KR20190006633A - Security management system and method, and server for executing the same - Google Patents

Abstract

Provided are a security management system and method, and a server for executing the same. The server according to an embodiment of the present invention comprises: an event management unit which receives information about an event from a legacy system, sets a code corresponding to the event according to as a user inputs and a security policy corresponding to the set code, and shares the code with the legacy system; and a policy application unit which sets a security policy corresponding to the code as an execution policy when the code is called from the legacy system, and transmits information on the execution policy to a user terminal.

Description

TECHNICAL FIELD [0001] The present invention relates to a security management system and method, and a server for performing the security management system and method.

Embodiments of the invention relate to security management techniques.

Enterprise Mobility Management (EMM) is one of the mobile security solutions for enterprises that cover the functions of existing Mobile Device Management (MDM) and Mobile Application Management (MAM). In recent years, as the use of mobile terminals has become common, BYOD (Bring Your Own Device), which enables employees to use individual terminals for work, and COPE (Company -issued, and Personal Enabled).

However, as such personal terminals are used together for business and personal purposes, concerns about corporate confidentiality leakage are also increasing. Accordingly, there is a growing demand for control functions of hardware such as a WiFi module of a terminal, a camera, a microphone, and a GPS module, and control functions of enterprise applications such as e-mail, messenger, and in-house system required for business.

Conventionally, there has been a problem in that a security policy to be applied by the administrator is directly sent to the terminal or the security policy applied to the terminal must be manually changed for controlling the hardware and the application.

Korean Patent Registration No. 10-1731312 (Apr. 24, 2014)

Embodiments of the present invention are intended to provide a means for efficiently applying a security policy to a terminal in cooperation with an external system.

According to an exemplary embodiment of the present invention, there is provided a system for receiving information on an event from a system of a base station, setting a code corresponding to the event and a security policy corresponding to the event according to a user's input, And an event management unit And a policy application unit configured to set a security policy corresponding to the code as an execution policy when the code is called from the subsystem, and to transmit information on the execution policy to the terminal.

The policy application unit may change the execution policy to a set basic policy when the calling of the code ends.

The information about the event may include at least one of an identification code of the event defined in the subsystem and conditions under which the event is triggered.

The event management unit may receive a priority of a plurality of security policies from the user.

According to another exemplary embodiment of the present invention, the server described above; And a terminal that receives at least one of the plurality of security policies from the server and executes at least one of the security policies considering a priority of security policies corresponding to each event when a plurality of events are triggered A security management system is provided.

Wherein each of the security policies includes detailed policies for a plurality of detailed items, and the terminal executes the security policy having the highest priority among the security policies, wherein the security policy having the highest priority If there is a sub-item for which the sub-policy is not set among the sub-items, the detailed policy of the security policy having the highest priority among the security policies for which the detailed policy for the sub-item is set can be executed for the sub-item.

According to another exemplary embodiment of the present invention, there is provided an event management method comprising the steps of: receiving information on an event from a subsystem; Setting, in the event management unit, a code corresponding to the event and a security policy corresponding to the code according to a user's input; Sharing the code with the main system in the event management unit; Setting a security policy corresponding to the code as an execution policy when the code is called from the subsystem; And in the policy application section, transmitting information on the execution policy to the terminal.

The security management method may further include a step of, when the code is called, setting a security policy corresponding to the code as an execution policy, and then, when the calling of the code is terminated, And a step of modifying the data.

The information about the event may include at least one of an identification code of the event defined in the system of the subsystem and a condition under which the event is triggered.

The security management method may further include a step of receiving, from the user, a priority for a plurality of security policies in the event management unit after the setting of the security policy.

The security management method includes: receiving information on the priority from the server at the terminal after receiving the priority from the user; And executing at least one of the security policies by considering the priority of the security policies corresponding to each event when a plurality of events are triggered in the terminal.

Wherein each of the security policies includes detailed policies for a plurality of detailed items, and the step of executing at least one of the security policies comprises: executing the security policy having the highest priority among the policies, When there is a detail item of the security policy having the highest priority among the detailed items of the security policy for which the detailed policy is not set, You can run a detailed policy.

