KR20060131431A - Network device for preventing leakage of secret data and method thereof - Google Patents

Abstract

A network device and a method for preventing leakage of confidential information are provided to keep network security by warning the leakage of a confidential document with an alarm signal corresponding to the security level of a file and preventing external transfer of the file over a specific security level. A communication interface(110) transmits the file uploaded from a node to the external network. A determiner(120) determines the security level of the uploaded file by connecting to the communication interface. An alarm signal output part(130) outputs the alarm signal corresponding to the determined security level. The first memory(150) stores the uploaded file. A controller(140) makes the communication interface and the first memory store the uploaded file to the first memory without transmitting the uploaded file to the external network if the determiner outputs a signal representing that the security level of the uploaded file is over the specific security level. The second memory(160) stores security level information classified by at least one of a file name, an extension name, a file size, an upload date, a sender IP(Internet Protocol), and a receiver IP.

Description

Network device for preventing the leakage of confidential information and its method {Network device for preventing leakage of secret data and method

1 is a schematic diagram showing the configuration of a network system according to an embodiment of the present invention;

2 is a block diagram showing a configuration of a network device according to an embodiment of the present invention;

3 is a flowchart illustrating a file leakage prevention method of a network device according to an embodiment of the present invention;

4 is a flowchart illustrating an example of a method of determining a security level among the file leakage prevention method of FIG. 3.

Explanation of symbols on the main parts of the drawing

100: network device 110: communication interface unit

120: determination unit 130: alarm signal output unit

140: control unit 150: first memory unit

160: second memory unit

The present invention relates to a network device having a confidential information leakage prevention function and a method thereof, and more particularly, after receiving a file to be uploaded to an external network, determining the security level of the received file, The present invention relates to a network device and a method for outputting a corresponding alarm signal to prevent leakage of a file in which confidential information may be recorded.

With the arrival of the information age, as the amount of information handled increases, the spread of network systems that connect and use a plurality of terminal devices in one network has become popular. Accordingly, a plurality of users can operate various terminal devices connected to the network to upload or download information.

On the other hand, the network system has a problem in that the security is weak in nature. That is, since a large number of users can share information, there is a high probability that confidential information will be leaked to the outside. In particular, the importance of information security is more urgent for companies and research institutes that deal with new technologies and know-how. Accordingly, security checkpoints are installed at doors of each company or research institute to search documents and storage media leaked to the outside.

However, such a direct search method cannot prevent leakage by transmitting in the form of mail through the Internet or by uploading a file by accessing a web hard providing server. To prevent this, a method of blocking the connection with the external network itself has been used. However, according to this original method, there is a problem that users of the network system have a problem in smoothly performing their tasks.

In addition, in order to prevent the leakage of confidential documents, a network system is also implemented that restricts the general user's access to certain confidential files. However, it was difficult to set a read limit for all confidential files. Therefore, in the case where confidential matters are included in patent documents, papers, etc. which are individually created by the inventors, there is a problem in that leakage of such data cannot be prevented.

The present invention is to solve the above problems, an object of the present invention, by outputting a predetermined alarm signal corresponding to the security level of the file to warn the leakage of confidential documents, and in the case of a file of a certain level or more the external transmission The present invention provides a network device and a method for preventing network security.

According to an embodiment of the present invention for achieving the above object, a network device connecting a network environment and an external network to which at least one node is connected, transmits a file uploaded from the at least one node to the external network. A communication interface unit connected to the communication interface unit to determine a security level of the uploaded file and an alarm signal output unit to output an alarm signal corresponding to the security level determined by the determination unit.

Preferably, when the first memory unit for storing the uploaded file and a signal from the determination unit that the security level of the uploaded file is greater than or equal to a predetermined level, the first memory unit does not transmit the information to the external network. The apparatus may further include a controller configured to control the communication interface unit and the first memory unit to store the memory unit.

The second memory unit may further include a second memory unit in which a plurality of security level information classified according to at least one of a file name, an extension name, a file capacity, an upload date, a sender IP, and a receiver IP are stored.

In this case, the determination unit detects at least one of a file name, an extension name, a file size, an upload date, a sender IP, and a receiver IP of the uploaded file, and then detects the detected information among the plurality of security levels. The security level corresponding to may be determined as the security level of the uploaded file.

Also, preferably, the determining unit may determine whether a predetermined keyword is included in the text recorded in the uploaded file, and then determine the security level of the uploaded file according to whether the keyword is included.

