unit 310 include credit information, electronic money, public certificate, fingerprint information, user identification code (ID), user personal information, and the like. The controller 320 is a data management module 321 for managing data stored in the memory unit 310 as a part of performing a calculation operation by a microprocessor, and stored in the memory unit 310. A transaction management module 322 for performing a role as an electronic wallet (E-purse) using electronic money and an input / output communication module 323 for exchanging data with an external device are mounted.

The user's personal information may be personal identification information such as name, social security number, address, or various certificate data, that is, a driver's license number, a health insurance number, a passport number, and the like, and a right to use the computer terminal 200. The information is data capable of performing a kind of identification card, and the authority to use the computer terminal 200 is for distinguishing an ordinary user from an administrator.

The data management module 321 classifies the data input and output to the smart card according to the type and performs management such as storing, deleting, and updating.

The transaction management module 322 is a module required to perform a transaction using credit card information and electronic money stored in the smart card 300, the credit card information is a credit card type, credit card number, etc. possessed by the user, In addition, the electronic money refers to a rechargeable electronic money used to charge the amount of money as desired. Accordingly, the smart card 300 by the transaction management module 322, the credit transaction using the credit information stored in the memory unit 310, debit card, traffic card, cash card, etc. using the charged electronic money It can also be used.

The various modules 321, 322, and 323 described above are applets developed based on the Java Open Platform, and according to needs according to the use purpose of the smart card 300. It is an application that can be installed in various ways.

Smart card 300 according to the present invention that can be configured as described above is preferably divided into a master card (User card) and a user card (User card) according to the use rights of the computer terminal 200, The master card may be referred to as an administrator of the computer terminal 200, and the user card may be referred to as a simple user of the computer terminal 200. Here, the use rights of the master card and the user card will be described. First, common functions include user information deployment (for example, fingerprint information, credit card information, terminal use authority information, etc.), mounting of an authorized certificate, and the like. The user has all rights to the use of the computer terminal 200, the computer terminal 200 use time adjustment for the user card user, computer terminal use function restrictions, computer terminal 200 usage history inquiry, etc., the user The card can be used only within the functions and ranges specified by the master card.

The card reader 400 is a device for reading the official certificate information stored in the smart card 300, which is also in accordance with the ISO7816 / 14443 standard, PC / SC for the interface between the computer terminal 200 and the smart card It adopts standard interface standard and can use regardless of Windows operating system type by using "winscard.dll" provided by Windows OS.

The Certificate Authority (CA) 500 is an institution that has the credibility to manage and guarantee the facts of transactions fairly according to the Digital Signature Act, and the manpower, technology, and funding power to safely establish and manage the certification system. As a personal certificate, a public certificate or a digital certificate of a user, such as a personal seal, is issued, and the subscriber can use the certificate to ensure the integrity and stability of the electronic transaction. Currently recognized government accredited certification bodies include Korea Financial Services Agency, Korea Securities Computerization, Korea Information Certification, and Korea Computer Center. An accredited certificate registration agency (not shown) may be configured between the accredited certification authority 500 and the computer terminal 200. The accredited certification agency facilitates a user identification and registration procedure to be issued when issuing an accredited certificate. In order to ensure that the certificate is designated, the agency is designated to act on behalf of the authorized certification body. If the certificate is valid, it renews, abolishes, and suspends the service.

The service server 600 is a server for providing a service to the computer terminal 200. Services provided to the computer terminal 200 include harmful site information and a program update of the access manager.

The member information DB 610 stores information on members who receive the service according to the present invention. Preferably, the member information DB 610 corresponds to a member name or name, address, contact information, and the like.

The harmful information DB 620 stores URLs and IP addresses of websites (or web pages) containing adult or harmful information.

The service provider 630 transmits harmful information and update related information of the harmful information DB 620 to the computer terminal 200 to provide a service.

The service management unit 640 is an administrator module for performing information update of the harmful information DB 620, so that the service server 600 can perform management and data management.

Hereinafter, a description will be given of the security method of a computer terminal security system using a public certificate according to the present invention configured as described above.

