KR20100030875A - Secure infrastructure by the virtual separation of personal device(personal computer) network and hard drive - Google Patents

Abstract

PURPOSE: A secure infrastructure by virtual separation of a personal device network and a hard drive are provided to apply strict security system to a work area by dividing the purpose of using the PC into a work area and a individual area based on virtual PC. CONSTITUTION: A main system is comprised of a network controller, a main server, a policy server, a database, a logging server, and a monitoring server. A management system is comprised of a security client agent, a network firewall controller, a file system controller, a memory access controller, an external storage media access controller, a printing controller, a management tool, and a real time state board. A user system applies a policy received from the main system and the management system and virtualizes the user PC as a security section and a private section.

Description

Secure infrastructure by the virtual separation of personal device (personal computer) network and hard drive}

The present invention relates to a security system for establishing a security work area system within an enterprise. More specifically, the intranet can be classified into a secured work area and a private area to apply a security policy differently according to a use area. Prevents unauthorized data leakage by controlling access to intranet system and communication network of outsider's work area, strengthens security of computer used inside the enterprise and free internet in personal area The present invention relates to a security system through virtualization of personal computer network and hard disk that can increase work convenience due to access and use of personal programs, and maximize work efficiency by maximizing individual IT utilization in a state of perfect security.

In general, the computer used for work in the company uses the company's internal security data using the work program and the personal data by the personal program not used for the work, and the intranet system and external access are used for the efficiency of the work. You can use the Internet system at the same time.

Therefore, when using a computer system that has been personally paid and used for work, it is possible to transmit work data through an Internet connection, and to prevent this since there is no great difficulty in leaking work data to the outside using a personal storage device. In order to prevent this, various security functions and security policies were applied, but it was impossible to completely prevent information leakage.

In addition, not only the leakage of information through the Internet, but also the internal staff can be stored on an external storage medium via a computer, and then easily leaked to the outside, and the issue that can be easily leaked by printing important documents in the company There was this.

On the other hand, if you completely exclude the use of personal IT (Internet, personal storage media, private programs) in order to prevent personal data leakage, there is a problem that the efficiency of work can be reduced.

Conventionally, the same security system is applied to the storage, transmission, and output of data to programs executed to solve such problems. However, the security policy as described above is applied to all users. The security of documents is not fully applicable, and there is a problem that reduces the efficiency of the work of the individual.

The present invention has been made in order to solve such a conventional problem, virtualized PC environment to be divided into a work area and a personal area according to the purpose of personal PC use, so that it can be easily switched to this, In the work area, the strict security system is applied to prevent the problem of information leakage and hacking, and in the personal area, it is possible to freely access the Internet and use personal programs to enhance security and increase work efficiency. The purpose of the present invention is to provide a security system through the virtual separation of the personal computer network and hard disk.

In order to achieve the above object, the present invention provides a network controller (NAC: Network Access Control, NAP: Network Access Protection, IP Manager, etc.) that manages the network access control of the accessor; A main server for checking usage consistency of users, user groups, network data and user computers, and determining whether to use the network of the user computers in association with the network controller; Manages policies for user groups or users, PC network firewall policies, file system access control policies, removable storage device access control policies, memory access control policies, and printing policies for printing documents through printers and plotters. Policy server; A database for storing data of the server; Logging server for managing the log generated in the system in real time; A monitoring server for managing the state of the user computer in real time; A main system consisting of;

A security client agent installed on the user's computer to check usage consistency; PC firewall controller installed in user computer to apply PC network firewall policy for intranet or internet access control, file system controller installed in user computer to apply folder access policy in file system, and memory installed in user computer A memory access controller for applying an access right policy of a board), a printing controller for applying a printing policy to a printer output; A management tool for managing the main system; It is characterized by consisting of a management system consisting of; a real-time situation board to enable real-time monitoring of the main system.

The apparatus may further include a network controller interface module for linkage with the network controller and a database agent module for linkage with a database.

Meanwhile, in the method of the present invention, the user accesses the intranet through a computer logon, the main server of the main system checks whether the network is allowed through the network controller, and then, in the case of an unauthorized computer, the computer is allowed to access the computer. Restricting the use of the network, after connecting to the intranet characterized in that it consists of the step of selecting from the work area and personal area according to the purpose of use of the computer.