More preferably, the alarm signal output unit may include a plurality of warning lights of different colors, respectively, and output the alarm signal in a manner of flashing a warning light of a color corresponding to the security level among the plurality of warning lights.

Meanwhile, according to an embodiment of the present disclosure, a method of preventing leakage of confidential information of a network device connecting a network environment and an external network to which at least one node is connected may include (a) receiving a file uploaded from the at least one node. Step (b) determining the security level of the uploaded file, and (c) outputting a predetermined alarm signal corresponding to the security level of the uploaded file.

Preferably, if the security level of the uploaded file is less than a predetermined threshold level, transmitting the uploaded file to a destination of the external network, and if the security level of the uploaded file is greater than or equal to a predetermined threshold level The method may further include temporarily storing the uploaded file without transmitting the uploaded file to a destination of the external network.

Also preferably, the step (c) may include a plurality of warning lights of different colors, and may output the alarm signal in such a manner that a warning light of a color corresponding to the security level of the plurality of warning lights is blinking. .

More preferably, step (b) uses the uploaded file's file name, extension name, file capacity, upload date and time, sender IP, and receiver IP as at least one of the selected information, as the criterion. You can determine the security level of the file.

Alternatively, the step (b) may include determining whether a predetermined keyword is included in the text recorded in the uploaded file, and determining a security level of the uploaded file according to whether the keyword is included. It may also include.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the present invention.

1 is a schematic diagram showing the configuration of a network system according to an embodiment of the present invention. According to FIG. 1, the present network system includes a plurality of terminal devices 10a to 10n, a network repeater Hub 20, and a network device 100.

According to FIG. 1, each terminal device 10a to 10n may be implemented as a PC, a notebook PC, a printer, a scanner, a facsimile, or the like. Each terminal device 10a to 10n may be connected to a wired LAN (Local Area Network) or a wireless LAN.

Each terminal device 10a to 10n communicates with the external network 30 through the network repeater 20. That is, the network repeater 20 relays communication so that each terminal device 10a to 10n belonging to the internal network can access the external network 30. The network repeater 20 may be implemented as a hub, a router, an Internet Protocol (IP) router, an access point (AP) repeater, or the like.

A hub is a network device that connects to an external network when an office or close computer is connected. Routers are network devices that serve to connect between different networks. An IP router is a network device that adds a router function to a hub. In other words, the IP sharer uses one Internet IP address provided by an Internet service provider to allow multiple computers, laptops, IP phones, and set-top boxes to share the Internet. The AP repeater is a device that connects each wireless terminal to an infrastructure environment in a wireless LAN environment.

The network device 100 monitors a file transmitted to the external network 30 through the network repeater 20. Specifically, the network device 100 checks the security level of a file uploaded from each device 10a to 10n connected to the network repeater 20, and then outputs an alarm signal corresponding to the security level. The security level of the file may be checked using at least one of a file name, extension name, file capacity, upload date and time, sender IP, and receiver IP. Accordingly, when the security level is confirmed, a predetermined alarm signal corresponding to the checked level is output. The alarm signal may be output in the form of a visual signal or a sound signal. Detailed description thereof will be described later.

Meanwhile, when the network device 100 is above a predetermined threshold level, the network device 100 may block transmission of the file to the external network 30 and store the file in its own memory. The network manager may check the contents of the file stored in the network device 100 to determine whether the file is related to confidential information.

2 is a block diagram illustrating a configuration of a network device 100 according to an embodiment of the present invention. According to FIG. 2, the network device 100 includes a communication interface 110, a determination unit 120, an alarm signal output unit 130, a control unit 140, a first memory unit 150, and a second. The memory unit 160 is included.

The communication interface unit 110 serves to connect a network repeater and an external network. That is, it transmits a file uploaded from each terminal device connected to the network repeater to the external network, or transmits a file downloaded from the external network to each terminal device through the network repeater. The user of each terminal device may attach to an e-mail or attempt to upload a file using a predetermined web server. Accordingly, in order for a file uploaded from each terminal device to be transmitted to an external network, it must go through a network repeater. Therefore, the network device 100 is preferably connected to the front end of the network repeater to connect between the network repeater and the external network.

The determination unit 120 determines the security level of the file uploaded from each terminal device. As described above, the security level may be determined using at least one of file name, extension name, file capacity, upload date and time, sender IP, and receiver IP. Specifically, the determination unit 120 may determine the security level by referring to a previously prepared database. Such a database may be previously created by a network administrator or a person having a corresponding authority and stored in the second memory unit 160. The database may be created differently according to the characteristics of the environment using the present network device 100, that is, the company's business characteristics, research fields, and the like.

