KR20040009394A - Information secure system with PKI technology - Google Patents

Abstract

PURPOSE: A system for intercepting the illegal information outflow by a PKI(Public Key Infrastructure) technology is provided to intercept an external intruder and to prevent an internal authorized person from flowing out the information without permission by encrypting the data on the LAN(Local Area Network) and setting an authority through the PKI. CONSTITUTION: The system is divided into a server section(400) and a client section(500). The server section is classified into a general system user group(411) using a general system regardless of encryption and a CFS(Cryptographic File System) user group(421) using an encrypted file. The general system user group uses only a general directory and can not use a CFS directory(420). The CFS user group can use the CFS directory. If the client section wants to access the CFS directory of the server section, the client section registers to an authority register(440) through a procedure receiving the authority certification from an authority certification part(430).

Description

Information security system with PKI technology {Information secure system with PKI technology}

As computer-to-computer communications over the network become more common, various information leaks have occurred, such as theft or destruction of important data by invading other users' domains, the intrusion into bank computers through telephone lines, the manipulation of deposits, or the alteration of school grade data. Due to the frequent occurrence, the institution is very concerned about security.

It is a security measure that can be implemented by the users of non-secured public network such as the Internet as a standard for personal computer system. It is divided into main parts and the representative contents are by server section, client section and entire encrypted file system. It is applied separately. In the following, the main contents and problems are described. In the client section, which is usually performed according to the control command of the server, the personal PC security of functions such as the use of passwords or software locks that are taken to the terminal to protect the system or data from illegal use, and the external In order to protect the internal confidentiality and information from users or electronic wiretapping, a firewall is used to prevent the access of people who do not meet certain requirements when connecting to the external network or to prevent data intrusion in advance. However, these technologies all have a problem that blocking is impossible when information is leaked by an authorized internal user. In addition, in the server section that comprehensively manages internal files according to preset security settings, there are generally SAC (Server Access Control) or Secure OS, but these are not encrypted. Also, as a whole encryption file system, as a solution to block external intrusion through the network like a firewall or to detect and respond to intrusion after the firewall is hacked by an external intrusion, various hacking methods have already been built and in itself Unlike intrusion detection system (IDS) that can detect and control behavior in real time or simply firewall or IDS of passive defense concept, it is a concept that combines intelligent function and active function that actively responds automatically. It uses IPS (Intrusion Prevention System) to detect and monitor suspicious activity on devices connected to the network. You can stop if you want to spill There was no way.

The present invention is to solve the above problems, and encrypts data on the local network (company or organization, etc.) by the public key infrastructure (PKI), block external invasion due to the authority setting, and prevent unauthorized leakage of information of the insider It is to provide a blocking system to prevent.

In an embodiment of the information leakage prevention system according to the present invention for achieving the above object as

The server section is classified into a group of general system users who use a general system regardless of encryption, and a group of Cryptographic file systems (hereinafter referred to as "CFS") users who can use encrypted files. While only general directories can be used and CFS directories cannot be used, CFS user groups can use the CFS directory and the CFS directory can decrypt the CFS directory to make it a regular directory, or encrypt the general directory to CFS directory. In order for the client to access the CFS directory of the server section, the client must be registered in the privilege register through the authorization authentication procedure in the authorization section. The client section connected to the server section is connected to the CFS drive. through The registrants registered in the authority registration can output data to the general drive by encrypting or decrypting through the CFS drive, and the non-registrants output only the encrypted directory bypassing the CFS drive. It is configured to be able to.

1 is a block diagram of a blocking system for preventing unauthorized information leakage by the public key infrastructure (PKI) of the present invention.

2 is a flowchart of security operations on a server.

