KR20090123651A - Method and system for securing of e-mail data - Google Patents

Abstract

PURPOSE: An e-mail data security method and a system thereof are provided to help transmission and download of a legal and stable program or execution file by converting the program or execution file. CONSTITUTION: A sender client(110) generates a virtual drive, encrypts an attachment within the generated virtual drive, and transmits an encrypted mail including the encrypted attachment to a mail server(200). By connecting to the mail server, a receiver client(120) receives the encrypted mail. The receiver client generates a virtual drive and decodes the attachment, attached to the encrypted mail, within the virtual drive.

Description

Method and system for securing of e-mail data

The present invention relates to a security method of a data file, and more particularly, to transmit and receive data transmitted on a communication network such as the Internet, for example, an executable file, a program, etc. For the purpose of guaranteeing the executableness of an executable file or a program that has been recognized for its legitimacy and stability, and converting the executable file or program into an HTM or text file that is operable in every OS and is not classified as a hazard. By transmitting, it is to facilitate the transfer and download of the executable file or program that has been recognized for its validity and stability.

In addition, in executing the executable files and programs, the executable files and programs can be restored and used only when the user's authentication is permitted, thereby sufficiently preventing the inflow of illegal programs such as viruses and spyware. A method and system for securing data.

The development of communication technology such as communication network technology, exchange technology, transmission technology, high performance and intelligent computer technology, software technology and terminal technology has greatly influenced the development of information and communication. Recognizing that it depends on network construction, it is spurring on network construction.

In particular, with the establishment of high-speed communication network and the spread of the Internet, the number of Internet users is increasing exponentially, and these Internet users collect various latest information and exchange information with each other through the Internet connection.

With the development of the high speed communication network and the Internet as described above, users enjoy significant benefits in acquiring and distributing various multimedia information such as text information, voice information, video information, etc., while leaking resources and information of the internal network, which is its dysfunctional function. In particular, the threat of information leakage due to illegal intrusion by hackers is increasing day by day.

Therefore, in order to protect resources and important information of the internal network connected to the Internet from hackers and to prevent information leakage and damage by malicious programs, researches on firewall systems are being actively conducted at home and abroad. It is commercially available.

For example, in order to protect an internal network connected to an external network such as the Internet, a firewall system for analyzing input / output packets in a device connecting a network, controlling and blocking packet traffic, and the like have been developed.

In particular, most of the illegal programs such as viruses and spyware, which are becoming a problem recently, are produced in the form of executable files and are transmitted and distributed by e-mail. Once infected, not only the information stored in the infected client, Since even the client information is leaked out, most firewall systems block the reception of executable files such as files with EXE extensions in order to prevent the inflow of illegal programs.

The firewall system as described above prevents the inflow of illegal programs such as viruses and spyware by blocking the inflow of executable files, but also prevents the inflow of normal executable files.

In other words, even executable files or programs that have been recognized for their validity and stability are not transmitted or downloaded, there is a problem that can not be guaranteed to perform the installation, execution, operation, etc. of such executable files and programs.

In particular, in the case of a corporate body, it often occurs inconvenient to use the program used for improving the productivity of the company.

In order to solve the above problems, the present invention is executed to ensure the executableness of the executable file or program that is recognized for its validity and stability with respect to the executable file, the program, etc. attached to the email and the email transmitted over the Internet, E-mail that makes it easy to transfer and download executable files or programs that have been recognized for their legitimacy and stability by converting and transferring files or programs into HTM or text files that can be operated on any OS and not classified as hazards. It is an object of the present invention to provide a method and system for securing data.

In particular, in executing the executable files and programs, the executable files and programs can be restored and used only when the user's authentication is permitted, thereby sufficiently preventing the inflow of illegal programs such as viruses and spyware. It is an object of the present invention to provide a method and system for securing email data.

