KR20170000286A - File security method by using system information - Google Patents

Abstract

The present invention relates to a file security method by using system information, a computer program for executing said file security method, and a recording medium which can be read by a computer with said program stored. The disclosed file security method includes the following steps: acquiring system information about an information processing device on which a security file is stored and then storing as initial system information when a first security file execution is attempted; checking system information of a current information processing device on which a security file is stored when a security file execution is attempted; determining, based on the initial system information, whether or not the checked system information about the current information processing device meets predetermined file execution conditions; and permitting the execution of the security file if the predetermined file execution conditions are met. Accordingly, even if a security file is provided to an information processing device such as a computer having an environment in which there is no DRM module, there is an advantage in that security regarding the security file can be achieved by using system information.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a file security method using system information,

The present invention relates to file security, and more particularly, to a file security method for securing a file using system information of an information processing device, a computer program for performing such a file security method, To a recording medium on which the recording medium can be recorded.

Recently, security has become an important issue not only in corporations but also in public institutions such as government and research institutes. In particular, the importance of security for attacks on networks, as well as for documents created inside the organization (electronic documents created by electronic information processing devices (computers, mobile devices, etc.), not normally written documents) It is getting bigger. In the case of companies, information about new products and confidential information are leaked out to competitors, or they are seriously damaged due to leakage of sensitive information on the outside. In particular, there are many cases in which information about new products or services provided to customers for B2B business in the inter-company transactions is passed to the competitor through the relevant company and the competitive products are produced.

According to the related art, since the generated document is encrypted by the document security program of the company and is authenticated on the company internal network, the document is accessed. Therefore, when the document is normally transmitted to the outside It is normal to release this security application.

In such a case, the leaked document can be provided to a third party without any restriction, thereby causing a serious problem in document security.

Korean Patent Registration No. 0750697, filed on August 13, 2007.

According to an embodiment of the present invention, there is provided a file security method for achieving security for a file using system information of an information processing apparatus attempting to execute the file, a computer program for performing the file security method, As a recording medium.

The problems to be solved by the present invention are not limited to those mentioned above, and another problem to be solved can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a file security method using system information, comprising the steps of: acquiring system information of an information processing device in which a security file is stored when initial security file execution is attempted and storing the system information as initial system information; Determining whether the system information of the current information processing apparatus that has been confirmed conforms to a predetermined file execution condition based on the initial system information; And allowing the execution of the security file if the file execution condition is satisfied.

According to the embodiment of the present invention, it is determined whether or not the system information of the information processing apparatus attempting to execute the file matches with the file execution condition according to the comparison result of the file execution with the system information allowed in advance, Allow.

In addition, when the execution of the file is the first attempt, the system information of the information processing apparatus is obtained, and if the execution of the file is attempted several times, the execution of the file can be selectively permitted only to the first executed information processing apparatus.

Accordingly, even when a security file is provided to an information processing device such as a computer having an environment without a DRM (Digital Rights Management) module, the security for the security file can be achieved by using the system information.

1 is a configuration diagram of an information processing apparatus capable of executing a file security method using system information according to an embodiment of the present invention.
2 is a flowchart illustrating a file security method using system information according to an embodiment of the present invention.
3 is a flowchart illustrating a file security method using system information according to another embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

1 is a configuration diagram of an information processing apparatus capable of executing a file security method using system information according to an embodiment of the present invention.

1 illustrates a case in which the information processing device # 1 110 generates a security file 121 and provides the security file 121 to the information processing device # 2 110. FIG. The information processing device # 1 110 may be implemented by various information communication devices such as a computer, a mobile device, and the like on which the DRM module 111 is mounted. The information processing device # 2 110 may execute a security file 121 such as a document file or the like, and any information communication device may be used if the system manager 122 is installed.

As shown in the figure, an information processing device such as a computer that can be used in the file security method according to an embodiment of the present invention includes an information processing device # 1 110 on which the DRM module 112 is mounted, 2 (120).

The information processing device # 1 110 in which the DRM module 112 is installed may further include an application program 112, a system DLL 113, an OS kernel 114, and the like.

The information processing device # 2 120 without the DRM module can achieve security for the security file 121 without using the DRM module. The information processing device 120 may include a system manager 122, an application program 123, an OS (Operating System) kernel 124, and the like.