3 is a flowchart of security operations on a client section;

<Description of the symbols for the main parts of the drawings>

400: server portion 410: general directory

411: system user group 420: CFS directory

421: CFS user group 430: authorization

440: Authority registration 500: Client part

510: General drive 520: CFS drive

530: Registered right 540: Non-registered right

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a blocking system for preventing unauthorized information leakage by a public key infrastructure (PKI) of the present invention. As shown in the drawing, the system is divided into a server section 400 and a client section 500. In addition, the server section 400 includes a general system user group 411 that uses a general system regardless of encryption, and a cryptographic file system (CFS) user group 421 that can use an encrypted file. CFS user group can use the CFS directory, while the system user group 411 can use only a general directory and cannot use the CFS directory. In addition, the encrypted file system may decrypt the CFS directory into a general directory, or encrypt the general directory and convert the CFS directory into a CFS directory.

Here, the encrypted file system is a system that performs a function of encrypting and decrypting files and directories. Encryption of a file is generally performed as follows. When a user selects one or more files and performs encryption, the files are encrypted and stored on disk. Both reads and writes to the file are encrypted, and all users who try to open the encrypted file will receive an access denied error because they do not have a key to decrypt the file. In this case, the administrator should not encrypt the files in the system directory. These files are needed to boot the system. Preferably, files with system properties may solve this problem by disallowing encryption attempts.

Marking a directory as encrypted is similar to file encryption. The user can select a directory to encrypt, select the encryption option, and choose whether to encrypt the directory only or all files and subdirectories below it. With directory encryption, you can manage confidential files by simply copying them to an encrypted directory. It is also a good idea to provide visible encryption and decryption during data writes and reads to avoid having to decrypt files or directories for normal operation. However, in special situations where users need to share encrypted files with other users, this decryption may be necessary. Users can use the context menu to decrypt files and mark directories as unencrypted, similar to the task of encryption. When you do this on one or more files, CFS decrypts and deciphers the entire file. If you want to decrypt a directory, it is convenient to have the context menu repeatedly decrypt all encrypted files and subdirectories in that directory.

On the other hand, in order to access the CFS directory 420 of the server section 400, the client 500 needs to register with the authority registration 440 through a procedure of receiving authority authentication from the authority authentication 430 unit.

Security in this server section 400 is as follows.

The server section 400 is usually designed to be accessible from an external PC, not in-house, in preparation for external hacking, and loads only resources necessary for communication with the client 500 and encrypts all transport packets to secure the outside. The present invention is considerably superior to the conventional security technology described above, regardless of the type of CPU type / operating system (OS), the cryptographic file system operates in a modular form on the OS kernel and is stored in the cryptographic file system. Information is encrypted and stored with a unique key for each user.

In addition to the general system user group 411 registered in the system, the user and group 421 on the encrypted file system are separately managed so that users and groups not registered in the encrypted file system are superusers. , Admin) has the function to disable access. At this time, the authority authentication 430 for the users and groups of the encrypted file system is usually performed based on the public key infrastructure (commonly referred to as PKI technology).

The above PKI technique will be described briefly. Public Key Infrastructure (hereinafter referred to as "PKI") uses a pair of public and private keys granted by a trusted authority to enable secure and confidential exchange of data or funds. It provides a digital certificate to identify an individual or organization, and a directory service that can store and retrieve the certificate when needed. PKI uses public key cryptography, the most common method of authenticating a message sender or encrypting a message on the Internet. Traditional ciphertext usually involves creating and sharing a secret key that is used to encrypt and decrypt messages. Such a private or private key system has a fatal weakness that the message can be easily decrypted if the key is known or intercepted by others. For this reason, public key encryption and PKI are the preferred methods on the Internet. Private key systems are sometimes referred to as symmetric cryptography and public key systems are called asymmetric cryptography. Typically, a PKI is a certificate authority that issues and verifies digital certificates, certificates that contain information about a public or public key, and certificates that have a public key or a registrar that acts as a certification authority before digital certificates are issued to applicants. It consists of one or more directories and a certificate management system where they are stored. In the encryption of the public key, the public key and the authentication key are simultaneously created by the certification authority using the same algorithm (commonly referred to as RSA). The private key is given only to the requester, and the public key is published as part of a digital certificate in a directory accessible to everyone, and the private key is never shared with anyone or transmitted over the Internet. You use your private key to decrypt text that someone encrypted with their public key found in the public directory. Therefore, if someone sends a message to someone, first find the recipient's public key through the central administrator, then encrypt the message using the public key, and the person who receives the message uses it's own private key. To decipher.

