KR20040037051A - Document Security System and Method therefor, and Recording Medium Recording a Program Carring Out The Method - Google Patents

Abstract

PURPOSE: A document security system and a method for the same and a recording medium for executing the program capable of reading a computer are provided to encrypt document using an internet account of a receiver, and decrypt the encrypted document by verifying the user. CONSTITUTION: The document security system comprises client computers(110, 120), a document security server(130), and an internet server(140). Document security client modules(111, 121) are installed at the client computers(110, 120). The internet server(130) stores user IDs. The document security client modules(111, 121) have an ID at each module. The document security client modules(111, 121) generate security documents' information and register the document to the document security server(130). The document security client modules(111, 121) decrypt the encrypted document using transmitted session key and configuration information, and confirm electronic signatures by using the temporary public key. The document security server(130) registers the session key and configuration information generated from the document security client modules(111, 121) for each document, and transfers the session key and the configuration information when the legal user's request is generated.

Description

Document security system and method and computer-readable recording medium programmed to execute the document security method TECHNICAL FIELD

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a document security system and method related to the security of a program file or a general document. In particular, a document stored in a user terminal is referred to as an Internet account (hereinafter referred to as an "Internet account") of a recipient's portal server or an email server. Recipients can be identified and encrypted using the ID of the user, and when the encrypted document is transmitted to another terminal, the receiver can be read by logging in to the Internet account and decrypting the encrypted document. A document security system and method thereof are provided.

As communication technology has developed, personal computers (PCs) have become popular, and these PCs are used not only in homes, but also in offices, schools, and PC rooms, where people can share one PC. This is a widening trend.

In addition, digital communication using a personal computer is not only easy to make the same copy or modified version of the original, but also easy to distribute, so that the confidentiality of the company or organization may be leaked due to illegal copying and distribution of documents. Cause.

Therefore, a user who writes a confidential document using a PC or performs a secret project requires document security so that other users cannot check the created document and program without permission.

Accordingly, a method for preventing unauthorized third parties from verifying a document or a program file created by a certain user has been developed and used.

For example, if you want to set a user password on a calendar document or program file to run the document or program file, you must enter the user's password beforehand to run the document or program file, or you can enter the user's initials in the document. It is a watermarking technique that secretly inserts to clarify the origin of the document.

Recently, a method of directly encrypting a document has also been studied. For example, there is an electronic envelope method that encrypts a secret document or program using a symmetric key encryption algorithm, and then encrypts the key and hash values with the document recipient's public key and transmits the data over a network.

However, the document security method continuously uses a fixed security key, that is, a fixed initial or a user's password, which may be leaked or hacked by others, and using a public key encryption algorithm. In the case of encryption, it is necessary to find a certificate of the other party, and in the case of a password, there is a hassle to inform the other party of the password.

In order to solve the above problems, an object of the present invention is to encrypt a document stored in a user terminal using a recipient's Internet account and to designate the recipient, and when the stored encrypted document is transmitted to another terminal, Providing a document security system and method for verifying that the user is authorized by logging in to an Internet account to decrypt and view the encrypted document, and a computer-readable recording medium having recorded thereon a program for realizing the method. There is.

In addition, the present invention provides a simple and secure document security method that does not require the sender or receiver who creates a secure document to individually manage a password related to encryption or a public key associated with an electronic signature, and the security setting of the secure document is released. Its purpose is to ensure that security is achieved as intended by the author of the document, even after it has been done.

Other objects and advantages of the present invention will become more apparent with reference to the following detailed description of the invention and the accompanying drawings.

1 is a system schematic diagram showing a schematic configuration of a document security system according to the present invention;

2 is a flowchart illustrating a document security setting method according to the present invention;

3 is a diagram illustrating a screen for specifying a recipient by the recipient's Internet account ID,

4 is a diagram illustrating a screen for a sender to enter an Internet account ID and password,

5 is a diagram illustrating a screen configuration for inputting an automatic destruction setting condition.

6 is a flow chart illustrating a method of registering a session key and configuration information of a secure document with a document security server according to the present invention;

7 is a flowchart illustrating a method of releasing a security setting of a secure document according to the present invention to generate a general document,

8 is a diagram illustrating a screen configuration for authenticating a user.

9 is a diagram illustrating a screen configuration for confirming an electronic signature;

10 is a diagram illustrating a screen configuration for checking the automatic destruction setting condition.

11 is a flow chart illustrating a file I / O process in accordance with the present invention.