In order to achieve the above object, the security method of the email data according to the present invention comprises the steps of: a) the sender client is selected whether to perform encryption of the mail including the attachment; b) if the encryption execution is selected, generating a virtual drive and encrypting the attachment file in the created virtual drive to generate an encrypted mail; c) transmitting the generated encrypted mail to a mail server and removing the generated virtual drive; d) a recipient client accesses a mail server, checks the encrypted mail, and receives whether to recover the encrypted mail; e) if restoring the encrypted mail is selected, creating a virtual drive and verifying an encrypted portion of the encrypted mail in the generated virtual drive to decrypt the attached file; And f) when the decryption of the attachment is completed, performing the operation on the restored attachment in the virtual drive, and when the operation on the attachment is completed, deleting the restored attachment and removing the virtual drive. It is characterized by including.

In addition, the step b), b-1) when the attachment is called to the virtual drive, receiving at least one of the authentication and the authority setting for the attachment; b-2) when authentication is selected, selecting an authentication method and generating authentication information corresponding to the authentication method; b-3) if the permission setting is selected, generating at least one of an execution function, an execution frequency, and a duration of the attached file to generate permission setting information; And b-4) generating an encrypted mail in which an attached file is encrypted based on at least one of the generated authentication information and authority setting information and the attachment file. .

In addition, in the step b-2), if the authentication method is authentication by an authentication server, an authentication request for a receiver client receiving an encrypted mail to access the authentication server to request authentication for the encrypted mail. It provides a security method for the email data comprising the step of generating authentication information including a message.

In addition, in the step b-2), if the authentication method is authentication by password, a password is set in the encrypted mail, and a password inputted by the receiver by the receiver client receiving the encrypted mail and the set password are set. It provides a security method of the email data comprising the step of generating authentication information including a password confirmation message to determine whether to compare the authentication.

In addition, the step e), e-1) confirming the authentication information contained in the encrypted mail; e-2) if the message included in the authentication information is an authentication request message, accessing the corresponding authentication server and requesting authentication for the encrypted mail; e-3) when the message included in the authentication information is a password confirmation message, receiving a password from a receiver and comparing the input password with a password included in the encrypted mail; e-4) When authentication is completed by any one of the above steps e-2) and e-3), check the permission setting information included in the encrypted mail, and decrypt the encrypted mail to restore the attached file. It provides a security method of the email data comprising the step of.

Further, after the step e-4), e-5) when the work on the restored attachment is completed, modifying the permission setting information, and e-6) the permission setting information included in the encrypted mail. It provides a security method of the email data further comprising the step of updating with the modified permission setting information.

In particular, the attachment file is encrypted in the form of an HTM including an encrypted character rule syntax to provide a security method of the email data, characterized in that included in the encrypted mail.

And, in order to achieve the above object, the security system of the email data according to the present invention, whether to perform encryption for the attached file included in the mail is selected, if the encryption execution is selected, generates a virtual drive, the generation A sender client encrypting the attached file in the virtual drive, generating an encrypted mail including the encrypted attached file, and transmitting the encrypted mail to a mail server, and receiving the encrypted mail transmitted from the sender client by accessing the mail server. After selecting whether to restore the encrypted mail, and if the restoration of the encrypted mail is selected, create a virtual drive, decrypts and restores the attachment attached to the encrypted mail in the generated virtual drive, the attachment When you are done with the file, delete the restored attachment. It characterized in that it comprises a recipient client to remove the virtual drive to the generated.

In addition, when the sender client is called with the virtual drive, the sender client receives at least one of authentication and authority setting for the attachment, and based on at least one of the selected authentication information and authority setting information and the attachment file. It provides a security system for the email data, characterized in that for generating an encrypted encrypted mail attachment.

In addition, the sender client includes an authentication request message for allowing the receiver client receiving an encrypted mail to access the authentication server and request authentication for the encrypted mail when the selected authentication is authentication by an authentication server. It provides a security system for email data, characterized in that to generate authentication information.

In addition, when the selected authentication is authentication by password, the sender client sets a password in the encrypted mail, and the receiver client receiving the encrypted mail compares the password input by the receiver with the set password and authenticates the authentication. It provides a security system for e-mail data, characterized in that for generating authentication information including a password confirmation message to determine whether or not.

In addition, the sender client, when the authority setting is selected, provides a security system of the email data, characterized in that by setting at least one of the execution function, the execution frequency and the period of the attachment file to generate the authority setting information.

