KR20110041778A - Method for preventing information leakage of host apparatus - Google Patents

Abstract

PURPOSE: A method for blocking information leakage through a synchronizing program of a host device is provided to control data transmission by blocking a virtual port of a synchronizing program. CONSTITUTION: A portable storage medium is connected to a host device(210). The hooking of a system call operates(230). The system call is delivered from an application of the host device to a kernel. It is determined whether the system call is transmitted to the portable storage medium through a virtual port. The transmission of the system call is blocked according to a determination result(270).

Description

Method for preventing information leakage of host apparatus}

The present invention relates to a method for preventing information leakage of a host device, and more particularly, to information leakage of a host device that can block a file from being copied to a portable storage medium or a file generated on the portable storage medium.

Recently, as the spread of portable storage devices as well as personal computers has been expanded, various application services providing data transmission between portable storage devices and personal computers have been actively studied.

After the user connects the portable storage device with the computer, the user easily copies the information stored in the computer to the portable storage device or vice versa. This allows users to share information more easily.

However, as technology and application services related to data transmission have evolved, frequently the main information or personal information is leaked out through the portable storage device. Accordingly, there is a need for a technology that can prevent information stored in a host device such as a computer from leaking through a portable storage device.

As described above, the problem to be solved by the present invention is to provide a method of preventing information leakage of the host device that can prevent the main information from leaking through the portable storage device.

The proposed method of preventing information leakage of the host device includes hooking a system call transmitted from an application of the host device to the kernel when the portable storage medium is connected to the host device, and hooking the system call to the portable storage medium through the virtual port. The method may include determining whether the call is to be transmitted to, and blocking transmission of the system call according to the determination result.

The determining may include analyzing a handle included in the system call to identify a port to which the system call is transmitted, and identifying a type of a port set for the identified port. If the type of the virtual port, it can block the transmission of the system call.

The method may further include checking an access right policy set for the identified port. If the access right policy is blocked, transmission of a system call may be blocked.

The set access policy can be changed.

The method may further include notifying the application that the transmission of the system call is blocked.

When the portable storage medium is connected to the host device, the portable storage medium sink program installed in the host device may further include generating a system call.

The system call can be one of creating a file and copying a file.

The portable storage medium may be provided in a portable terminal or a smart phone.

On the other hand, the proposed method of preventing information leakage of the other host device, the step of connecting the host device and the portable storage medium, hooking a system call transferred from the application of the host device to the portable storage medium, and hooked The method may include checking property information of the system call and blocking delivery of the system call according to the identified property information.

After the connecting step, the method may further include allocating a removable drive volume to the connected portable storage medium.

In the assigning step, the portable storage medium may be recognized as a universal serial bus (USB) removable disk to allocate a removable drive volume.

Identifying the destination of the system call from the path information included in the system call; and if the destination is a portable storage medium recognized as a removable drive, checking the access permission policy set for the removable drive. If one policy is blocking, access to portable storage media can be blocked.

The method may further include notifying the application that delivery of the system call has been blocked.

Prior to analyzing, the method may further include hooking a packet transferred from the application to the kernel.

According to the present invention, when the portable storage medium is connected to the host device, information leakage to the portable storage medium can be prevented through a sink program. This is because the data transmission from the host device to the portable storage medium can be controlled by blocking the virtual port used by the sink program.

In addition, according to the present invention, the portable storage medium may be recognized as a removable memory, and the file may be copied, generated, or read from the portable storage medium. As a result, it is possible to prevent the main information stored in the host device from leaking.

 BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In describing the present invention, when it is determined that detailed descriptions of related known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terminology used herein is a term used to properly express a preferred embodiment of the present invention, which may vary according to a user, an operator's intention, or a custom in the field to which the present invention belongs. Therefore, the definitions of the terms should be made based on the contents throughout the specification.

1 is a block diagram illustrating a host device according to an exemplary embodiment.