Document security system according to an aspect of the present invention for achieving the above object is a document security client module is installed, the document security client module generates a security key for the document to be secured to secure the security document according to the security settings A sender document security client computer and a document security client module for generating and registering configuration information for the secure document and registering the document with the document security server, and the document security client module sends the document to the secure document. Receiving configuration information received from the recipient document security client computer to release the security settings, the sender document security client computer registered configuration information sent by the document for each document, if requested by the authorized user configuration information Awards Characterized in that it comprises an Internet server with a secure document server, and user accounts to secure sent to the recipient document, the client module is registered. The document security client computer may further include a file protection module that stores configuration information transmitted from the document security server. In addition, the security key includes a session key for document encryption and a temporary private key / temporary public key pair for digital signature, the temporary public key for verifying the electronic signature is included in configuration information, and the document encryption The session key for is registered with the document security server independently of the configuration information, and is transmitted to the recipient document security client module upon request of the authorized user.

According to another aspect of the present invention, in the document security method of the present invention, a client computer on which a document security client module is installed, a document security server, and a server on which a user's account is registered (hereinafter referred to as an "Internet server") form a network. Designating a recipient of a document by using the recipient's Internet account ID in a document security system coupled through the document security; generating, by the sender's document security client module, a session key and a document ID for the document; Encrypting the document, generating a secure document containing the document ID and document information in the encrypted document, generating configuration information for the secure document, and session key and configuration information for the secure document. Registering with the document security server, the document security class of the recipient Receiving, by the client module, the configuration information about the secure document from the document security server, by logging into the Internet server with the Internet account of the recipient to confirm that the document security client module of the recipient is a legitimate recipient of the secure document. Authenticating the recipient; when the recipient authentication is completed, receiving the session key from the document security server by the document security server; decrypting the encrypted document with the session key and based on the configuration information Generating a general document.

According to another aspect of the present invention, the electronic signature method of the present invention is a document security system in which a client computer on which a document security client module is installed, a document security server, and an Internet server on which a user's account is registered are connected through a network. Authenticating the sender by logging in to the Internet server with the sender's Internet account to verify the sender, wherein the sender's document security client module generates a temporary public / temporary key pair and document ID for the document. Digitally signing the document with the temporary private key, registering configuration information for the electronically signed document with the document security server, and the document security client module of the recipient obtains configuration information from the document security server. Receiving the step, to the configuration information And verifying the electronic signature of the electronically signed document with the included temporary public key.

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

1 is a system schematic diagram schematically showing the configuration of a document security system according to the present invention.

Referring to FIG. 1, a document security system according to the present invention includes a user document security client computer 110, 120, a document security server 130, and a user account on which document security client modules 111 and 121 are installed. Server 140.

The Internet server 140 is sufficient as long as the user's account is registered, and may include, but is not limited to, a portal site and an e-mail server where the user's account is registered. Hereinafter, for convenience of explanation, the sender has an internet account of "alice@hotmail.com" and the receiver has an internet account of "bob@naver.com".

The document security client modules 111 and 121 are modules installed in a user's computer and have an ID for each document security client module (hereinafter, referred to as a "prog id"), and are registered in the document security server as an ID of the module. There is a key / public key pair. In addition, a session key for document encryption and a temporary private key / public key pair for electronic signatures are generated for each document, and the document is encrypted with the session key or a security signature is generated such as an electronic signature generation with the temporary private key. Then, configuration information of the secured document ("security document") is generated and registered in the document security server 130. Also, in order to release the security setting of the security document, the session key and the configuration information are received from the document security server to decrypt the encrypted document or verify the electronic signature with a temporary public key (electronic signature verification key) included in the configuration information. Disable security settings on security documents. In addition, the document security client module authenticates the user by accessing the Internet server 140 and logging in with the user's Internet account to confirm that the user is an authorized user.

The document security client module also includes file protection modules 112 and 122 that are installed when the document security client module is installed. The file protection module monitors all file I / Os and controls file I / Os for documents having configuration information according to the present invention.

The document security server 130 registers the session key and configuration information generated by the document security client module for each document, and transmits the session key and configuration information to the document security client module when requested by the authorized user. do.

Hereinafter, a detailed procedure of the document security method of the present invention by the system will be described.

2 is a flowchart illustrating a document security setting method according to the present invention.