In addition, the recipient client confirms the authentication information included in the encrypted mail, performs authentication in response to the message included in the verified authentication information, and when authentication is completed, the authority setting information included in the encrypted mail is received. It provides a security system for email data, characterized in that to verify and decrypt the encrypted mail to restore the attachment.

In addition, when the message included in the authentication information is an authentication request message, the receiver client requests authentication of the encrypted mail to the corresponding authentication server, and determines whether to authenticate in response to the request result. Provides a security system for email data.

In addition, when the message included in the authentication information is a password confirmation message, the receiver client receives a password from the receiver, and compares the input password with the password included in the encrypted mail to determine whether to be authenticated. Provides a security system for email data.

In addition, the recipient client, when the work on the restored attachment is completed, modify the permission setting information, characterized in that for updating the permission setting information contained in the encrypted mail with the modified permission setting information Provides a security system for data.

In particular, the attachment file is encrypted in the form of an HTM including an encrypted character rule syntax provides a security system for email data, characterized in that included in the encrypted mail.

By means of the above solution, the present invention in transmitting and receiving data transmitted on a communication network, such as the Internet, for example, an executable file, a program, etc. attached, the justification and Continuous information security of corporate information by not only guaranteeing the stability of executable files or programs that have been recognized for stability, but also preventing the leakage of information that is concerned when exchanging information with others and protecting the information assets of the company. It has the effect of maintaining the system.

In particular, safe and convenient data (text file, executable file, program, etc.) can be exchanged, and by granting the right to execute the data by authentication of the receiver, the security of the data can be improved.

In addition, whether to read or write, whether to execute or not, whether to print, or to allow the screen shot, etc. is selectively provided for the right to execute the data, and the number of times and the period of use (time of use, expiration date, etc.) to grant the right. Designation, and the retirement of the data can be supported to achieve improved security.

In addition, the receiver client can induce the execution of the program by the present invention without executing the EXE file or the like, so that the receiver client can be executed even in the restricted or incapable client executable.

Examples of a method and system for securing email data according to the present invention can be variously applied. Hereinafter, the most preferred embodiment will be described with reference to the accompanying drawings.

1 is a flowchart illustrating an embodiment of a method for securing email data according to the present invention, which will be described with reference to FIG. 2.

First, the sender client connected to a communication network, such as the Internet, is a conversion software composed of an algorithm that encrypts an attached file, an executable file such as an EXE file or a setup file, with an HTM file or a text file, and decrypts the encrypted file. 110 and the receiver client 120 is mounted.

Herein, the conversion software is programmed in various programming languages according to the requirements of those skilled in the art, and the internal algorithm may be variously modified as long as the method of the present invention can be achieved. In addition, when the conversion software is not installed in the receiver client 120, the conversion software can be downloaded from the mail server 200 when receiving the email according to the present invention.

When the sender who creates the mail creates an email using the sender client 110 equipped with the conversion software according to the present invention, the sender client 110 provides a web page as shown in FIG. 5 provided by the mail server 200. Prints to the screen.

The sender inputs the desired contents on the web page output on the screen of the sender client 110, attaches an executable file such as an EXE file or a setup file, and then selects an encryption selection button 111 as shown in FIG. Click (S100).

When the encryption of the mail is selected as described above, the sender client 110 generates a virtual drive, and encrypts the attached executable file (mixed with the attached file) in the generated virtual drive to generate an encrypted mail. (S200).

At this time, the attached file is converted into an HTM file or a text file encrypted by the conversion software according to the present invention, and the converted data is input to the text window 113 shown in FIG.

Therefore, it is possible to convert and transfer files in HTM form or text form that can be operated in any OS and are not classified as hazards.

On the other hand, when an Explorer, which is one of the application programs, directly processes an encrypted HTM file, a problem may occur such that even a general HTM file is decrypted.

In order to solve this problem, the encrypted HTM file of the present invention has a general HTM file structure, but includes a specific encrypted character rule syntax in the HTM file, so that the encrypted HTM file can be identified.

