KR20090065876A - Method and apparatus useful for preventing sensitive information from flowing out in personal computer - Google Patents

Abstract

A method and an apparatus useful for preventing sensitive information from flowing out to the outside in a personal computer are provided to supply user's convenience by enabling a user to edit a protection information file through a general information file. An apparatus for preventing the external leakage of protection information includes a user interface unit(10), at least one external communication connection unit(30) and a protection information leakage preventing unit(20). According to a user authentication mode through a user interface unit, the user of the protection leakage preventing unit is allowed. When the user interface unit senses at least one kind of protection information from the used and stored information, the protection leakage preventing unit blocks the access to the connection unit of at least one external communication unit.

Description

Method and Apparatus Useful for Preventing Sensitive Information from Flowing Out in Personal Computer}

The present invention relates to a method and an apparatus for preventing the leakage of protection information, and more particularly, to a method for preventing the leakage of protection information to prevent the leakage of protection information important to the user in a personal computer to the outside and its Relates to a device.

The present invention is derived from the research conducted as part of the IT growth engine technology development project of the Ministry of Information and Communication and the Ministry of Information and Telecommunications Research and Development. (Development of the threat containment for all-in-one mobile devices on convergence networks)].

As generally the amount of information handled by an information age arrival increases, the spread of the network system has been popularized to connect the plurality of computers by a network. Accordingly, a user can operate his / her computer connected to a network to access another user's computer, or a plurality of users can share one computer to transmit and receive information within a network.

On the other hand, a computer used by people stores a lot of protection information (for example, personal information such as address book, diary, photos, e-mail and confidential information such as papers, patents, credit card numbers, passwords, etc.) In addition, if the protected information stored in such a computer is leaked to the outside through a network by malicious attackers, both inside and outside, there is a great possibility of economic or social loss.

Therefore, the conventional personal computer uses a user ID and a password-based authentication method at the time of user login as a means for controlling access to the protection information of unauthorized persons, but such authentication method is used for different user IDs and passwords. There was a lot of exposure. In addition, even if you have security programs (such as firewalls and virus detection programs) for the security of your personal computer, these security programs will not be able to detect all new types of intrusions, so you will be completely protected from hacking by external intruders. I could not. For example, a phishing attack, one of the hacking methods, allows a user to directly access an external attack server, so that protection information may be leaked to the outside without the user's knowledge.

Therefore, recently, methods for preventing the leakage of protected information based on the signature of the protected information in the network communication step have been proposed.

1 is an exemplary diagram illustrating an external leakage path of protection information according to the related art.

As shown in FIG. 1, when the user creates a protection information document such as a paper or a patent, the protection information 105 may be completed by partially copying the general information-A 104 such as a previously created document or a picture. When the protection information 105 is completed, a new version of the protection information files may be generated. In addition, the inside and outside malicious attackers 101 and 192 may change the protection information 105 itself into general information-B 106 using a method such as encryption or compression of the protection information 105 in the personal computer. In this case, the conventional signature-based protection information leakage prevention method has a problem in that it is not possible to detect that a modified form of protection information is leaked.

As another conventional technology, a DRM (Digital Rights Management) method that encrypts and stores all protected information in a designated shared system and permits only authorized users to access and modify them.

However, DRM is very inconvenient from the user's point of view because the internal and external attackers (101, 102) know the password of the owner of the protected information and can not only prevent the leakage of the protected information. There was a problem.

Therefore, since the conventional protection information protection method only supports modification to the designated protection information file, it is very inconvenient for the user, and the general information that may be protected or included when the protection information is changed and transmitted to the outside may not be protected. If the user authentication information is exposed or subjected to a hacking attack such as phishing, there is a problem that the protection information stored in the personal computer is leaked to the outside without any knowledge.

In order to solve the above problems, the present invention manages protection information and prevents access to outside information without unauthorized leakage of not only protection information but also general information related thereto when an authorized user approaches through user authentication. The present invention provides a method and an apparatus for preventing the leakage of protected information to be controlled.