According to the embodiments of the present invention, an event-based security policy is applied to a terminal in cooperation with an external system, thereby enabling efficient control of hardware and applications in the terminal.

In addition, according to embodiments of the present invention, when a plurality of events are triggered, at least one of the security policies is executed in consideration of the priority of security policies corresponding to each event, It is possible to efficiently apply the present invention.

1 is a block diagram showing a detailed configuration of a security management system according to an embodiment of the present invention;
2 is a block diagram showing a detailed configuration of a server according to an embodiment of the present invention;
3 is a flowchart illustrating a process of setting a code corresponding to an event in the event management unit according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a process of setting a code corresponding to an event in the event management unit according to an embodiment of the present invention.
5 is a diagram illustrating a state in which a policy corresponding to a code called from a periodic system according to an embodiment of the present invention is applied;
6 is a diagram illustrating a state in which the above-mentioned basic policy is applied after the calling of the code is terminated from the subsystem system according to an embodiment of the present invention
7 is a diagram illustrating an example of a priority order of security policies set in the event management unit according to an embodiment of the present invention.
8 is a diagram illustrating a process of applying a security policy in consideration of a priority order of a UE according to an embodiment of the present invention.
9 is a diagram illustrating a process of applying a security policy in consideration of a priority of a terminal according to an embodiment of the present invention.
10 is a diagram illustrating a process of applying a security policy in consideration of a priority of a terminal according to an embodiment of the present invention.
11 is a flowchart illustrating a security management method according to an embodiment of the present invention.
Figure 12 is a block diagram illustrating and illustrating a computing environment including a computing device suitable for use in the exemplary embodiments.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification. The terms used in the detailed description are intended only to describe embodiments of the invention and should in no way be limiting. Unless specifically stated otherwise, the singular form of a term includes plural forms of meaning. In this description, the expressions "comprising" or "comprising" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, Should not be construed to preclude the presence or possibility of other features, numbers, steps, operations, elements, portions or combinations thereof.

1 is a block diagram showing a detailed configuration of a security management system 100 according to an embodiment of the present invention. 1, the security management system 100 according to an embodiment of the present invention includes a subsystem 102, a server 104, and a terminal 106. [

A legacy system (102) provides various information to the server (104) in cooperation with the server (104). The main system 102 may be, for example, an access management system, an e-mail management system, an electronic approval system, or the like, but the type of the main system 102 is not particularly limited. The timeline system 102 may be coupled to the server 104 via a network (not shown). Although only one time base system 102 is illustrated in FIG. 1 for convenience of explanation, a plurality of base system 102 of different types may be connected to the server 104 through a network.

The timeline system 102 may provide information about the set event to the server 104. Here, an event refers to an occurrence of an operation, an action, or an event triggered when a set condition is satisfied. In the present embodiments, the event may be generated by satisfying the condition set in the subsystem 102, or may be generated by detecting a condition set at the terminal 106 as described later. Each event system 102 may generate event information for each event system 102 based on events of the same type, and each event system 102 may send information about events managed by the event system 102 to the server 104 ). Here, the information on the event may be, for example, information on the name and type of the event, the identification code of the event defined in the system 102, and the conditions under which the event is triggered.

The server 104 determines the security policy to be applied to the terminal 106 in conjunction with the subsystem 102. The server 104 may be, for example, an Enterprise Mobility Management (EMM) server. As described above, the server 104 can receive information about the event from the main system 102.

In addition, the server 104 may set a code corresponding to the event and a security policy corresponding to the code according to an input of a user (i.e., an administrator of the server 104). As an example, when the server 104 receives the identification code " abcd00 " of the event A from the main system 102, the user can access the event A through the user interface (not shown) Quot; CASE 1 ", the type " customization ", the code " 0x01 ", and the like. That is, the server 104 may set the name, type, code, application policy, and the like of the event input from the system 102 based on the input of the user. In addition, the server 104 generates a "code-in" parameter for calling the code and a "code-out" for terminating the calling of the code in the course of generating the code Parameters can be defined individually. The server 104 sends these information to the subscriber system 102 by sending the event code (e.g., " 0x01 "), code-in parameter, code- 102).