Figure 4 is a flow chart for explaining the login process to the Windows operating system in the computer terminal security using a public certificate according to the present invention, the official certificate issued by the certification authority and stored in the smart card (S1) Wow; The certificate information acquisition unit requests the public certificate (S2); Inserting a smart card into the card reader to provide public certificate information, and inputting an electronic signature password of the public certificate (S3); Transmitting the certified certificate information and the electronic signature password to the authorized certification authority to perform validity verification (S4); Receiving the validity authentication result to the computer terminal (S5) and blocking the use of the computer terminal when disapproving (s6), and accepting the use of the computer terminal when the validity authentication is approved (S7); Checking the existence of a smart card in the card reader, and shows the computer terminal security method using a public certificate including the step (S8) of blocking the use of the computer terminal when the smart card is removed.

First, the computer terminal should install a connection management unit 220 which is a program for providing a service using a security system according to the present invention.

Next, the smart card 300 stores the accredited certificate issued by the accredited certification authority 500. (S1) Of course, the smart card 300 includes information of a user, that is, fingerprint information, electronic payment information, and a computer terminal. The usage rights information of 200 is stored.

Thereafter, the computer terminal 200 is started, and the computer terminal 200 requests the input of the public certificate stored in the smart card 300 by the certificate information acquisition unit 221 during startup. (S2)

The official certificate information is transmitted to the computer terminal 200 by the card reader 400 and requests an electronic signature password for the official certificate. According to the request, the user inputs an electronic signature password for the public certificate granted to the user (S3).

The certificate and the digital signature password obtained by the certificate information acquisition unit 221 is transmitted to the of the authorized certification authority 500 by the user verification unit 222, the official certification authority is valid for the received content (I.e., the validity of the signature), and the authentication is performed (S4).

The authentication result is transmitted to the computer terminal 200 again, and the user verification unit 222 determines whether to use the computer terminal 200 according to the authentication result (S5). If it is to block the use of the computer terminal 200 (s6), if the authentication result is justified to allow the use of the computer terminal 200 (S7). At this time, it is natural that the user information included in the authorized certificate of the smart card 300, that is, the restriction on the use of the function of the computer terminal 200 according to the use right. It is a restriction of the use right according to the above master card or user card.

During the use of the computer terminal 200, the certificate information acquisition unit 221 periodically requires an authorized certificate of the smart card (S8), and removes the smart card 300 inserted into the card reader 400. Or if the smart card 300 is lost, the use of the computer terminal 200 is stopped, it is preferable to output a specific message such as a screen saver or "insert a smart card" with the suspension. . Of course, in the above case, it is natural that the stop time is set in advance, and if the time limit is exceeded, it is natural to save and automatically terminate the work performed in the computer terminal 200.

In addition, as shown in the flowchart of FIG. 5, a user who uses the computer terminal 200 by validity authentication of the public certificate and the digital signature password is provided by the harmful site connection management unit 223 of the connection management unit 200. Access to a harmful site can be used, the step of entering a URL or IP address for the harmful website in the harmful information DB (620) of the service server 600 (S11); Transmitting data of the harmful information DB 620 to the computer terminal 200, and storing the harmful information information in the harmful site information DB 230 (S12); Requesting a website using the web browser 210 (S13); Comparing the requested website address with a URL or an IP address stored in the harmful site information DB 230 (S14); If there is a URL or IP address corresponding to the address, stopping access to the requested website (S15), and if there is no URL or IP address corresponding to the address, performing a connection to the website (S15). S17). The harmful site is stored in the harmful site information DB 230, and the URL and / or IP address of the harmful site constructed in the harmful information DB 620 of the service server 600 through online or mailing. Updated offline with support.

In addition, the access management unit 220 according to the present invention is to provide a function such as a firewall function and hacking prevention by the external terminal access management unit 224, the external terminal access management including the harmful site blocking management is the user verification. It is possible to change the setting through the manager setting unit 227 by an administrator authorized by the unit 222.

In addition, during the use of the computer terminal 200, a user manages, ie, encodes or decodes a specific file or folder through an authorized certificate stored in his smart card 300 and the file / folder manager 226. In order to perform encryption using the digital signature password for the public certificate and the public certificate, and to decrypt the files and folders on which the encryption has been performed, the public certificate of the public certificate and the digital signature password may be used. The certification certificate validation shall be performed through input.

As described above, in the security of a computer terminal using a public certificate according to the present invention, the construction of a computer terminal security system using a private certificate and the like in a local network other than the internet network can be sufficiently provided. This is sufficiently applicable in the present invention as described above.

By using the computer terminal enclosed using the certificate according to the present invention as described above, there is an advantage that can effectively block the harmful site access to minors, and also reduce the external hacking damage.