When running a program in the personal area, PC firewall policy that prevents access to the intranet but only the Internet, prevents reading / writing to the work area folder other than the folder designated as the personal area (file storage). Folder access control policy in the file system to enable read / write, memory access control policy to allow only the movement of process driven in the work area from the memory of a process driven in the private area, read only from external storage media It is characterized in that it comprises a step of using a storage medium access control policy, whether to print through a printer for the process driven in the personal area and to apply the watermark template to the personal area.

When running the program in the work area, the PC firewall policy that does not allow internet access but only intranet access, the folder designated as the personal area (file storage) can only be read, and it can be read / written in the work area folder other than the folder designated as the personal area. The folder access control policy in the file system to enable the operation, the memory of the process driven in the work area cannot be moved from the memory of the process driven in the personal area, and the memory enables the process of the process in the same work area to the memory. Access control policy, storage medium access control policy to read only from external storage media, whether to print documents through printer for process driven in business area, and policy for watermark template application to business area. It is characterized by consisting of.

At this time, if the program is run in each area, the network PC firewall policy, the folder access right policy in the file system, the memory access right policy, and the access control to the external storage medium according to the operation purpose (for work or personal use) of the driven program Retrieval of policies and printouts from the policy server for policy output and application; control of processes according to the program being executed to control access to the Internet and intranets according to their purpose of use (business or personal); Controlling processes to control folder (storage) access according to their purpose of use (business or personal); controlling processes according to the program being executed to determine the memory of different processes according to their purpose of use (business or personal). Control access, save externally according to program to be executed It characterized in that the step of controlling access to the body, to control a process in accordance with the executed program consists of a step of controlling the printing of the output in accordance with the purpose of use (business or personal).

As described above, according to the present invention, unlike all application programs running on the computer for the conventional security, the same firewall policy is applied, the user can be easily switched to the work area and the personal area, and the personal area can be easily changed. In order to free access to the Internet and to execute personal programs, access to the work area should be blocked. In the work area, a thorough network firewall system, folder access control in the file system, memory access control, removable storage device access control, There is an effect that can increase the work efficiency by enhancing the security by using the print control on the output.

In addition, in the security system in the work area, it is possible to prevent the leakage of important data and to ensure the management of important data by controlling the storage location according to the executed program and controlling the storage in the portable storage device. It has the effect of making it possible.

In addition, in the work area, it is possible to access the intranet to access the intranet, but access to the Internet is possible only by running the program in the personal area, thereby preventing the leakage of important data through the Internet. You can protect your intranet from hacking, viruses, and the like.

In addition, in the work area, the data is leaked by using the differentiated folder access policy according to the operation purpose of the program by giving access control to the storage of the computer according to the user's authority and granting access to a specific folder according to the currently running program. Can be prevented.

In addition, in the work area, watermarks are applied to prints to enhance security of prints and to know the source of prints.

In addition, in the business area, data generated as a result of business activities within the company can be operated only within the business area to prevent illegal leakage of important information by requiring approval through a quarantine station for storage and movement to other portable storage media. It is a very useful invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the configuration of the security system through the inventors personal computer network and hard disk virtual separation.

Accordingly, the apparatus of the present invention is a network controller (NAC: Network Access Control, NAP: IP Manager) that manages the access and network access of the accessor, user, user group, network data and the use consistency of the user computer A main server for checking whether to use the network of the user computer in association with the network controller; A policy server that manages policies for user groups or users, network firewall policies to be applied to other user computers, folder policies, access control policies for external storage devices, memory access control policies, and print policies for document output through printers and plotters; A database for storing data of the server; Logging server for managing the log generated in the system in real time; A monitoring server for managing the state of the user computer in real time; A main system consisting of;

A security client agent installed on the user's computer to check usage consistency; PC firewall controller installed in user computer to apply PC network firewall policy for intranet or internet access control, file system controller installed in user computer to apply folder access policy in file system, and memory installed in user computer A memory access controller applying the access right policy of the board), a printing controller applying a printing policy to the output through the printer and the plotter; A management tool for managing the main system; Real-time status board for real-time monitoring of the main system; It consists of a management system consisting of.

The apparatus may further include a network controller interface module for linking with the network controller and a database agent module for linking with a database.