The host device 100 of FIG. 1 is a file from the host device 100 to the portable storage medium 10 when the portable storage medium 10 connected to the host device 100 via wired or wireless communication is connected through a virtual port. You can block copying or creating files.

The host device 100 may be a device for installing software, and may include a personal computer as an example. The portable storage medium 10 may be a device that provides a mobile storage medium function, such as a mobile phone, a smart phone, and personal digital assistants (PDAs).

To this end, the host device 100 includes an application unit 110, a port access control unit 120, a policy providing unit 130, an I / O (In / Out) manager 140, and an interface unit 150. . The application unit 110 corresponds to an application layer among the seven layers, and the port access control unit 120, the policy provider 130, and the I / O (In / Out) manager 140 correspond to an OS layer. 150 corresponds to a hardware layer.

The application unit 110 includes at least one application program. For example, the application unit 110 is provided with a SYNC program for providing various services to the portable storage medium 10.

The sink program is a program that allows the host device 100 and the portable storage medium 10 to share information, and a user may use various programs such as documents, music, and images stored in the host device 100 using the sink program. ) Can be downloaded to the portable storage medium (10).

The sink program of the application unit 110 recognizes that the portable storage medium 10 is connected to the host device 100, and sends a system call to the portable storage medium 10 through a virtual port. You can output to a layer. The system call is a kind of In / Out Request Packet (IRP), and may request creation or copying of a file. System calls can be generated automatically by the sink program or upon user request.

The port access control unit 120 may monitor the application unit 110 and hook a system call output from the application unit 110 to a kernel layer. The port access control unit 120 analyzes the hooked system call to determine whether the system call is a call related to a connection to a virtual port.

In detail, the system call output from the application unit 110 includes a handle, and the application unit 110 includes a plurality of ports 150-1,..., 150-n provided in the host device 100. (n is a positive number) may include information indicating which port is a system call. As a result, the port access control unit 120 may determine the destination of the system call by analyzing the handle of the system call.

The port access control unit 120 may check whether the target port is a virtual port by comparing a COM port list with a target port that is a destination of a system call. The host device 100 sequentially generates a port list whenever devices are connected to the plurality of ports 150-1,..., 150-n or a virtual port is created.

Alternatively, the port access control unit 120 may determine whether the target port is a virtual port by comparing the access right policy provided from the policy provider 130 with the identified target port.

The port access control unit 120 may determine that the target port is a virtual port, and when a blocking policy is set for the identified virtual port, the system call may be blocked from being transmitted to the portable storage medium 10. As a result, the system call from the application unit 110 is blocked from accessing the portable storage medium 10. In addition, the port access control unit 120 reports to the application unit 110 that the transmission of the system call is denied.

On the other hand, if the identified target port is not a virtual port, or the policy of allowing is set in the access right policy, the port access control unit 120 makes a system call corresponding to the target port (for example, a portable storage medium). System call may be output to I / O manager 140. The port access control unit 120 may be installed in the kernel layer of the host device 100 in the form of '* .sys'. An example of * .sys is smss.exe. The Session Management Subsystem (SMSS) is responsible for initiating user sessions.

The policy provider 130 may set and store a policy for each port that blocks or permits transmission of a system call. The user may manually set the access right by using a program for setting the access right policy, or the policy provider 130 may automatically set the access right.

For example, the policy provider 130 sets a policy of blocking for a port set as a virtual port among the plurality of ports 150-1,..., 150-n. In addition, the policy provider 130 sets a block or allow for the designated general port among the plurality of ports 150-1,..., 150-n. The policy provider 130 may be installed in the kernel layer in the form of '* .exe'.

The I / O manager 140 transmits a system call input from the port access control unit 120 to the corresponding port.

The interface unit 150 includes a plurality of ports 150-1,..., 150-n. The plurality of ports 150-1,..., 150-n include a general serial port (COM port) or a virtual serial port.

2 is a flowchart illustrating an information leakage blocking method of a host device according to an exemplary embodiment.