If you want to send a signature, send the certificate encrypted using the sender's private key.If you want to decrypt the signature, the sender of the message must be able to decrypt the encrypted signature using the sender's public key. It allows you to know that you are the sender.

Meanwhile, the client section 500 connected to the server section 400 network refers to a personal computer that accesses the server section 400 and inputs and outputs information. The server section 400 and the server section 400 through the CFS drive 520. The registrants 530 that are connected in communication and registered in the authority registration 440 may output data to the general drive 510 by encrypting or decrypting the data through the CFS drive 520, and the non-registrants 540 may read the data. Only the encrypted directory bypassing the CFS drive 520 can be output. Normally, after entering the ID and password in the login process, the user is authenticated while operating the encrypted file system, and the CFS drive is operated using the public key, so that the registrants 530 can use the CFS related directories.

Security in this client section 500 is performed as follows.

That is, all information on the CFS drive to which the encrypted file system is applied is encrypted and stored. Only the authorized user 530, the authorized user, receives the session key from the server section 400 that receives the CFS drive 520 to which the encrypted file system is applied. It can be mounted and used by unauthorized users, and unauthorized users are forced to control access. In the case where the non-registered right holder 540 approaches the CFS drive 520, all data is encrypted and output so that decryption is not possible. Information can also be leaked to other media 550, but all are encrypted and output so that there is little possibility of decryption according to the degree of encryption (encryption strength) of the present encryption file system.

In this way, the client section 500 does not interfere with general office work through file management through the general drive 510 and file management through the CFS drive 520, and any external storage device such as a CD, a USB printer, or an FTP or e-mail. You can also prevent the leakage of management files online.

Security over communications on the local network is achieved as follows.

As shown in FIG. 1, the CFS directory protected by the encrypted file system on the server section 400 must be stored in the CFS drive 520 to which the encrypted file system of the CFS user group 421, which is an authorized user, is applied. Access to the authorized application program is enabled, but when stored in the general drive 510 to which other file systems (NTFS, FAT32, etc.) is applied, it is stored as encrypted and cannot be decrypted by any application program. At this time, the client section 500 and the server section 400 can communicate by an authentication system based on the PKI technology, and all information on the communication is encrypted and transmitted.

As such, all information stored in this encryption system may be leaked with the permission of the security administrator, but it may be possible to leave the record. However, the present invention is impossible to leak externally. It is to prevent unauthorized leakage of information.

Hereinafter, a flowchart of a security operation on a server will be described with reference to FIG. 2. If the user accesses the encrypted filed, that is, the directory where the encrypted file system is mounted (step 20), while the system is loaded and the encrypted file system module is initialized (step 10) as shown in FIG. Are classified (step 30). If the user is a security administrator, the security administrator accesses the encrypted file system through Admintool, performs administrative tasks (step 40), and determines whether access is made from a designated computer (IP) and whether the ID and password are correct. (Step 41). If the administrator is not registered in the above step, access is disabled (step 51), and only the registered administrator may register or delete the encrypted file system, and may select an encryption algorithm of the encrypted file system. In addition, it is possible to perform setting / deleting tasks of groups and users in the encrypted file system (step 42). On the other hand, if necessary in step 41 it is preferable to further implement the step of verifying the certificate can further refine the security step.

In step 30, if the user is a system administrator, all access rights to the encrypted file system are deleted (step 50) and access is disabled (step 51). (Step 60), the registered group / user can encrypt or decrypt with the designated user's key and group key, and output information to media such as a hard disk (step 61). If it is not a group / user registered in step 60, access is also disabled (step 51).

Next, the security operation flow diagram on the client section will be described with reference to FIG.