The secure document creator (hereinafter referred to as a "sender") selects a document for which security settings are desired, and selects a security setting type such as a password file generation, an electronic signature generation, and an automatic destruction generation (step 201). Creating a password file refers to encrypting the document by specifying a person who has permission to view the secure document (hereinafter referred to as the "recipient"). An electronic signature generation refers to the document creator's Internet account to verify the document creator. Digital signature on a document. And automatic destruction generation means that a sender sets the validity period, the number of validity | times, etc. which a recipient of a document can read the said document. In addition, the term "document" in the present invention should be understood to include not only general documents but also all files such as program files.

First, if the type of security setting is selected, the sender specifies the recipient (step 202). In the present invention, the recipient is assigned to the Internet account that most people have. The sender specifies the recipient by entering the recipient's Internet account ID "bob@naver.com" into the input box. 3 illustrates a screen for designating a receiver by an Internet account ID of the receiver. Of course, it is also possible to designate a plurality of recipients, and when a plurality of recipients are specified, it is also possible to set security settings described below individually for each recipient.

After designating the recipient of the document, a security document having security settings such as a password file generation, an electronic signature generation, and an automatic destruction generation is generated in each method as described below. However, the matters to be noted here are for convenience of explanation, divided into a password file generation, digital signature generation, automatic destruction generation, etc., but in actual implementation, the password file generation, electronic signature generation, automatic destruction generation for a single document at the same time Note that it can be done. In addition, as long as the security document according to the present invention is generated, the order of generating the security document is not important, and some illustrated steps may be omitted or appropriately changed. Such applications or modifications are apparent to those skilled in the art having ordinary skill in the art.

Create Password File

If the security setting type is "password file generation", the document security client module (sender) checks the validity of the input "bob@naver.com", and generates a document ID (docu id) and a session key (step 203). At this time, it should be guaranteed that the session key and docu id have not been previously generated. The document security client module (sender) encrypts a general document (1.txt) with the session key (step 204), and writes down various information such as a prog id and a document ID of the document security client module. Generate a secure document (encrypted document, 1.toe (e)) (step 210). Then, the document security client module (sender) generates configuration information (conf (1.txt)) for the secure document (step 211), the generated session key and the configuration information (conf (1.txt)). Register with the document security server (step 212). The configuration information (conf (1.txt)) includes a security setting type ("password file generation"), a docu id, a recipient's Internet account ID ("bob@naver.com"), and the like. Although the session key may be included in the configuration information and managed, the session key may be managed separately because it is extremely important for the security of the security document.

Generate electronic signature

If the security setting type is " generate digital signature ", the sender authenticates the sender by logging in to the sender's own Internet account (step 205). When the sender enters his internet account ID, "alice@hotmail.com" and the corresponding password, the document security client module (sender) identifies the Internet server from the Internet account ID and logs in with the ID and password. Try. Since the Uniform Resource Locator (URL) of the Internet server may change continuously, the document security client module must continue to receive updates from the document security server. 4 is a diagram illustrating a screen for inputting the sender's Internet account ID and password. Of course, if the sender's Internet account ID is already registered in the document security client module, the sender may be configured to input only a password corresponding to the sender's ID.

After the document security client module (sender) authenticates the user by logging in to the Internet server with the ID and password, the document security client module generates a docu id and a temporary public / temporary private key pair (step 206). The document security client module (sender) electronically signs the general document (1.txt) with the temporary private key (step 207). Looking at the process of the electronic signature in detail, by encoding a general document (1.txt) in a base 64 method to generate a hash value (hash (1.txt)) of the document, by digitally signing it with the temporary private key Generate a digitally signed value (cert (1.txt)) for the document. To configure the cert (1.txt), hash (1.txt), docu id, "alice@hotmail.com", portal server time, etc. are required. Finally, the secure document client module (sender) generates the cert (1.txt) and the secure document (document with electronic signature, 1.toe (s)) containing various information (step 210).

The document security client module (sender) generates the configuration information (conf (1.txt)) for the secure document (step 211), and secures the configuration information according to the file information registration method according to the present invention. Register with the server (step 212). The configuration information includes the security setting type ("generate electronic signature"), docu id, recipient's Internet account ID ("bob@naver.com"), sender's Internet account ID ("alice@hotmail.com"), and temporary disclosure. Keys and the like.

Automatic destruction generation

If the security setting type is "automatic destruction generation", the document security client module (sender) generates a docu id (step 208), and the sender sets an automatic destruction condition (step 209). 5 is a diagram illustrating an automatic destruction setting screen. The sender can set the number of validity times, the validity time, etc. that the recipient of the document can view the document. Thereafter, the document security client module (sender) generates a security document (automatic destruction setting document, 1.toe (a)) containing various information such as prog id and docu id (step 210).