2, in operation 210, the host device 100 connects the portable storage medium 10 through a virtual port.

In operation 220, the application of the application unit 110, for example, the sink program attempts to connect with the portable storage medium 10, and when connected, generates and outputs a system call to be transmitted to the portable storage medium 10. have. The system call generated in step 220 may correspond to a file creation or file copy command.

In operation 230, the port access control unit 120 may hook a system call output from the application unit 110 to the kernel layer.

In operation 240, the port access control unit 120 may analyze a handle of the hooked system call to identify a destination, that is, a target port, to which the system call is to be transmitted.

In operation 250, the port access control unit 120 may compare the target port identified by the handle analysis with the access right policy set in the policy providing unit 130. The access right policy refers to a policy indicating whether to block or allow a system call for each port.

In step 260, if the checked target port is the virtual port, that is, the sink program uses the virtual port, and the blocking is set for the virtual port, in step 270, the port access control unit 120 calls the system call. Access to the portable storage medium 10 can be blocked.

In operation 280, the port access control unit 120 may report that the transmission of the system call is denied to the application unit 110.

On the other hand, in step 290, the port access control unit 120, if the identified target port is not a virtual port, or if the policy of allowing permission is set in the access rights policy, the system call to be transmitted to the portable storage medium 10 Can be. As a result, the system call accesses the portable storage medium 10 via the I / O manager 140.

According to the first embodiment described above, a system call transmitted to a portable storage medium 10 connected through a virtual port is hooked, and if the destination of the hooked system call is a portable storage medium 10, transmission of the system call is performed. It is possible to cut off. As a result, it is possible to prevent the main information stored in the host device 100 from being copied to the portable storage medium 10 or generated as a new file.

In addition, when a user or an administrator needs to store a document in the portable storage medium 10, by using a graphical user interface (GUI) of the blocking policy program, the access right policy set for the virtual port is changed from blocking to allowing, Of course, information can be stored. In this case, the user may change the access right policy as described above after receiving the permission from the administrator. Here, the permission may be made in various ways such as electronic approval through the web, sharing of passwords required for policy change, and changing the access level of the user.

3 is a block diagram illustrating a host device according to another exemplary embodiment.

The host device 300 of FIG. 3 allocates a removable drive volume to the portable storage medium 20 connected to the host device 300 in a wired or wireless communication, and copies files from the host device 300 to the portable storage medium 20. Or you can block file creation.

The host device 300 is a device for installing software, and may be a personal computer as an example. The portable storage medium 20 may be a device that provides a mobile storage medium function such as a mobile phone, a smile phone, and a personal digital assistant (PDA).

To this end, the host device 300 may include the application unit 310, the volume access control unit 320, the policy providing unit 330, the I / O manager 340, the file system driver 350, and the driver unit 360. It may include.

The application unit 310 includes at least one application program. For example, the application unit 310 is provided with a program for creating a document, a program for image editing, and the like. The application unit 310 may generate a system call according to a user's command and output the generated system call to the kernel layer. The system call is a kind of In / Out Request Packet (IRP) and may request creation or copy of a file.

The volume access control unit 320 may obtain mapping relationship information between the file system volume and the device volume through the I / O manager 340 at the initial load. The file system volume is a partitioned logical volume of the host device 300, and the device volume refers to a physical device volume corresponding to each logical volume. Mapping relationship information is information showing a logical volume and a physical device volume mapped thereto. When an application wants to store a file, if the file is stored on a logical volume (eg, d drive), the proposed volume access control 320 may be physically mapped to that logical volume (eg, d drive). By checking the device volume, it may be determined whether the identified physical device volume is a portable storage medium.

The volume access control unit 320 may perform an access control function between the I / O manager 340 and the file system driver 350 based on an access right policy to a hardware medium (eg, a portable storage medium or an HDD). have.