A device for preventing the leakage of protection information according to a preferred embodiment of the present invention is a device for preventing the leakage of protection information, the user interface for providing access to the stored information including the protection information by the user authentication part; At least one external communication connection unit for providing external communication of the stored information through the user interface unit; And allowing use of the stored information according to a user authentication mode through the user interface unit, and controlling to block access to the at least one external communication connection unit when detecting at least one protection information among stored information used by the user interface unit. Protection information leakage prevention unit; characterized in that it comprises a.

The present invention further includes a protection information table including an identifier for distinguishing protection information, wherein the protection information leakage prevention unit detects protection information used by using the protection information table, and stored information used by the user interface unit. It is preferable to classify all general information activated for use when detecting at least one protection information among the protection information in the protection information table.

The present invention may further include a protection information table including an external access control policy including whether to allow access to an external communication access unit according to a user authentication mode, and at least one external communication access unit when using protection information through the user interface unit. It is preferable to control each access in accordance with the external access control policy.

The protection information table of the present invention preferably includes at least one of a protection information file name and a directory name in which the protection information is stored in the identifier.

The protection information leakage prevention unit of the present invention further includes an encryption / decryption unit that provides encryption / decryption of the protection information, and preferably encrypts and decrypts through the encryption / decryption unit when requesting protection information from the user interface unit. .

The user interface unit of the present invention preferably includes any one of a management mode capable of operating the protection information table and a general mode allowing use of the stored information for the user authentication.

The cache memory for temporarily storing and providing all the information activated when using the stored information through the user interface of the present invention; The protection information leakage prevention unit, when all the use of the protection information through the user interface unit, the cache memory It is desirable to delete all information on the image.

According to an aspect of the present invention, there is provided a method of preventing an external leakage of protection information, the method of preventing an external leakage of protection information, the access from the user interface to the stored information including the protection information by the user authentication The first step being requested; And determining whether there is protection information of the information requested to be accessed through the user interface unit to allow use of the stored information according to the user authentication, and providing external communication when sensing at least one protection information among the stored information used by the interface unit. And a second step of controlling to block access to an external communication connection unit.

The second step of the present invention, while detecting the protection information used through the protection information table including an identifier for distinguishing the protection information according to the user authentication of the first step, at least from the stored information used through the user interface unit Preferably, the method further includes a step 2-1 of dividing all general information activated for use in detecting one protection information into protection information in the protection information table.

The second step of the present invention may include at least one of using a protection information table including an external access control policy including whether to allow access to the at least one external communication connection unit according to user authentication when using the protection information through the user interface unit. Step 2-2 of controlling access to each of the external communication connection of the; preferably further comprises.

The second step of the present invention may further include a second to third step of providing use of the protection information according to a user's request by user authentication of the user interface unit.

The second step of the present invention may further include allowing external communication through the external communication connection unit when at least one protection information is not detected from the stored information used through the user interface unit.

Step 2-3 of the present invention, if the user requests to read the protection information file decrypting the file provided after decrypting the stored file; And encrypting and storing the file after encrypting the file when the user requests writing of the protection information file.

Step 2-3 of the present invention, if all the protection information files used through the user interface unit is closed, the step of deleting all the data stored in the cache memory; preferably further comprises a.

The user authentication of the present invention preferably includes any one of a management mode capable of manipulating the protection information table and a general mode allowing use of stored information.

According to another aspect of the present invention, there is provided a method for preventing an external leakage of protection information in a personal computer, the method for preventing an external leakage of protection information in a personal computer, the method including storing the protection information by user authentication of a user interface unit. A first step of requesting access to information; And all the general information files that are likely to be used for editing the protection information file by changing the properties of all the general information files that are activated or to be activated to the protection information file while the user is accessing the protection information file through the user interface. And a second step of providing a security level equal to the security level of the protection information file.

The second step of the present invention includes the steps of: changing the attributes of all general information files that are activated or to be activated into protection information files while the user is accessing the protection information file through the user interface unit; And controlling data transmission to the outside according to an external access control policy based on the user authentication of the first step.

The user authentication of the present invention preferably includes a management mode that can change the security level of the stored information and a general mode for use of the stored information.

The protection information of the present invention is preferably stored encrypted.

As described above, the method and apparatus for preventing leakage of protection information according to the present invention have an effect of providing user convenience since the general user allows editing of the protection information file using the general information file.