The document security client module (sender) generates configuration information (conf (1.txt)) for the secure document (step 211) and registers the configuration information with the document security server. The configuration information includes a security setting type ("automatic destruction generation"), a docu id, a recipient's Internet account ID ("bob@naver.com"), automatic destruction conditions, and the like.

How to register file information

The document security client module registers the session key and configuration information for the secure document in the document security server in detail with reference to FIG. 6 as follows.

The document security client module (sender) connects to port 80 of the document security server via the HTTP protocol (step 601). Prog id, docu id, and configuration information (conf (1.txt)) are sent to the document security server (step 602). At this time, the configuration information (conf (1.txt)) and the docu id are digitally signed by the private key of the secure document client module (sender) and transmitted. If there is a session key as in the case of the encryption file generation, the session key is encrypted with the public key of the document security server and transmitted (step 603). The document security server verifies that the prog id of the document security client module is valid and checks the electronic signature with the public key of the registered secure document client module (sender). If there is a session key, the session key is decrypted with the private key of the document security server. The document security server stores the configuration information (conf (1.txt)) in the database using the docu id and prog id as keys (step 604), and stores the session key in a separate secret key database (step 605). .

The document security server signs the prog id and docu id with its private key and sends it to the document security client module, and the document security client module (sender) confirms that the file information registration is completed by checking the electronic signature of the document security server ( Step 606). If the electronic signature of the document security server cannot be verified or an error message is delivered, the document security client module notifies the file information registration failure and cancels generation of the file.

7 is a flowchart illustrating a process in which a receiver of a secure document releases security settings of the secure document to generate a general document. When the security document with the security setting is transmitted to the receiver, the receiver releases the security setting of the security document to generate a general document, and stores configuration information related to the security setting in the file protection modules 112 and 122. A security setting release method of the security document will be described with reference to the drawing.

When the secure document is sent to the receiver, the receiver must release the security setting of the secure document. First, when the secure document is selected, the document security client module (receiver) sends a docu id and a prog id to the document security server (step 702). The document security server retrieves the configuration information stored with the ID as a key and sends it to the document security client module (receiver) (step 703). At this time, the document security server electronically signs and transmits the configuration information (conf (1.txt)) with the private key of the document security server, and the document security client module (receiver) checks the signature with the public key of the document security server.

The document security client module (receiver) then authenticates the recipient by logging in to the Internet account of the recipient specified by the sender, included in the configuration information, to confirm that the recipient is a legitimate authorized recipient (step 704). 8 illustrates an example of a screen for authenticating a receiver. The receiver selects his / her Internet account ID from the user authentication screen and inputs a password corresponding to the Internet account ID. The document security client module (receiver) attempts to log in to the Internet server corresponding to the Internet account ID and the password, and authenticates the recipient if the login is successful.

If the recipient is identified, the document security client module (receiver) receives the session key from the document security server when the security setting type of the configuration information is "password file generation" (step 705). At this time, the document security server encrypts and transmits the session key with the registered public key of the document security client module (receiver), and the document security client module (receiver) decrypts it with its own private key. The document security client module (receiver) then decrypts the secure document (1.toe (e)) with the session key (step 706) to generate a general document (1.txt) (step 709), and the configuration information. Copies to the file protection module (step 710).

If the configuration information is " generated digital signature ", after confirming the digital signature with the temporary public key included in the configuration information as shown in the screen for confirming the digital signature of FIG. 9 (step 707), a general document (1.txt) is generated. (Step 709), the configuration information including the checked content is stored in the file protection module (step 710).

If the configuration information is " automatic destruction generation ", after confirming the automatic destruction condition as shown in the screen for confirming the automatic destruction condition of FIG. 10 (step 708), a general document (1.txt) is generated (step 709). In operation 710, the configuration information including the checked contents is stored in the file protection module.

11 is a flowchart illustrating a process of file I / O according to the present invention.

In the general document (1.txt) transmitted to the receiver according to the present invention and the security setting is released, the configuration information is stored in the file protection module using the full path of the general document as a key. As described above, the file protection module monitors all file I / Os to control file I / Os of files in which configuration information is stored in the file security module. Therefore, even after being transmitted to the receiver, the file I / O of the document can be controlled according to the security setting set by the sender.