Thereafter, when the event is triggered in the timeline system 102, the timeline system 102 may invoke a code (e.g., " 0x01 ") of the event set at the server 104. [ The subscription system 102 may invoke the code of the event, for example, by calling the code-in parameter.

When the code is called from the periodic system 102, the server 104 may set the security policy corresponding to the code as an execution policy. As an example, when the code "0x01" is called from the main system 102, the server 104 may set the "camera lock on terminal" policy corresponding to the code to the execution policy. The server 104 may transmit information about the set execution policy to the terminal 106 and the terminal 106 may execute the execution policy with reference to the information. In the above example, when the " camera lock of terminal " policy is executed, the camera of the terminal 106 can be switched to the locked state.

In addition, when triggering on the event is terminated in the subsystem 102, the subsystem 102 may terminate the invocation of the code, for example, by calling the code-out parameter.

When the calling of the code ends, the server 104 can set the set basic policy to the execution policy. As an example, if the call to code " 0x01 " is terminated, the server 104 may change the currently applied " camera lock on terminal " The server 104 may send information regarding the changed execution policy to the terminal 106 and the terminal 106 may execute the changed execution policy with reference to the changed execution policy. In this case, in the above example, the camera of the terminal 106 can be switched to the unlocked state, and a changed execution policy, for example, a "camera allowed" policy, a "allow microphone" policy,

In addition, the server 104 manages a plurality of security policies, and can receive a priority of each security policy from a user. Here, the security policies managed by the server 104 include not only security policies corresponding to the events input from the periodic system 102 but also security policies corresponding to the events triggered by detecting the conditions set at the terminal 106 can do. The server 104 may receive a priority of a plurality of security policies from the user and may transmit information on the priority to the terminal 106. [ The terminal 106 may execute at least one of the security policies in consideration of the priority of the security policies corresponding to each event when a plurality of events are triggered.

The terminal 106 may be a device to which the above-described security policies are applied, for example, a wearable device such as a smart phone, a tablet PC, a notebook, and a smart watch that can be used together for a user's business purpose or personal use. The terminal 106 may be equipped with hardware such as a wireless Internet (WiFi) module, a camera, a microphone, and a GPS module, and various applications such as an email, a messenger, and an in-house system required for business.

As described above, the terminal 106 may receive information about the execution policy from the server 104 and execute the execution policy received.

In addition, the terminal 106 can detect the occurrence of various events according to the set conditions. As an example, the terminal 106 may sense the occurrence of an event " testTime " if the current time falls within a certain time range. As another example, the terminal 106 may detect the occurrence of an event " testApp " As another example, the terminal 106 may detect the occurrence of an event " testWiFi " when the terminal 106 accesses a specific Wi-Fi SSID (Service Set Identifier). As another example, the terminal 106 may detect the occurrence of an event " testSim " when the U-SIM of the terminal 106 is changed. In this manner, the terminal 106 can detect the occurrence of various events triggered when the set condition is satisfied. One or more pre-defined security policies may be mapped to the respective events. In addition, as described above, in the case of an event input from the system 100, one or more security policies set by the user may be mapped.

Examples of the above-described event and the security policy mapped to each event are shown in Table 1 below.

Policy
event Camera policy Wi-Fi policy Microphone policy testUser prohibition Not set prohibition testApp permit prohibition prohibition testGate permit permit permit testTime permit permit prohibition General permit Not set prohibition

At this time, each of the security policies mapped to each event includes detailed policies (e.g., camera policy, Wi-Fi policy, microphone (s)) for a plurality of detailed items Policy).