In other words, through the above encrypted character rule syntax, whether the transmitted HTM file is a general HTM file or an HTM file encrypted by the present invention, and the conversion software according to the present invention gives priority to the encrypted HTM file. By granting and processing, it can be executed stably without affecting the operation of OS and general HTM file.

On the other hand, the setting button 112 shown in Figure 5 is a button that can set whether to encrypt the text, such as the content, title, etc. inputted in the text window with the attached file, the setting content by the setting button 112 Naturally, it can be variously applied according to the needs of those skilled in the art.

Hereinafter, referring to FIG. 3, the above-described step S200 will be described in more detail.

As described above, when encryption of an e-mail including an attachment is executed, the sender client 110 creates a virtual drive on a storage medium (HDD, EEPROM, etc.), and calls an attachment to be sent in the virtual drive. (S201).

When the attachment is called to the virtual drive, the sender client 110 allows the sender to set the authentication and authority (S202), and the sender sets the authentication or authority for the attachment. Here, the authentication and the authority setting for the attached file refers to the authentication and authority setting for the case where the receiver client 120 executes the attachment.

In the case of setting authentication for the attached file, when the sender client 110 requests the authentication process, the sender determines whether to authenticate (performation of the receiving client's authentication procedure) (S203), and when authentication is selected, authentication is performed. The method is input (S204).

Here, although the sender decides whether to authenticate, the sender selects through the input device of the sender client 110, and the actual data processing is performed by the conversion software mounted on the sender client 110. Meaning is given.

If the authentication method is authentication by the authentication server 200, the sender client 110 generates an authentication request message (S205), if the authentication by the password, the sender client 110 generates a password confirmation message (S206).

When setting the authority for the attachment, the sender client 110 sets the execution function of the attachment, for example, whether to read the attachment, whether to write, whether to execute, whether to print, whether to allow screenshots and the like ( In step S207, the number of executions for performing the execution function and the execution period (or usage period, etc.) are set (S208).

When the message generation and authority setting for authentication are completed as described above (S209), the sender client 110 generates an encrypted mail based on the attachment and the authentication and authority setting information (S210). Here, the generated encrypted mail refers to the mail converted to the HTM file by encrypting the attachment, it is natural that can be changed to various text files according to the needs of those skilled in the art.

When sending the encrypted mail generated as described above to the mail server 200, the sender client 110 deletes the encrypted attachment file in the virtual drive, and removes the virtual drive (S300).

Therefore, only the attachment file exists in the sender client 110, and not only the encrypted attachment file is deleted but also the virtual drive is removed, so that information on the file to be transmitted cannot be collected. In other words, it is not possible to know which of the plurality of files existing in the transmitting client is transmitted, thereby improving security.

On the other hand, when the receiver client 120 receiving the encrypted mail accesses the mail server 200, the receiver receiving the mail confirms the reception of the encrypted mail and determines whether to restore the mail.

When the receiver client 120 selects to restore the encrypted mail at the request of the receiver, the receiver client 120 creates a virtual drive on the storage medium of the receiver client 120 and checks the encrypted part of the encrypted mail in the generated virtual drive. To decrypt the attachment (S500).

The recipient client 120 decrypts and restores the attached file restored on the screen so that the receiver can work, and the user checks the outputted attachment file and reads, writes, executes, and prints the attached file.

When the receiver's work on the restored attachment is completed, the receiver client 120 deletes the restored attachment and removes the virtual drive (S600).

Hereinafter, referring to FIG. 4, the above-described step S500 and step S600 will be described in more detail.

As described above, when the encrypted mail is received by the receiver client 120, the receiver client 120 receives whether to restore the encrypted mail from the receiver (S400), and if the restoration of the encrypted mail is selected, the receiver client 120 ) Creates a virtual drive on the storage medium and calls the encrypted mail received in the virtual drive (S501).

Here, it is natural that the conversion software is executed and the encrypted mail can be received, and the conversion software can be automatically executed by selecting the restoration of the received encrypted mail without the conversion software being executed according to the requirements of those skilled in the art. .