When the user communicates with the server, first, the user is given the same system key as the user key registered in the server through user authentication, and the encrypted file system is mounted using the system key (step 100). After that, when the user accesses the directory to which the encrypted file system is applied, the user determines whether the access subject is a registered application (step 140), and if the user is a registered user, distinguishes whether the work type is read or write (step 200). ). If it is read in step 200, decryption is performed with the designated user's key and group key and stored on the hard disk if necessary (step 210). In the case of writing in step 200, it is checked whether the writing target is an encryption file system (step 230). If it is an encryption file system, encryption is performed using the designated user's key and group key and stored in the hard disk if necessary (step 250). In step 230, if the target is not an encrypted file system, it may not be stored in a CD-ROM or a floppy (step 240). In other words, writing to an area other than the encrypted file is impossible. On the other hand, in step 140, even if the access subject is not a registered application, the task type is distinguished from read or write (step 300). In the case of reading in step 300, the encrypted data is read as it is without decryption so that the display cannot be decrypted (step 310). In this case, the same operation is performed even when the network is accessed. In the case of writing in step 300, encryption or decryption may be performed using the designated user's key and group key and stored in the hard disk (step 320).

While the invention has been described in detail only with respect to the described embodiments, it will be apparent to those skilled in the art that various modifications and variations are possible within the spirit of the invention, and such modifications and variations belong to the appended claims.

As described above, the present invention encrypts the data on the local network (company or organization, etc.) by the public key infrastructure (PKI), so that the client section is troubled in general office work through the file management through the file through the general drive and the CFS drive. It also has the effect of preventing the leakage of management files through all external storage devices such as CD, USB, printer, or online such as FTP and e-mail. The server section has the effect of blocking external invasion due to permission setting. It is effective to provide a blocking system that prevents unauthorized disclosure of information. In other words, all information stored in the encryption system will be impossible to leak externally, and thus, there is an effect of preventing unauthorized leakage of information on the local network.

Claims (2)

Loading the cipher file system module while initializing the system and initializing the cipher file system (step 10); Classifying the user when the user accesses a directory in which the encrypted file system is encrypted (step 30); If the user is a security administrator in step 30, accessing the encrypted file system through an admintool and performing administrative tasks (step 40); Determining whether access has been made from the designated computer (IP) and whether the ID and password are correct (step 41); Disabling access if not an administrator registered in step 41 (step 51); In the case of the administrator registered in step 41, the user can register or delete the encrypted file system, select an encryption algorithm of the encrypted file system, and perform setting / deletion of groups and users in the encrypted file system. Enabling (step 42); If the user is a system administrator in step 30, deleting all access rights to the encrypted file system and disabling access (step 51); Determining whether the user is a registered group / user of the IM file system when the user is a general system user in step 30 (step 60); In the case of the group / user registered in step 60, encrypting or decrypting with the designated user's key and group key, and outputting information to media such as a hard disk (step 61); Disabling access if not a group / user registered in step 60 (step 51); Unauthorized leakage blocking system of the server information comprising a. Mounting the encrypted file system using the same system key as the user key registered in the server through user authentication (step 100); Thereafter, when the user accesses the directory to which the encrypted file system is applied, determining whether the access subject is a registered application (step 140); Distinguishing whether the job type is read or write (step 200) when the user is registered in step 140; Performing reading with the key and group key of the designated user if the reading is in step 200 and storing it in a hard disk (step 210); In the case of writing in step 200, determining whether the write destination is an encrypted file system (step 230); If the write target in step 230 is an encrypted file system, performing encryption with a designated user's key and group key and storing the encrypted data on a hard disk if necessary (step 250); If the target is not the encrypted file system in step 230, storing data other than the CD-ROM or the floppy, that is, the encrypted file area (step 240); Determining whether the work type is read or write when the access subject is not a registered application (step 300); In the case of the reading in step 300, the encrypted data is read without being decrypted so that it cannot be decrypted (step 310); In the case of writing in step 300, allowing encryption or decryption to be performed using a key and a group key of a designated user and storing it on a hard disk if necessary (step 320); Information leakage prevention system of a personal computer made, including.