The network controller checks the use consistency of the personal PC so that only authorized users can access the network and use the intranet or the Internet, and unauthorized users can block the use of computers in the company by disallowing network access. Make sure

The main server manages users and user groups in connection with a policy server, a network controller, and a database. The user server can be used only by a registered user through data retrieval of a connecting user. Check the network controller interface and determine whether to use the network of the user computer in conjunction with the network controller through the network controller interface module.

The policy server manages individual policies, group policies, and other policies applied to user computers (network firewall policy, file system access control policy, memory access control policy, removable storage device access control policy, and print control policy for printouts). The program used for business and the program used for personal use control the process when each program is executed to establish the access right policy according to the purpose of using each program and link it with the security agent installed on the main server and user PC. To run it.

The network controller interface module performs a role of linking the main server to issue a control command to the network controller according to whether a user computer can use the network.

The database agent enables the main server to associate with a database that stores data such as user information, computer information, network information (IP address, gateway address, MAC address, etc.) of the user computer, policy information, and the like.

The logging server is to manage the log generated in the system in real time, check the log generated in the system in real time and stores the log information in the file system of the server.

The monitoring server manages the state of the user's computer in real time. The monitoring server manages the program and network usage in real time and stores and manages the usage information.

The security client agent is installed on the user's computer, and connected to the main server to check the usage consistency of the user's computer and apply each policy to the user's computer.

The network firewall controller is installed in a user computer and controls intranet and internet access by applying a firewall policy according to a program use purpose.

The file system controller is installed on a user computer and controls access to personal folders and work folders by applying a folder access policy according to a program use purpose.

The memory access controller is installed in a user computer and controls sharing of memory between different processes according to a program use purpose.

The output print controller is installed in a user computer and controls whether to insert and output a watermark for the output according to a program use purpose.

The storage medium controller is installed in a user computer and controls the access right to the removable storage device according to the purpose of using the program.

Management tools and real-time status boards allow the main system to be managed while monitoring the main system in real time.

Looking at the embodiment to which the security system of the present invention configured as described above is applied as follows.

The main server checks the usage consistency of the user computer in conjunction with the security agent and determines whether to use the network of the user computer from the network controller through the network controller interface module.

Meanwhile, in the policy server, the network firewall policy, the folder access control policy in the file system, the memory access control policy, the external storage medium access control policy, and the printing policy for the printouts in the unit of the currently running program for the application program running on the user's computer. The established policies apply different policies in real time to a process driven according to the purpose of use of the application (personal and business).

In addition, the management system can manage the status of the main system monitored by the real-time status board in real time, and the management tool allows for faster maintenance and repair of the main system.

Hereinafter, operation steps of the present invention will be described.

According to the method of the present invention, a user accesses an intranet through a computer logon. The main server of the main system checks whether a network connection is allowed through a network controller. The step of restricting the connection, and the step of connecting to the intranet by selecting from the work area and personal area according to the purpose of use of the computer.

At this time, when the program is driven in each area, it is a step of retrieving and applying each policy from the policy server to the operation purpose (for work or personal use) of the driven program.

When running a program in the personal area, PC firewall policy that prevents access to the intranet but only the Internet, prevents reading / writing to the work area folder other than the folder designated as the personal area (file storage). Folder access control policy in the file system to enable read / write, memory access control policy to allow only the movement of process driven processes from the work area to the memory of the process driven in the private area, read only from external storage media The storage medium access control policy, the process of using the printer or plotter for the process run in the personal area, and the policy for applying the watermark template to the personal area.

When running the program in the work area, the PC firewall policy that does not allow internet access and only intranet access, the folder designated as the personal area (file storage) can only be read, and the work area folder other than the hf designated as the personal area can be read / The folder access control policy in the file system to enable writing, and from the memory of the process driven in the work area to the memory of the process driven in the private area is not possible, it is possible to move to the memory of the process in the same work area. Uses a memory access control policy, a storage medium access control policy that only allows reading from an external storage medium, the ability to print documents through a printer or plotter for processes driven in the work area, and the application of watermark templates to the work area. It consists of steps.

This is because the uniform security policy is applied to all programs to be executed, and there are many limitations due to security problems when using the program. Therefore, the program is controlled by applying the security policy to each program by controlling the process according to the operation purpose of each program. It is effective in strengthening security by perfecting incomplete security system through process control by broadening the scope and applying uniform security policy.