When the specific application program 112 installed in the information processing device # 1 110 is executed, the DRM module 111 causes the system DLL 113 to be loaded automatically, The controller of the DRM module 111 controls the function of the application program 112 by hooking the system API (application programming interface) of the OS kernel 114 used by the DRM module 112.

The system API of the OS kernel 114 used in the application program 112 can be connected to the application program 112 only through the DRM module 111. [ Therefore, in an environment where the DRM module 111 is not present, the application program 112 can not access the security document or the like to which the security DRM is applied.

On the other hand, if the information processing device # 1 110 selects an external transfer function for a security file such as a security document to which a secure DRM is applied, the DRM module 111 generates a code capable of executing the file security method according to the embodiment of the present invention The security file 121 is generated.

2 is a flowchart illustrating a file security method using system information according to an embodiment of the present invention.

As shown in the figure, the file security method according to an embodiment includes steps (S201 to S205) of checking system information of an information processing device when an attempt is made to execute a security file.

The method further includes steps (S207 to S211) for determining whether the confirmed system information conforms to a predetermined file execution condition. Here, when the execution of the security file is the first attempt, the confirmed system information is stored as the initial system information (S208), and it can be determined that the file satisfies the file execution condition. If an attempt is made to execute the security file thereafter, the system information of the current information processing device can be confirmed, and it can be determined based on the minimum system information whether the system information of the currently confirmed information processing device conforms to the predetermined file execution condition . For example, when the execution of the security file is a predetermined number of times or more, it can be determined whether the file satisfies the file execution condition according to the result of comparing the system information of the currently-used information processing apparatus with the previously stored first system information.

Next, the method further includes a step (S213, S215) for allowing execution of the security file if the system information matches the file execution condition, and blocking execution of the security file if the system information does not match.

3 is a flowchart illustrating a file security method using system information according to another embodiment of the present invention.

As shown in the figure, the file security method according to another embodiment includes steps (S301 to S305) of confirming system information of the information processing device when an attempt is made to execute a security file.

The method further includes steps (S307, S309) for determining whether the confirmed system information conforms to a predetermined file execution condition. At the time of generation of the security file, the pre-stored system information is loaded and it can be determined whether or not the system information matches the file execution condition according to the result of comparison with the system information confirmed in step S205.

Next, the method further includes steps (S313 and S315) for allowing the execution of the security file if the system information matches the file execution condition, and blocking the execution of the security file if the system information does not match.

Hereinafter, a process in which the security file 121 generated by the information processing device # 1 110 is transmitted or transferred to the outside and executed in the information processing device # 2 120 will be described.

First, a security method for allowing a security file 121 to be accessed only from a specific device will be described with reference to FIGS. 1 and 2. FIG.

When the execution of the security file 121 (S201) is attempted in the information processing device # 2 (120), the application program 123 is not loaded but connected to the system manager 122 (S203) (S205). ≪ / RTI > Here, the security file 121 may obtain a MAC (Media Access Control) address from the system manager 122. Alternatively, if the information processing device # 2 120 uses a fixed IP (Internet Protocol) network, it may acquire an IP (Internet Protocol) address.

Then, it is determined whether the execution of the security file 121 is an initial attempt or an attempt of more than a preset number of times (S207). For example, the security file 121 may display an identifier in a header or the like when the security file 121 is executed for the first time, and then, when the security file 121 is attempted for the second time or more, confirm that the security file 121 has already been executed based on the identifier. Alternatively, a count value indicating the number of executions may be displayed in a separate field of the header, and when the execution is attempted more than the second time, the execution count may be confirmed through the count value.

When the initial execution of the security file 121 is confirmed, the system information confirmed in step S205 is stored as initial system information (S208), and the execution of the security file is permitted (S213). For example, at this time, a substantial security document is read.

If the execution of the security file 121 beyond the preset number of times, for example, the second execution or more, is confirmed, the system information checked in step S205 after loading the first system information stored in the first execution (S209) And compares it with the system information of the information processing apparatus, and judges whether the file execution condition is satisfied according to the comparison result (S211).

When a MAC (Media Access Control) address is acquired in step S205, it is determined that the MAC address of the currently-processed information processing device matches the preset permitted MAC address, that is, the MAC information of the first system, can do.

Alternatively, when an IP (Internet Protocol) address is acquired in step S205, it is determined that the IP address of the currently processed information processing apparatus matches the preset permitted IP address, that is, the IP address of the first system, Can be distinguished. Here, a predetermined allowable IP address band may be set based on the IP address of the first system, and it may be determined that the file execution condition is satisfied when the IP address obtained in step S205 is included in the set allowable IP address band.