Most commonly, security levels can be classified based on file extension. Accordingly, the database can be created as shown in the table below.

Security level Extension One  hwp, gul, doc, pdf, txt, asp, asv, bak, html, htm 2  jpg, mpeg, msp, tif, tiff, img, dwg 3  cpp, bas, for 4  Etc

Looking at Table 1, the first rating is a document file extension such as hwp, gul, doc, etc., the second rating is a multimedia file extension such as photo, picture, and video data, the third rating is a file extension for various programming languages, and The fourth class includes other extensions. The type of security level and the extension name corresponding to the level may be set by the network administrator and stored. The determination unit 120 detects the extension name of the uploaded file and then determines the security level to which the file belongs using Table 1 above.

On the other hand, when classifying the security level based on the file capacity, the database can be created by using the fact that the larger the file size, the greater the possibility of including confidential information. If a KB (Kilo Byte) or more can be classified as a first grade, a second grade for a ~ b KB, a third grade for b ~ c KB, and a fourth grade for less than c KB.

Meanwhile, the security level may be classified based on the upload date and time. That is, the security level can be classified using the fact that the risk of leakage of confidential information such as lunch time, dinner time, and overtime is greater than the frequent working hours of users.

In case of using the sender IP, the terminal device IP used by the researcher who handles the main secret information can be classified into the first class, the terminal device IP of the senior executive by the second class, and the terminal device IP of the general clerk by the third class. Can be.

In the case of using the recipient IP, a server IP of a competitor company may be classified into a first class, a server IP of a company engaged in the same industry as a second class, a general third party IP, and the like. The sender IP or the receiver IP can detect and confirm header information of the uploaded file.

As a result, when the file is uploaded, the determination unit 120 may determine the security level of the corresponding file by referring to the database stored in the second memory unit 160.

Meanwhile, according to another exemplary embodiment of the present disclosure, the determination unit 120 may determine whether a predetermined keyword is included in the content of the file and determine the security level. That is, the network administrator can set a plurality of keywords in consideration of the characteristics of the environment in which the network device is installed. For example, in the case of a semiconductor company, various terms such as wafer and silicon or various numerical information related to company know-how may be prepared as keywords and stored in the second memory unit 160. The determination unit 120 detects various texts recorded in the corresponding file and determines whether or not the keywords match the preset keyword. Accordingly, the security level is determined according to the number of matches. Specifically, if more than 10 keywords are included, the first grade may be determined. If 5 to 9 keywords are included, the second grade may be determined. If less than 5 keywords are included, the third grade may be determined.

The alarm signal output unit 130 outputs a corresponding alarm signal according to the security level determined by the determination unit 120. Specifically, the alarm signal output unit 130 may be implemented to include a plurality of warning lights of different colors. Accordingly, the alarm signal may be displayed in a manner of blinking a warning light of a color corresponding to each class. Specifically, in the case of the first grade, the red warning light blinks, in the case of the second grade, the yellow warning light blinks, and in the other grades, the green warning light may blink.

Alternatively, the alarm signal output unit 130 may be implemented as a speaker. In this case, the network manager may be alerted by outputting a voice message or an alert sound corresponding to each class. In this case, the loudness of the output sound, the output time, and the number of output repetitions of the speaker may also be set differently for each security level.

If the alarm signal output unit 130 includes both a warning light and a speaker, it is preferable to flash the warning light and output a voice message or a warning sound so that the network administrator can easily recognize whether the file is transmitted.

On the other hand, if it is determined that the security level determined by the determination unit 120 is equal to or greater than a predetermined threshold level, the controller 140 controls the communication interface 110 to stop external transmission of the corresponding file, and then the first memory unit ( Temporary storage. Accordingly, the network manager or the like may check the contents of the corresponding file stored in the first memory unit 150. If the network administrator, etc., confirms that the confidential information is not transferred to the original destination, and if the confidential information is found, the network administrator deletes the file and finds the sender and takes a censure. This threshold level can be arbitrarily set by the network administrator. That is, when the first class is set as the critical class, a file corresponding to the first class is temporarily stored in the first memory unit 150.

3 is a flowchart illustrating a file leakage prevention method according to an embodiment of the present invention. According to FIG. 3, when a file is uploaded from a predetermined device belonging to an internal network (S310), the security level of the uploaded file is checked (S320). Accordingly, when the security level is confirmed, the alarm signal corresponding to the checked level is output (S330). As described above, the alarm signal may be output in a manner of flashing a warning light of a predetermined color or outputting a voice message, a warning sound, or the like.