Recipient client 120 checks the authentication message included in the encrypted mail (S502), if the authentication message is an authentication request message, the authentication server 300 as shown in Figure 2 to confirm whether or not the decryption of the encrypted mail In step S503, if the authentication message is a password confirmation message, the user inputs a password for confirmation of decryption of the encrypted mail (S504). Here, the authentication server 300 may constitute a separate authentication server for the present invention, of course, may be composed of a certificate server of a well-known certification authority according to the needs of those skilled in the art.

The receiver client 120, in the case of an authentication request message, confirms the authentication in response to the authentication verification result from the authentication server 300, and in the case of the password verification message, the receiver client 120 is included in the password and encryption file input by the receiver. If the password is matched and determined to be authenticated (S405).

As described above, when the authentication is completed, the receiver client 120 decrypts the encrypted mail to restore the attached file (S506), confirms the authority setting information of the restored attached file, and informs the receiver (S601) of the receiver client ( 120, in response to the request of the receiver, a job (read, write, execute, print, etc.) for the attached file is executed (S602).

As described above, when the work on the attached file is completed, the receiver client 120 generates log information of the attached file based on the work result of the attached file, and attaches the encrypted mail in response to the generated log information. Change the permission settings for the file. For example, if the execution frequency of the attached file is set among the permission setting information, the execution frequency of the attached file is subtracted once when the operation on the attached file is completed.

When the above operation is completed, the receiver client 120 deletes the attached file and the encrypted mail restored on the virtual drive, and removes the virtual drive (S603).

Therefore, the receiver client 120 only receives the received information of the encrypted mail, and not only deletes the attached file but also removes the virtual drive, so that information on the transmitted file cannot be collected, thereby improving security. It is.

In particular, it is possible to manage the log information such as restoration information (restoration time, restoration frequency, etc.) from the encrypted mail to the attached file and the operation and permission setting information on the attached file in real time, thereby obtaining improved security and efficiency. It can be.

The security method and system for email data according to the present invention have been described above. Such a technical configuration of the present invention will be understood by those skilled in the art that the present invention can be implemented in other specific forms without changing the technical spirit or essential features of the present invention.

In addition, the software to which the algorithm for performing the method of the present invention is applied, the storage medium storing the software, etc. will be included in the rights of the present invention.

Therefore, the embodiments described above are intended to be illustrative in all respects and not to be considered as limiting, the scope of the present invention is indicated by the appended claims rather than the foregoing description, the meaning of the claims and All changes or modifications derived from the scope and the equivalent concept should be construed as being included in the scope of the present invention.

1 is a flowchart illustrating an embodiment of a method for securing email data according to the present invention.

2 is a configuration diagram showing an embodiment of a security system for email data according to the present invention.

3 is a flowchart illustrating an embodiment of step S200 of FIG. 1.

4 is a flowchart illustrating an embodiment of steps S400 to S600 of FIG. 1.

5 is a partially enlarged screen illustrating an embodiment of a web page for creating a mail according to the present invention.

<Explanation of symbols for the main parts of the drawings>

110: sender client 120: receiver client

200: mail server 300: authentication server

Claims (17)