In addition, according to the present invention, since the properties of all general information files activated during access to protected information are changed to protected information, and at the same time, the transmission of the protected information to the outside is blocked according to the external access control policy. There is an excellent effect that can be prevented.

Hereinafter, an apparatus for preventing leakage of protection information according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. A personal computer to which the present invention is applied is generally configured to be connected to the outside by a network and will be described based on a configuration including a small or large information storage device.

2 is a block diagram showing the configuration of an apparatus for preventing the leakage of external protection information according to the present invention.

In the personal computer according to the present invention, the device for preventing the leakage of external protection information is the user interface unit 10, the protection information leakage prevention unit 20, the external communication connection unit 30, the protection information table 40, the file storage unit It consists of 50.

The user interface unit 10 serves as an interface for providing a user access to use a personal computer, an information storage server, and the like through user authentication, and manages to change the following protection information table 40 or settings. It provides user authentication such as general mode which can use only mode and stored information.

Here, the user interface unit 10 has the authority to manage the protection information table 40 by operating in the management mode at the time of authentication through an authentication method such as ID and password for the management mode. In addition, the user interface unit 10 can access the personal computer resources (eg, files, USB, printer, LAN) by operating in the normal mode when the user is connected through an authentication method such as ID and password for the normal mode. Can be granted.

The protection information leakage prevention unit 20 serves to prevent the use of the stored protection information and leakage to the outside. That is, in order to protect the stored protection information and general information related thereto, the encryption and decryption of the file are used, and the following modification of the protection information table and the external communication connection unit are controlled. In other words, the protection information leakage prevention unit 20 may change the attributes of the general information file associated with the protection information file in order to prevent the protection information file stored in the file storage unit 50 from being leaked to the external communication connection unit 30. Change to the protection information (ie, register in the protection information table 40), encrypt / decrypt the protection information file, and further, in accordance with the external access control policy while the user interface unit 10 is accessing the protection information. The communication connection unit 30 can be controlled.

In addition, the present invention may further include a cache memory (not shown) for the protection information leakage prevention unit 20 to temporarily store and provide the information requested to use when using the information through the user interface unit 10.

The protection information table 40 includes an identifier for distinguishing protection information from general information and an external access control policy for storing an external policy for setting a degree of access to the external communication connection unit 30 to the user through the user interface unit 10. Include. The protection information table 40 can be changed when the user connects to the management mode through the user interface unit 10.

Here, the protection information table 40 stores the identifier of the protection information file for distinguishing the general information from the information stored in the file storage unit 50 for storing the protection information and the general information and the external access control policy as described above, have.

Here, the identifier of the protection information file may be represented by a file name or a directory name, and the external access control policy is a control policy regarding an external access to be performed while protection information is activated (that is, accessed by a user). For example, as an external access control policy for a user operating in the normal mode 12, a policy called blocking all external access devices except for a printer may be set.

The external communication connection unit 30 provides the user interface unit 10 with data communication with the outside. That is, the external communication connection unit 30 may include a plurality of external devices (eg, a printer, a USB, an Internet access modem, a LAN, etc.) capable of outputting the stored information of the personal computer to the outside.

3 is a flowchart illustrating the operation of the apparatus for preventing the leakage of protection information according to the present invention. As shown in FIG. 3, the apparatus for preventing the leakage of protection information according to the present invention may operate differently according to the user authentication state of the user interface unit 10. That is, the user may operate in the management mode 11 or the general mode 12 among user authentications according to the type of ID and password used by the user to access the user interface unit 10.

If the protection information leakage prevention unit 20 receives a file access request from the user operating in the normal mode, that is, if the user interface unit 10 operates in the normal mode and requests the use of the stored information, the file is protected information. The protection information table 40 is searched to determine. If the protection information leakage preventing unit 20 requests the information requested by the user interface unit 10 to be a protection information file, all the general information files currently activated (currently open) are registered in the protection information table 40.

Here, even if the file requested by the user interface unit 10 is a general information file, the protection information leakage prevention unit 20 may have a protection information file loaded or changed on the cache memory. When requested, the requested general information file is registered in the protection information table 40. That is, the device for preventing the leakage of protected information according to the present invention provides a user convenience so that a user can freely edit the protected information file using the general information file, and also all general information activated while accessing the protected information. By changing the attributes of the file to protected information, it is possible to block the leakage of important general information files to the outside.