First, when the receiver attempts to file I / O, the file protection module verifies that the configuration information exists in the full path of the document (step 1102). If the configuration information is present, the file protection module sends the configuration information to the document security client module. The document security client module (receiver) reads the configuration information and performs user authentication as described above (step 1103). As shown in Fig. 8, each time the recipient browses the document, an option setting for storing the password for one day is also possible to eliminate the inconvenience of having to enter the recipient's password. When user authentication is completed, it is checked whether the file I / O satisfies the security setting condition included in the configuration information (step 1104). If the file I / O satisfies the security setting condition, the document security client module (receiver) sends the OK signal to the file protection module to execute the file I / O (step 1105), and sets a security constraint. If not satisfied, the document is deleted or the file I / O is rejected (step 1106). For example, if the validity period is set, the document is deleted if the validity period has expired, and if it is within the validity period, the file protection module sends an OK signal to the file protection module so that the file I / O of the document is determined. Run O. The file I / O includes loading, copying, deleting, saving as, and the like. In addition, in the case of a digitally signed document, it may be a printout of the sender certificate confirmation document. In addition, in the case of an electronic signature, the content of the document should not be allowed.

The embodiments disclosed in the specification and the drawings present specific embodiments and are not intended to limit the scope of the invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention can be carried out in addition to the embodiments disclosed herein. As described above, if the document security method according to the technical idea of the present invention, it should be understood that the change of specific details is not important. For example, cryptographic file generation, digital signature generation, automatic destruction generation, etc. may be performed separately or simultaneously. Accordingly, the technical scope of the invention should be determined by the claims that follow.

According to the present invention, the recipient is designated by using the Internet account ID that most of the general public has, and the designated recipient is more convenient to designate a user by confirming that the user is a legitimate authorized recipient by logging in with the Internet account. Allowed.

According to the present invention, a simple and secure document security can be achieved without requiring a user to directly manage a password related to encryption or a public key related to an electronic signature. Moreover, even if the security setting of the security document is released, the document author has an excellent effect of controlling the file I / O of the document according to the intended security setting.

Claims (20)