Although the above-described embodiments have been described with respect to the most preferred embodiments of the present invention, it is not limited to the above embodiments, and it will be apparent to those skilled in the art that various modifications can be made without departing from the technical spirit of the present invention.

1 is a block diagram showing a schematic principle of a security system through the inventors personal computer network and hard disk virtual separation,

Figure 2 is a block diagram showing the configuration of a security system through the present inventors personal computer network and hard disk virtual separation,

Figure 3 is a floor chart showing the operation of the security system through the inventors personal computer network and hard disk virtual separation,

Claims (8)

A network controller configured to manage access and block access of the accessor; A main server for checking usage consistency of users, user groups, network data and user computers, and determining whether to use the network of the user computers in association with the network controller; A policy server for managing a policy for a user group or user and other user computers, a network firewall policy, a folder policy, an external storage medium access control policy, a memory access control policy, and a printing policy for document printing; A database for storing data of the server; Logging server for managing the log generated in the system in real time; A monitoring server for managing the state of the user computer in real time; A main system consisting of; A security client agent installed on the user's computer to check usage consistency; A network firewall controller installed on a user computer to apply a network firewall policy; A file system controller installed in a user computer and applying an access policy in the file system; A memory access controller installed in a user computer to apply a memory (clipboard) access policy; An external storage medium access controller installed in a user computer to apply an access policy of the external storage medium; A printing controller installed in a user computer to apply a printing policy for output; An administrative tool installed on a user computer to manage the main system and the policy server; Real-time status board for real-time monitoring of the main system; Personal computer network and hard drive system, characterized in that consisting of a management system, and the user system to apply the respective policies from the main system and the management system to the user's computer to use the computer by virtualizing the security area and the personal area Security system with disk virtual separation. The method according to claim 1, And a network controller interface module for linkage with the network controller and a database agent module for linkage with a database. When the user connects to the intranet through the computer logon, check whether the computer is allowed to access the network through the network controller from the main server of the main system, and then allow the access if the computer is allowed and restrict the network access if the computer is not allowed. Accessing the intranet and selecting a work area and a personal area to access the intranet; Retrieving a policy of a selected area of the personal area and the business area from the policy server; Personal computer network comprising the steps of applying the printing policy for the PC firewall policy, the folder access control policy in the file system, the memory access control policy, the storage medium access control policy, the watermark template applied by the policy server And security method through hard disk virtual separation. The method according to claim 3, The PC firewall policy is to allow only intranet access and Internet access when running programs in the personal area, and only intranet access without Internet access when running programs in the work area. Security method through disk virtual detach. The method according to claim 3, The folder access control policy in the file system is such that when the program is run in the personal area, the user cannot read / write the folder in the work area other than the folder designated as the personal area (file store) and read / write only in the storage area designated as the personal area. In addition, when the program is run in the work area, the folder designated as the personal area (file storage) can be read only, and the personal computer network and the hard drive, characterized in that read / write to the work area folder other than the folder designated as the personal area. Security method through disk virtual detach. The method according to claim 3, The memory access control policy allows only the movement of the process driven in the personal area to the memory of the process driven in the business area when the program is run in the personal area, and when the program is run in the business area. It is impossible to move from the process memory to the memory of the process driven in the personal area, the security method through the virtual separation of the personal computer network and hard disk characterized in that it is possible to move to the memory of the process in the same work area. The method according to claim 3, The storage medium access control policy allows only the processes that are run when the program is run in the private area to read only from the storage medium, and writes are not allowed. When the program is run in the work area, the storage medium is only allowed to run in the storage medium. A security method using virtualization of a personal computer network and a hard disk, characterized in that to enable reading and to allow writing to a storage medium according to whether or not it is writable according to a storage medium access control policy. The method according to claim 3, The print policy for the application of the watermark template is to insert the watermark information set in the print policy of the personal area only when the program is run in the personal area, and to print through the printer or the plotter. When the gram is driven, the personal computer network and the hard disk virtual machine can be set such that the print control policy is set so that the process can be printed through a printer or a plotter by inserting watermark information set in the print policy of the work area only for the driven process. Security method by separation.

Images