In addition, the protection information leakage prevention unit 20 is the protection information registered in advance by the user operating the user interface unit 10 in the management mode 11 as described above, while the user operating in the normal mode to access the protection information. According to the external access control policy on the table, it is possible to block transmission of all data (protection information and general information) to the outside through the one or more external communication connection unit 30.

That is, the present invention cannot transmit data to the outside even if the user who has the authority to access the protection information accessed through user authentication of the user interface unit 10 does not allow the external access control policy. For example, if the external access control policy on the protection information table 40 is blocking all external access devices except the printer, the protection information leakage preventing unit 20 prohibits the protection information from being transmitted to other external interfaces except the printer. .

In addition, the protection information leakage prevention unit 20 according to the present invention, when a user operating in the normal mode of the user interface unit 11 requests to read the protection information file, the file storage unit 50 reads the file and then decrypts it. If the user of the normal mode 12 through the interface unit 10 to write the protection information file, the protection file is encrypted and then stored in the file storage unit 50. Save it. In addition, if the user operating in the normal mode 12 of the user interface unit 10 requires the protection information file to be closed or there is no more protection information file activated, all data currently stored in the system cache memory (not shown) will be deleted. Can be.

That is, the apparatus for preventing the leakage of protection information according to the present invention blocks the source of copying the protection information cached in the system cache memory and transmitting it to the outside.

In addition, when the user operating in the normal mode 12 accesses the general information file, the protection information leakage prevention unit 20 according to the present invention transmits the file to the outside if the currently active protection information file does not exist. To allow them to do so.

In addition, according to the present invention, a user who accesses the management mode 12 may explicitly register and manage the protection information file through the user interface unit 10.

In this case, the present invention may register and change an external access control policy to be executed while the user connected to the management mode 12 accesses the protection information through the user interface unit 10.

4 is an example of use of the internal data structure of the protection information table according to the present invention. As shown in FIG. 4, the protection information table 40 according to the present invention may include a protection information file identifier 42 and an external access control policy 44.

The protection information file identifier 42 may include a folder location of the protection information, a file name, a file capacity, a change date, and the like. The protection information leakage prevention unit 20 of the present invention may be provided through a user interface unit 10 of the user. When distinguishing the information used from the general information, the file identifier 42 of the protection information is used.

As described above, the external access control policy 44 may include one or more external communication connection units 30 in which the user interface unit 10 is configured according to the user authentication type of the interface unit 10, that is, the management mode 11 and the general mode 12. You can determine the range that you can use (connect). For example, when the user interface unit 10 is in the normal mode 12, A class can be limited to use only the printer, B class is USB only, C class can be limited to use only the LAN, the user interface unit 10 When is in the management mode (11), class D can be set to enable all interfaces.

As such, the present invention can prevent errors or overload by partially limiting the external communication connection unit 30 through which the protection information can be leaked through the protection information file identifier of the protection information table and the external access control policy.

Hereinafter, a method of preventing leakage of protection information according to the present invention will be described with reference to the drawings. In the description, the same reference numerals as in FIGS. 1 to 4 refer to performing the same function.

5 is a flowchart illustrating a method of preventing the leakage of protected information according to the present invention. Referring to FIG. 5, a method of preventing the leakage of protected information according to the present invention is based on a user authentication mode of the user interface unit 10. You can do it differently. That is, the user may operate in the management mode 11 or the normal mode 12 as described above among the user authentications according to the type of ID and password that the user uses to access the user interface unit 10.

First, the description will be made based on when the user interface 10 is in the normal mode. That is, a method of preventing leakage of protection information when a user connects through a user authentication in a normal mode will be described.

First, the user accesses in the normal mode through user authentication of the user interface unit 10 so that the protection information leakage prevention unit 20 receives a file access request from the user operating in the normal mode (S10).

Subsequently, the protection information leakage prevention unit 20 determines whether the corresponding information file requested by the user interface unit 10 is a protection information file (S20).

Here, the protection information leakage prevention unit 20 may search and determine the preset protection information table 40 to determine whether the corresponding information file requested by the user interface unit 10 is a protection information file.