A document security method of a document security system in which a client computer on which a document security client module is installed, a document security server, and an Internet server on which a user's account is registered are connected through a network. Designating a recipient of a document using the recipient's Internet account ID; Generating, by the sender's document security client module, a session key and a document ID for the document; Encrypting the document with the session key; Generating a secure document including the document ID and document information in the encrypted document; Generating configuration information for the secure document; Registering a session key and configuration information for the secure document with the document secure server; Receiving, by the document security client module of the receiver, configuration information about the secure document from the document security server; Authenticating the recipient by logging into the Internet server with the recipient's Internet account to confirm that the recipient's document security client module is a legitimate recipient of the secure document; Receiving the session key from the document security server by the document security client module of the receiver when the receiver authentication is completed; Decrypting the encrypted document with the session key and generating a general document based on the configuration information. The method of claim 1, further comprising storing the configuration information received from the document security server in a document security client module of the receiver, and controlling file I / O of the general document according to the stored configuration information. Document security method, characterized in that. The document security method of claim 1 or 2, wherein the registering of the session key and the configuration information with the document security server encrypts the session key. The method of claim 1 or 2, further comprising the step of setting an automatic destruction condition of the secure document, wherein the automatic destruction condition is a validity period or a valid number of times that a recipient can view the document. Document security method. 3. The method of claim 1 or claim 2, wherein the step of designating a recipient further comprises authenticating the sender by logging in with an Internet account of an Internet server to identify the sender. Generating a session key and document ID for the document further includes generating a temporary private key / temporary public key pair; Generating the secure document further comprises attaching a value that is digitally signed by the document with the temporary private key, Generating the general document further comprises the step of verifying the electronic signature based on the configuration information. 5. The method of claim 4, wherein specifying a recipient further comprises authenticating the sender by logging in with an Internet account of an Internet server to verify the sender. Generating a session key and document ID for the document further includes generating a temporary private key / temporary public key pair; Generating the secure document further comprises attaching a value that is digitally signed by the document with the temporary private key, The generating of the general document further comprises the step of verifying an electronic signature based on the configuration information. A method of digitally signing a document security system in which a client computer on which a document security client module is installed, a document security server, and an Internet server on which a user's account is registered are connected through a network, Authenticating the sender by logging in to the Internet server with the sender's Internet account to identify the sender; Generating, by the sender's document security client module, a temporary public / temporary private key pair and document ID for the document; Electronically signing the document with the temporary private key; Registering configuration information for the electronically signed document with the document security server; Receiving, by the document security client module of the receiver, configuration information from the document security server; Verifying the electronic signature of the electronically signed document with a temporary public key included in the configuration information. 8. The method of claim 7, further comprising: designating a recipient of the document using the recipient's Internet account; And Authenticating the recipient by logging in to an internet account of the internet server to confirm that the document security client module of the recipient is a legitimate recipient of the electronically signed document. 9. The method according to claim 7 or 8, further comprising the step of setting an automatic destruction condition of the electronically signed document, wherein the automatic destruction condition is valid, valid for the recipient to view the electronically signed document. Electronic signature method comprising a number of times. 9. The method according to claim 7 or 8, further comprising the step of storing the configuration information received from the document security server in the document security client module of the recipient, the file I / of the general document according to the stored configuration information. Electronic signature method characterized by controlling O. The method of claim 9, further comprising storing the configuration information received from the document security server in a document security client module of the receiver, and controlling file I / O of the general document according to the stored configuration information. Electronic signature method, characterized in that. A recording medium recording a program for document encryption / decryption of a document security system in which a client computer, a document security server, and an Internet server on which a user's account is registered are connected through a network. Designating a recipient of a document using the recipient's Internet account ID; Generating, by the sender's document security client module, a session key and a document ID for the document; Encrypting the document with the session key; Generating a secure document including the document ID and document information in the encrypted document; Generating configuration information for the secure document; Registering a session key and configuration information for the secure document with the document secure server; Receiving, by the document security client module of the receiver, configuration information about the secure document from the document security server; Authenticating the recipient by logging into the Internet server with the recipient's Internet account to confirm that the recipient's document security client module is a legitimate recipient of the secure document; Receiving the session key from the document security server by the document security client module of the receiver when the receiver authentication is completed; Decrypting the encrypted document with the session key and generating a general document based on the configuration information; a computer-readable recording medium having recorded thereon a program for executing the encrypted document. A recording medium having recorded thereon a program for generating / verifying an electronic signature of a document security system in which a client computer, a document security server, and an Internet server on which a user's account is registered are connected through a network. Authenticating the sender by logging in to the Internet server with the sender's Internet account to identify the sender; Generating, by the sender's document security client module, a temporary public / temporary private key pair and document ID for the document; Electronically signing the document with the temporary private key; Registering configuration information for the electronically signed document with the document security server; Receiving, by the document security client module of the receiver, configuration information from the document security server; Verifying the electronic signature of the electronically signed document with the temporary public key included in the configuration information; a computer-readable recording medium having recorded thereon a program for executing the electronic signature. In document security systems, The document security client module is installed, and the document security client module generates a security key for a document to be secured, generates a security document according to the security setting, and generates configuration information for the security document to secure the document. A sender document security client computer registering with the server; A document security client computer having a document security client module installed therein, wherein the document security client module receives configuration information about the security document from the document security server and releases security settings of the security document; A document security server that registers configuration information transmitted from the sender document security client computer for each document and transmits the configuration information to the receiver document security client module when the authorized user requests it; Internet server in which the user's account is registered; document security system comprising a. The document security system of claim 14, wherein the document security client computer authenticates the user by logging in to the Internet server to verify that the user is a legitimate user. 16. The method of claim 14 or 15, wherein the security key comprises a session key for document encryption and a temporary private key / temporary public key pair for digital signature, wherein the temporary public key for verifying the electronic signature is stored in configuration information. And a session key for encrypting the document is registered with the document security server independently of configuration information, and is transmitted to a recipient document security client module upon request of the authorized user. . 16. The document security system according to claim 14 or 15, wherein the document security client computer further comprises a file protection module for storing configuration information transmitted from the document security server. 18. The document security system of claim 17, wherein the file protection module controls file I / O of a document in which the configuration information is stored. A document security method of a document security system in which a client computer, a document security server, and an Internet server on which a user's account is registered are connected through a network. Setting security settings by specifying an Internet account ID of a receiver; Generating configuration information on the security setting and registering the configuration information with the document security server; Receiving the configuration information from the document security server; Authenticating the receiver by logging in to the Internet server with the designated recipient's Internet account ID; And when the recipient authentication is completed, releasing the security setting of the secured document based on the configuration information. 20. The method of claim 19, wherein said security setting comprises document encryption, digital signature, and automatic destruction setting.