In addition, since the authorized authority for each computer user and granting the authority is required, the effective advantages of security and management in computer use can also be great.

Claims (11)

To secure a personal computer terminal, An internet network; To perform data communication with a web browser for accessing the Internet network, a connection management unit for performing user authentication and access management, a harmful site information DB having information on a harmful site, and an external device. Computer terminal having a communication unit for; A smart card with a built-in certificate; A card reader connected to the computer terminal for acquiring the authentication information embedded in the smart card; An accredited certification authority which is loaded on the Internet network and performs issuance and certification of accredited certificates; A member information DB loaded on the Internet network and storing member information, a harmful information DB storing information about harmful sites, a service provider for providing harmful site information to the members, and Service server equipped with service management unit for performing management of each component Computer terminal security system using a public certificate including The method according to claim 1, The connection management unit, Certificate information acquisition unit for acquiring the authentication certificate information input through the card reader, A user verification unit which performs user authentication using the public certificate and information input by the user; A harmful site access management unit which blocks access to a site registered in the harmful site information DB, An external terminal connection management unit for managing the connection of the computer terminal to an external device; A file / folder management unit which encrypts and decrypts files and folders stored in the computer terminal; A terminal usage record storage unit for generating and storing the computer terminal usage record; Administrator setting unit for setting the function and range of each component Computer terminal security system using a certificate further including The method according to claim 1, The information stored in the harmful site information DB and harmful information DB is a computer terminal security system using a public certificate, characterized in that the URL or IP address The method according to claim 1, A computer terminal security system using an accredited certificate which is loaded on the Internet network and further includes an accredited certificate registration agency that is connected to the accredited certification authority to perform registration of the accredited certificate. An internet network; To perform data communication with a web browser for accessing the Internet network, a connection management unit for performing user authentication and access management, a harmful site information DB having information on a harmful site, and an external device. Computer terminal having a communication unit for; A smart card with a built-in certificate; A card reader connected to the computer terminal for acquiring the authentication information embedded in the smart card; An accredited certification authority which is loaded on the Internet network and performs issuance and certification of accredited certificates; A member information DB loaded on the Internet network and storing member information, a harmful information DB storing information about harmful sites, a service provider for providing harmful site information to the members, and In the computer terminal security system using a public certificate including a service server having a service management unit for performing the management of each component, Receiving a certificate issued by the certificate authority and storing the certificate in the smart card; The certificate information acquisition unit requesting the public certificate; Inserting a smart card into the card reader to provide public certificate information, and inputting an electronic signature password of the public certificate; Transmitting the certified certificate information and the electronic signature password to the authorized certification authority to perform validation; Receiving the validity authentication result to the computer terminal and blocking the use of the computer terminal when disapproved, and accepting the use of the computer terminal when the validity authentication is approved; Checking whether a smart card is present in the card reader and blocking the use of the computer terminal when the smart card is removed. Computer terminal security method using a certificate containing a The method according to claim 5, Inputting information on the computer terminal usage right into the smart card; Accepting, by the user verification unit, a function and a range of using a computer terminal according to a use authority stored in an authorized certificate of the smart card; Computer terminal security method using a certificate further including The method according to claim 5, Inputting a URL or an IP address of a harmful website in a harmful information DB of the service server; Transmitting data of the harmful information DB to the computer terminal, and storing the harmful information information in the harmful site information DB; Requesting a website using the web browser; Matching the address of the requested website with a URL or IP address stored in the harmful site information DB; Interrupting access to the requested website if there is a URL or IP address corresponding to the address; and performing access to the website if there is no URL or IP address corresponding to the address; Computer terminal security method using a certificate further including The method of claim 7, wherein Retrieving permission to use an authorized certificate stored in the smart card according to a website request of the web browser; Performing access to the requested website according to the retrieved authority Computer terminal security method using a certificate further including The method of claim 7, wherein Outputting a separate message when the access to the website is interrupted; Computer terminal security method using a certificate further including The method according to claim 5, Encrypting a file or folder through the file / folder manager; Inputting the authorized certificate information and the electronic signature password; Decrypting the encrypted file or folder Computer terminal security method using a certificate further including The method of claim 10, The encryption method is a computer terminal security method using a public certificate, characterized in that the symmetric key encryption algorithm or public key encryption algorithm.