If, in step S20, the protection information leakage prevention unit 20 is a requested information file is a protection information file, an identifier for dividing all general information files used or currently activated by the user interface unit 10 into protection information files. Designate and register in the protection information table 40 (S21).

Subsequently, the protection information leakage prevention unit 20 may allow the user who operates the user interface unit 10 to the management mode 11 in advance as described above while the user interface unit 10 accesses the protection information to the general mode. According to the external access control policy on the registered protection information table, it is possible to block transmission of all data (protection information and general information) to the outside through at least one external communication connection unit 30 (S30). For example, if the external access control policy on the protection information table 40 is blocking all external access devices except the printer, the protection information leakage preventing unit 20 prohibits the transmission of the protection information to other external interfaces except the printer. .

Subsequently, the protection information leakage prevention unit 20 determines the use request of the protection information file requested from the user interface unit 11 (S40), and provides the protection file accordingly (S50).

On the other hand, when the user interface unit 11 requests to read the protection information file in step S40, the protection information leakage prevention unit 20 reads the file from the file storage unit 50 and decrypts the user interface unit 10 It can be provided to the user through the (S41). In addition, if the user requests the write of the protection information file in step S40, the protection information leakage prevention unit 20 may encrypt the protection file and store it in the file storage unit 50 (S42). In addition, if a user operating in the normal mode 12 of the user interface 11 requests the closing of the protection information file or there is no more protection information file activated, all data currently stored in the system cache memory (not shown) is deleted. Can be.

That is, the method for preventing the leakage of protection information according to the present invention prevents copying of protection information cached in the system cache memory and transmits it to the outside.

In addition, in step S20, the protection information leakage prevention unit 20, even if the information file requested by the user through the user interface unit 10 is a general information file, the protection information file used or currently activated by the user interface unit 10 In operation S23, when the protection information file used or currently activated by the user interface unit 10 is detected, the protection information leakage prevention unit 20 identifies an identifier that divides the requested general information file into a protection information file. It can be designated and registered in the protection information table 40 (S22).

If, at step S23, the protection information leakage prevention unit 20 accesses the general information file by the user interface unit 10, if the protection information file used or currently activated by the user interface unit 10 is not detected, The user interface unit 10 allows the information file to be transmitted through the external communication connection unit 30 (S44).

In addition, when the user interface 10 is connected in the management mode, the protection information leakage prevention unit 20 is connected to the management mode 12 of the user interface unit 10 by the user connected to the protection information identifier on the protection information table It can be provided so that it can be registered and managed explicitly.

In addition, when the user interface unit 10 is connected in the management mode, the protection information leakage prevention unit 20 is connected to the management mode 12 of the user interface unit 10 while the user accesses the protection information on the protection information table. You can also provide the user with an external access control policy to be executed.

As described above, the method for preventing the leakage of protected information according to the present invention protects all the information used when using or changing the protected information, even if the user is authorized to access the protected information through user authentication. By specifying the information, data cannot be transmitted to the outside unless the external access control policy permits, thereby effectively protecting the protected information in the personal computer.

In addition, the method for preventing the leakage of protected information according to the present invention provides a user convenience so that a user can freely edit the protected information file using a general information file, and also all general information activated while accessing the protected information. By changing the attributes of the file to protected information, it is possible to block the leakage of important general information files to the outside.

While the technical idea of the embodiment as described above has been described with the accompanying drawings, it is intended to illustrate the best embodiment of the present invention by way of example and not to limit the invention. In addition, it will be apparent to those skilled in the art that various modifications and variations can be made without departing from the spirit of the present invention.

1 is an exemplary diagram showing an external leakage path of protection information according to the present invention.

2 is a block diagram showing the configuration of a device for preventing the leakage of external protection information according to the present invention.

3 is a flow chart showing the operation of the device for preventing the leakage of protection information according to the present invention.

4 is an example of use of an internal data structure of a protection information table according to the present invention;

5 is a flowchart illustrating a method of preventing the leakage of protected information according to the present invention.