To this end, the volume access control unit 320 may monitor the application unit 310 and hook a system call output from the application unit 310 to the kernel layer. The volume access control unit 320 analyzes the hooked system call and checks property information and path information of the system call. The attribute information includes attributes of the system call, and the route information includes volume information (eg, D drive, F drive) of a destination to which the system call is to be transmitted, that is, a drive.

As a result of the check, when the attribute information of the system call is a file creation or file copy command, the volume access control unit 320 checks the volume of the destination from the path information. That is, the volume access control unit 320 may check the destination and the volume of the destination from the route information. If the destination is a portable storage medium 20, the volume of the destination is a removable drive volume.

The volume access control unit 320 may check the policy set for the volume of the removable drive from the access right policy provided from the policy provider 330. As a result of the check, when the access right policy is set to block the volume of the removable drive, the volume access control unit 320 may block the system call from being transmitted to the kernel layer. As a result, the system call cannot be transmitted to the portable storage medium 20. In addition, the volume access control unit 320 reports to the application unit 310 that the transmission of the system call is blocked.

On the other hand, if the policy set for the volume of the removable drive is allowed, the volume access control unit 320 may transmit a system call to the kernel layer. As a result, the system call is transferred to the portable storage medium 20 to perform the corresponding operation. The volume access control unit 320 may be installed in the kernel layer of the host device 300 in the form of '* .sys'.

The policy provider 330 may monitor a volume change of the file system and provide an access right policy to the volume access controller 320. To this end, the policy provider 330 sets and stores a policy for blocking or permitting transmission of a system call for each drive or for each drive volume. As described with reference to FIG. 1, a user may manually set a policy or a policy program may automatically set a policy in consideration of characteristics of each volume. In the case of automatic setting, the policy program can prevent information leakage by setting the blocking to the default value for the medium connected to the mobile driver 363.

For example, when a hard disk drive (HDD) of the host device 300 is partitioned into a C drive and a D drive, the policy provider 330 is set to allow or block an access permission policy for each drive.

In addition, blocking may be set for a volume recognized as a removable drive. Therefore, when a universal serial bus (USB) driver is installed in the host device 300, copying or creation of a file may be blocked for a medium connected through the USB driver.

The policy provider 330 may be installed between the I / O manager 340 and the file system driver 350 in the kernel layer in the form of '* .exe'. The policy of the policy provider 330 may be provided by smss.exe described above. In addition, as described above, the policy content may be changed by a user or an administrator.

The I / O manager 340 is responsible for input / output in the kernel, and may transmit a system call input from the volume access control unit 320 to a driver of a corresponding volume.

The file system driver 350 is a device driver that implements a file system in the kernel. The file system driver 350 controls the HDD driver 361, the CD-ROM driver 362, or the removable driver 363 to read the corresponding file or to read each driver 361. Files can be copied to a storage medium corresponding to.

The HDD driver 361 of the driver unit 360 is a driver for driving an HDD installed in the host device 300, and the CD-ROM driver 362 is a driver for driving an optical disc such as a CD or a DVD. 363 is a driver for driving a USB memory (eg, portable storage medium 20). When the portable storage medium 20 is connected through the removable driver 363, the portable storage medium 20 is recognized as a removable storage medium, that is, a USB memory. Thus, a removable drive volume is assigned to the portable storage medium 20.

4 is a flowchart illustrating an information leakage blocking method of a host device according to another exemplary embodiment.

Referring to FIG. 4, in operation 400, the host device 300 may allocate a removable drive volume to the portable storage medium 20 connected to the host device 300.

In operation 410, the volume access controller 320 may hook a system call output from the application unit 310 to the kernel layer.

In step 420, the volume access control unit 320 may analyze the hooked system call and check the property information and the path information of the system call.

In operation 430, if the attribute information of the system call is a file creation or file copy command, and if the destination included in the system call path information is a removable drive in operation 440, the volume access control unit 320 may determine an access right policy in operation 450. You can check the policy set for the volume of the removable drive by comparing it with the confirmed removable drive.