a) the sender client is selected whether or not to encrypt the mail including the attachment; b) if the encryption execution is selected, generating a virtual drive and encrypting the attachment file in the created virtual drive to generate an encrypted mail; c) transmitting the generated encrypted mail to a mail server and removing the generated virtual drive; d) a recipient client accesses a mail server, checks the encrypted mail, and receives whether to recover the encrypted mail; e) if restoring the encrypted mail is selected, creating a virtual drive and verifying an encrypted portion of the encrypted mail in the generated virtual drive to decrypt the attached file; And f) performing the operation on the restored attachment in the virtual drive when the decryption of the attachment is completed; and deleting the restored attachment and removing the virtual drive when the operation on the attachment is completed. How to secure email data. The method of claim 1, Step b), b-1) when the attachment is called to the virtual drive, receiving at least one of authentication and authority setting for the attachment; b-2) when authentication is selected, selecting an authentication method and generating authentication information corresponding to the authentication method; b-3) if the permission setting is selected, generating at least one of an execution function, an execution frequency, and a duration of the attached file to generate permission setting information; And b-4) generating an encrypted mail in which an attached file is encrypted based on at least one of the generated authentication information and permission setting information and the attached file. The method of claim 2, Step b-2), When the authentication method is authentication by an authentication server, a process of generating authentication information including an authentication request message for allowing a recipient client receiving an encrypted mail to access the authentication server and request authentication for the encrypted mail. Security method of the email data comprising a. The method of claim 2, Step b-2), If the authentication method is authentication by password, a password is set in the corresponding encrypted mail, and the receiver client receiving the encrypted mail compares the password input by the receiver with the set password to determine whether to authenticate or not. And generating authentication information including a confirmation message. The method of claim 1, Step e), e-1) checking the authentication information included in the encrypted mail; e-2) if the message included in the authentication information is an authentication request message, accessing the corresponding authentication server and requesting authentication for the encrypted mail; e-3) when the message included in the authentication information is a password confirmation message, receiving a password from a receiver and comparing the input password with a password included in the encrypted mail; e-4) When authentication is completed by any one of the above steps e-2) and e-3), check the permission setting information included in the encrypted mail, and decrypt the encrypted mail to restore the attached file. And e-mail data security method. The method of claim 5, After the above step e-4), e-5) When the work on the restored attachment is completed, modifying the permission setting information; e-6) further comprising updating the permission setting information included in the encrypted mail with the modified permission setting information. The method according to any one of claims 1 to 6, The attachment file is encrypted in an HTM form including an encrypted rule rule syntax and included in the encrypted mail. It is selected whether to perform encryption for the attachment included in the mail, and if encryption execution is selected, generates a virtual drive, encrypts the attachment within the generated virtual drive, encrypted mail including the encrypted attachment Sender client to create and send to the mail server, After receiving the encrypted mail transmitted from the sender client by accessing the mail server, selecting whether to restore the encrypted mail or not, and if restoring the encrypted mail is selected, a virtual drive is generated and the virtual drive is generated within the created virtual drive. Decrypting and restoring the attached file attached to the encrypted mail, the security system of the email data including a recipient client to delete the restored attachment and remove the generated virtual drive when the work on the attached file is completed . The method of claim 8, The sender client, When the attachment is called to the virtual drive, at least one of authentication and authority setting for the attachment is selected, and based on at least one of the selected authentication information and authority setting information and the attachment, encryption of the attachment is encrypted. A security system for email data, characterized in that for generating mail. The method of claim 9, The sender client, If the selected authentication is authentication by an authentication server, generating the authentication information including an authentication request message for the receiver client receiving the encrypted mail to access the authentication server and request authentication for the encrypted mail. A security system for email data. The method of claim 9, The sender client, If the selected authentication is authentication by password, a password is set in the corresponding encrypted mail, and the receiver client receiving the encrypted mail compares the password input by the receiver with the set password to determine whether to authenticate or not. Security system for email data, characterized in that for generating authentication information including a confirmation message. The method of claim 9, The sender client, If the permission setting is selected, the security data security system, characterized in that for generating at least one of the execution function, the execution frequency and the duration of the attachment file to generate the permission setting information. The method of claim 8, The receiver client, Check the authentication information included in the encrypted mail, perform authentication in response to the message included in the verified authentication information, and when authentication is completed, check the authority setting information included in the encrypted mail, and decrypt the encrypted mail. Security system of the email data, characterized in that to restore the attachment. The method of claim 13, The receiver client, If the message included in the authentication information is an authentication request message, requesting authentication for the encrypted mail to the corresponding authentication server, and determining whether to authenticate in response to the request result. The method of claim 13, The receiver client, If the message included in the authentication information is a password confirmation message, receiving a password from the recipient, and comparing the password and the password contained in the encrypted mail security system of the email data, characterized in that for determining whether or not. The method of claim 13, The receiver client, And modifying the permission setting information and updating the permission setting information included in the encrypted mail with the modified permission setting information when the operation on the restored attached file is completed. The method according to any one of claims 8 to 16, The attachment file is encrypted in an HTM form including an encrypted rule rule syntax and included in the encrypted mail security system.

Images