Description of the main parts of the drawing

10: user interface unit 20: protection information leakage prevention unit

30: external communication connection 40: protection information table

50: file storage unit

Claims (19)

In the device for preventing the leakage of protection information, A user interface unit providing access to the stored information including the protection information by user authentication; At least one external communication connection unit for providing external communication of the stored information through the user interface unit; And Allows use of the stored information according to a user authentication mode through the user interface unit, and controls to block access to the at least one external communication connection unit when detecting at least one protected information from the stored information used by the user interface unit. Information leakage prevention unit; Apparatus for preventing the leakage of external protection information, characterized in that it comprises a. The method of claim 1, And a protection information table including an identifier for identifying the protection information. The protection information leakage prevention unit detects protection information used by using the protection information table, and protects all general information activated in use when detecting at least one protection information among stored information used by the user interface unit in the protection information table. A device that prevents external leakage of protected information, characterized by dividing it into information. The method of claim 1, And a protection information table including an external access control policy including whether to allow access to an external communication access unit according to the user authentication mode. And controlling access to at least one external communication connection unit according to the external access control policy when using the protection information through the user interface unit. The method of claim 2, The protection information table, And at least one of a protection information file name and a directory name in which the protection information is stored in the identifier. The method according to any one of claims 1 to 3, The protection information leakage prevention unit, And an encryption and decryption unit that provides encryption / decryption of the protection information. And encrypting and decrypting the protection information through the encryption / decryption unit when the protection information is requested from the user interface unit. The method according to any one of claims 1 to 3, The user interface unit, And a management mode for manipulating the protection information table for the user authentication and a general mode for allowing use of the stored information. The method according to any one of claims 1 to 3, And a cache memory configured to temporarily store and provide all information activated when the stored information is used through the user interface unit. The protection information leakage prevention unit, when all the use of the protection information through the user interface unit, to prevent the external leakage of the protection information, characterized in that for deleting all the information on the cache memory. In the method of preventing the leakage of external protection information, A first step of requesting access to the stored information including the protection information by user authentication from a user interface unit; And Determining the presence or absence of protection information of the information requested to access through the user interface unit allows the use of the stored information according to the user authentication, and provides external communication when detecting at least one protection information from the stored information used by the interface unit And a second step of controlling to block access to an external communication connection unit. The method of claim 8, The second step, Detects protection information used through a protection information table including an identifier for distinguishing protection information according to the user authentication of the first step, and is used when detecting at least one protection information among stored information used through the user interface unit. And a step 2-1 of dividing all activated general information into protected information in the protected information table. The method of claim 8, The second step, When using the protection information through the user interface unit to each of the at least one external communication connection using a protection information table including an external access control policy including whether to allow access to the at least one external communication connection in accordance with user authentication Step 2-2 of controlling access; The method of preventing the external leakage of protected information further comprising. The method of claim 8, The second step, And providing the use of the protected information in response to a user's request by the user authentication of the user interface unit. The method of claim 8, The second step, Allowing external communication through an external communication connection unit when at least one protection information is not detected from the stored information used through the user interface unit. . The method of claim 11, The second step is, A file decryption step of providing a decrypted corresponding file when the user requests reading of the protection information file; And And a file encryption step of encrypting and storing the corresponding file when the user requests writing of the protection information file. The method of claim 11, The second step is, And deleting all data stored in the cache memory when all of the protection information files used through the user interface unit are closed. The method according to any one of claims 8 to 11, The user authentication is, And a management mode capable of manipulating the protection information table, and a general mode allowing use of the stored information. In a method for preventing the leakage of protected information in a personal computer, A first step of requesting access to the stored information including the protection information by user authentication of a user interface unit; And While the user is accessing the protection file via the user interface, the security of all general information files that are likely to be used for editing the protection information file by changing the attributes of all active information files to be activated or activated. And a second step of providing a level equal to the security level of the protection information file. The method of claim 16, The second step, While the user is accessing the protection information file through the user interface unit, changing the attributes of all general information files that are activated or to be activated to the protection information file; And And controlling data transmission to the outside in accordance with an external access control policy based on the user authentication of the first step. The method of claim 16, The user authentication includes a management mode for changing the security level of the stored information and a general mode for use of the stored information. The method of claim 16, The protection information is encrypted and stored in a personal computer, characterized in that for preventing the leakage of protection information.

Images