If the access right policy set in step 460 is blocked, in step 470, the volume access control unit 320 may block the system call from being transmitted to the kernel layer. As a result, the system call does not have access to the portable storage medium 20.

In operation 480, the volume access control unit 320 may report to the application unit 310 that transmission of the system call is blocked.

On the other hand, if the attribute information is not a file creation or file copy command in step 430, in step 490, the volume access control unit 320 may transmit a system call to the kernel layer.

In addition, if the destination included in the path information is not a removable drive in step 440, the volume access control unit 320 may perform step 490 even when the property information is a file creation or file copy command.

In addition, if the access right policy confirmed in step 460 is allowed, even if the attribute information is a file creation or file copy command, and the destination of the system call is a removable drive, the volume access control unit 320 may perform step 490. .

According to the above-described embodiment, when a system call such as copying a file or generating a file occurs in the portable storage medium 20 that is recognized as a removable disk, the system call is transferred to the portable storage medium 20 according to a preset access right policy. May be blocked. As a result, it is possible to prevent information leakage such as file copying and file generation from the host device 300 to the portable storage medium 20.

The method according to the present invention can be implemented in the form of program instructions that can be executed by various computer means and recorded on a computer readable medium. The computer readable medium may include a program command, a data file, a data structure, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

1 is a block diagram illustrating a host device according to an embodiment of the present disclosure;

2 is a flowchart illustrating a method of blocking information leakage of a host device according to an embodiment of the present disclosure;

3 is a block diagram illustrating a host device according to another proposed embodiment, and

4 is a flowchart illustrating an information leakage blocking method of a host device according to another exemplary embodiment.

Claims (17)

Hooking a system call transferred from an application of the host device to a kernel when a portable storage medium is connected to the host device; Determining whether the hooked system call is to be transmitted to the portable storage medium through a virtual port; And Blocking transmission of the system call according to a determination result Information leakage blocking method of the host device comprising a. The method of claim 1, The determining step, Analyzing a handle included in the system call to identify a port for transmitting the system call; And Confirming the type of the port set for the identified port; Including; If the identified port type is the virtual port, blocking the transmission of the system call. 3. The method of claim 2, Checking the access right policy set for the identified port; More, The information leakage blocking method of the host device to block the transmission of the system call, if the set access right policy is blocked. The method of claim 3, wherein The set access right policy is a change information blocking method of the host device. The method of claim 1, And notifying the application that the transmission of the system call is blocked. The method of claim 1, When the portable storage medium is connected to the host device, generating a system call by the sink program for the portable storage medium installed in the host device; Information leakage blocking method of the host device further comprising. The method of claim 6, The system call is one of the creation and copying of the file information leakage blocking method of the host device. The method of claim 1, The portable storage medium, the information leakage blocking method of the host device provided in the mobile terminal or a smart phone. Connecting the host device to the portable storage medium; Hooking a system call from an application of the host device to the portable storage medium; Checking attribute information of the hooked system call; And Blocking delivery of the system call according to the identified attribute information Information leakage blocking method of the host device comprising a. The method of claim 9, After the step of connecting, assigning a removable drive volume to the connected portable storage medium Information leakage blocking method of the host device further comprising. The method of claim 10, The allocating step may include: recognizing the portable storage medium as a universal serial bus (USB) removable disk and allocating the removable drive volume. The method of claim 10, Identifying a destination of the system call from route information included in the system call; And If the destination is the portable storage medium recognized as a removable drive, confirming an access right policy set for the removable drive More, And if the identified access right policy is blocked, blocking access to the portable storage medium. The method of claim 9, And notifying the application that the transmission of the system call is blocked. The method of claim 9, Prior to the analyzing, hooking a packet transmitted from the application to the kernel further comprising the step of (hooking). The method of claim 9, And the system call is a copy command of a file stored in the host device. The method of claim 9, The portable storage medium, the information leakage blocking method of the host device provided in the mobile terminal or a smart phone. A computer-readable recording medium for recording a program for executing the method of any one of claims 1 to 16 on a computer.

Images