Next, it is determined whether to upload the uploaded file to the destination (S340). In this case, whether to send the destination may be determined according to whether the checked security level is a predetermined level or more. That is, if it is less than the predetermined threshold level, it is transmitted to the destination (S360). If it is above the threshold level, the transmission may be stopped and the uploaded file may be temporarily stored (S350).

The file leakage prevention method illustrated in FIG. 3 may be directly executed by a network repeater such as a hub, an IP router, a router, or the like. Alternatively, as described above, a separate device installed in front of the network repeater may be executed.

4 is a flowchart illustrating an example of a method for checking a security level among the file leakage prevention method of FIG. 3. According to FIG. 4, first, the extension name of the uploaded file is checked (S410). Accordingly, with reference to the pre-created database, it is determined whether the file is a document file (S420).

If it is a document file, it is checked whether the capacity of the file is more than a predetermined KB. If it is more than a KB, it is determined as a first grade (S440). If it is less than a KB, it is determined as a second grade (S450).

On the other hand, if it is not a document file but a multimedia file (S430), it is checked whether the capacity of the file is more than a predetermined b KB (S435). As a result of the check, if the b KB or more is determined as the third grade (S460), if less than b KB is determined as the fourth grade (S470).

On the other hand, if it is not a document file or a multimedia file, it is recognized as a general file and determined as the fifth grade (S480).

As described above, the criterion for determining the security level may be a file name, a recipient IP, a sender IP, etc., as well as an extension name (ie, file type) or file capacity.

As described above, according to the present invention, by determining the security level of the file to be transmitted to the external network, and outputs an alarm signal corresponding to the class so that the network administrator can easily know what kind of file is being transmitted. do. In addition, in the case of a file for which confidential information may have been recorded, the transmission is stopped and temporarily stored so that the external network administrator can review it, thereby preventing the confidential information from leaking to the outside, thereby maintaining the security of the network.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the above-described certain embodiments, the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Claims (11)

A network device for connecting a network to which at least one node is connected to an external network, the network device comprising: A communication interface for transmitting a file uploaded from the at least one node to the external network; A determination unit connected to the communication interface unit to determine a security level of the uploaded file; And, And an alarm signal output unit for outputting an alarm signal corresponding to the security level determined by the determination unit. The method of claim 1, A first memory unit for storing the uploaded file; And, A control unit for controlling the communication interface unit and the first memory unit to receive the signal indicating that the security level of the uploaded file is equal to or greater than a predetermined level from the determination unit, and store the first file in the first memory unit without transmitting to the external network; The network device further comprises. The method of claim 2, And a second memory unit for storing a plurality of security level information classified according to at least one of file name, extension name, file size, upload date and time, sender IP, and receiver IP. . The method of claim 3, The determination unit, After detecting at least one of a file name, an extension name, a file size, an upload date, a sender IP, and a receiver IP of the uploaded file, the security level corresponding to the detected information among the plurality of security levels is detected. A network device, characterized in that it is determined that the security level of the uploaded file. The method of claim 1, The determination unit, And after checking whether a predetermined keyword is included in the text recorded in the uploaded file, determining a security level of the uploaded file according to whether the keyword is included. The method of claim 1, The alarm signal output unit, And a plurality of warning lights of different colors, and outputting the alarm signal in such a manner as to flash a warning light of a color corresponding to the security level among the plurality of warning lights. In the network environment connecting at least one node and a network device connecting an external network, A method for preventing leakage of confidential information, (a) receiving an uploaded file from the at least one node; (b) determining a security level of the uploaded file; And, (c) outputting a predetermined alarm signal corresponding to a security level of the uploaded file. The method of claim 7, wherein If the security level of the uploaded file is less than a predetermined threshold level, transmitting the uploaded file to a destination of the external network; And, And if the security level of the uploaded file is equal to or greater than a predetermined threshold level, temporarily storing the uploaded file without transmitting the uploaded file to a destination of the external network. The method of claim 8, Step (c) is, And a plurality of warning lights of different colors, and outputting the alarm signal in such a manner as to flash a warning light of a color corresponding to the security level among the plurality of warning lights. The method of claim 9, In step (b), A file characterized in that the security level of the uploaded file is determined using at least one of a file name, an extension name, a file size, an upload date, a sender IP, and a receiver IP of the uploaded file as a criterion. Spill Prevention Methods. The method of claim 9, In step (b), Checking whether a predetermined keyword is included in the text recorded in the uploaded file; And, And determining the security level of the uploaded file according to whether the keyword is included.

Images