Subsequently, when it is determined in step S211 that the system information matches the file execution condition, the execution of the security file 121 is permitted (S213). For example, at this time, the security document is browsed by the application program 123.

However, if it is determined in step S211 that the system information does not match the file execution condition, the execution of the security file 121 is blocked (S215).

Next, a security method for allowing the security file 121 to be accessed only from a specific network will be described with reference to FIGS. 1 and 3. FIG.

When the security file 121 is created in the information processing device # 1 110, that is, the code capable of executing the file security method according to the embodiment of the present invention is inserted, the information processing device # Set the IP address to the allowed IP address and store it together. Alternatively, the allowed IP address band may be set and stored together.

When the generated security file 121 is executed by the information processing device # 2 120 (S301), the application program 123 is not loaded but connected to the system manager 122 (S303) (S305). ≪ / RTI > Here, the security file 121 may obtain an IP address from the system manager 122.

Then, the system information stored together with the security file 121 is loaded (S307), and the system information is compared with the system information confirmed in step S305, and it is determined whether the system information matches the file execution condition (S309).

Here, it is determined that the IP address obtained in step S305 matches the pre-set allowable IP address to match the file execution condition. Alternatively, if the allowable IP address band is set, it can be determined that the file execution condition is satisfied when the IP address obtained in step S305 is included in the set allowable IP address band.

Subsequently, when it is determined in step S309 that the system information matches the file execution condition, the execution of the security file 121 is allowed (S311). For example, at this time, the security document is browsed by the application program 123.

However, if it is determined in step S309 that the system information does not match the file execution condition, the execution of the security file 121 is blocked (S313).

As described so far, according to the embodiment of the present invention, it is determined whether or not the system information of the information processing apparatus attempting to execute the file matches the file execution condition according to the result of comparison between the system information allowed beforehand and the file execution Allow file execution selectively.

When the execution of the file is the first attempt, the system information of the information processing apparatus is secured and when the execution of the file is tried more than the predetermined number of times, the file execution can be selectively allowed only for the first attempted information processing apparatus have.

Accordingly, even when a security file is provided to an information processing device such as a computer having an environment without a DRM module, the security for the security file can be achieved by using the system information.

Combinations of the steps of the flowcharts appended to the present invention may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which are executed via a processor of a computer or other programmable data processing apparatus, Lt; / RTI > These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible to produce manufacturing items that contain instruction means for performing the functions described in each step of the flowchart. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible for the instructions to perform the processing equipment to provide steps for executing the functions described in each step of the flowchart.

In addition, each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the steps may occur out of order. For example, the two steps shown in succession may in fact be performed substantially concurrently, or the steps may sometimes be performed in reverse order according to the corresponding function.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

According to the embodiment of the present invention, even when a security file is provided to an information processing device such as a computer having an environment without a DRM module, security for the security file can be achieved using the system information.

The present invention can be widely used in the field of security technology for various files including electronic documents.

110, 120: Information processing device 111, 123: Application program
112: DRM module 113: system DLL
114, 124: OS kernel 121: security file
122: System Manager

Claims (6)

Acquiring system information of an information processing device in which a security file is stored when initial security file execution is attempted, and storing the system information as initial system information;
Confirming the system information of the current information processing device in which the security file is stored when an attempt is made to execute the security file,
Determining whether the system information of the identified current information processing device conforms to a predetermined file execution condition based on the initial system information,
And allowing the execution of the security file if the file execution condition is satisfied. The method according to claim 1,
When the execution of the security file is an attempt more than a predetermined number of times, it is determined whether the file information satisfies the file execution condition according to the result of comparing the system information of the present information processing device with the previously stored first system information A file security method using system information. The method according to claim 1,
The system information includes an IP (Internet Protocol) address,
Wherein the file execution condition is a case where the IP address of the current information processing apparatus matches the IP address of the first system information. The method according to claim 1,
The system information includes a Media Access Control (MAC) address,
Wherein the file execution condition is a case where the MAC address of the current information processing device matches the MAC address of the first system information. A computer-readable recording medium storing a program for performing a file security method using the system information according to any one of claims 1 to 4. A computer program for performing a file security method using system information according to any one of claims 1 to 4.

Images