Here, the " testUser " event is an event set by the user. The " camera prohibited " policy, the " Wi-Fi not set " The " testApp " event may also be mapped to a " camera allowed " policy, a " Wi-Fi prohibited " In addition, the " testGate " event may be an event set by the user in connection with gate entry, and may be mapped " camera allowed ", " Wi-Fi allowed " In addition, the " testTime " event is an event that is detected by the terminal 106 in relation to time, and may be mapped to a " camera allowed " policy, a " Wi-Fi allowed " Also, the " General " event is a set basic event, and a basic policy such as a " camera allowance " policy, a " Wi-Fi not set "

If a plurality of events are triggered, the terminal 106 may execute all the security policies corresponding to the triggered events (i.e., execute the security policies corresponding to the triggered events in combination). At this time, when the security policies corresponding to the triggered event are both compatible and unfeasible (for example, the security policies corresponding to the triggered event each include the "camera prohibited" policy and the "camera allowed" policy) 106 may execute at least one of the security policies taking into account the priority of the security policies corresponding to each event.

More specifically, the terminal 106 executes the security policy having the highest priority among the policies, and when there is a detail item of the security policy having the highest priority among the details of the security policy, The detailed policy of the security policy having the highest priority among the security policies in which the detailed policy for the detailed item is set can be executed for the item.

2 is a block diagram showing a detailed configuration of a server 104 according to an embodiment of the present invention. 2, the server 104 according to an exemplary embodiment of the present invention includes a first interface 202, an event management unit 204, a policy application unit 206, and a second interface 208 .

The first interface 202 is a module for transmitting and receiving data to and from the main system 102. The server 104 can transmit and receive various data to and from the system 102 through the first interface 202. [ For example, the server 104 may receive information about the event from the critical system 102 via the first interface 202. For example,

The event management unit 204 manages events and policies. When information on an event is input from the main system 102 through the first interface 202, the event management unit 204 can set the name, type, code, application policy, and the like of the event according to the input of the user . In addition, the event management unit 204 may define a "code-in" parameter for calling the code and a "code-out" parameter for terminating the calling of the code in the course of generating the code. The event management unit 204 may share the code, the "code-in" parameter, the "code-out" parameter, etc., with the critical system 102 via the first interface 202.

In addition, the event management unit 204 may receive a priority of a plurality of security policies from a user.

The policy application unit 206 sets a security policy corresponding to the code as an execution policy when a code is called from the main system 102 and transmits information about the execution policy set through the second interface 208 to the terminal 106 ).

As an example, when the code " 0x01 " is called from the period system 102, the policy application unit 206 sets the " camera lock of terminal " policy corresponding to code " 0x01 " To the terminal 106, information regarding the execution policy set through the terminal 208.

In addition, the policy application unit 206 may set the set basic policy as an execution policy when the call of the code ends, and may transmit information on the execution policy set through the second interface 208 to the terminal 106 .

As an example, when the call of the code " 0x01 " ends, the policy application unit 206 changes the currently applied execution policy to the basic policy set in the " camera lock of terminal " policy, To the terminal 106, information regarding the changed execution policy.

The second interface 208 is a module for transmitting and receiving data with the terminal 106. The server 104 can transmit and receive various data to and from the terminal 106 via the second interface 208. For example, the server 104 may send information about the execution policy to the terminal 106 via the second interface 208.

FIG. 3 and FIG. 4 illustrate a process of setting a code corresponding to an event in the event management unit 204 according to an embodiment of the present invention.

3, the user sets a name "CASE 1", a type "user specified", a code "0x01", etc. for the event A through the user interface provided by the server 104, Camera lock "policy can be mapped.

4, the user sets a name "CASE 2", a type "custom designation", a code "0x02", etc. for the event B through the user interface provided by the server 104, Quot; permit microphone of the terminal " policy.

FIG. 5 is a diagram illustrating a state in which a policy corresponding to a code called from a subscription system 102 according to an embodiment of the present invention is applied. FIG. This is an example of a state in which the set policy is applied after the call of the code is terminated.

5, when event A is triggered in the subsystem 102 and a code-in parameter corresponding to event A (i.e., "CASE 1" in the example above) is called from the subsystem 102, 104 may determine the security policy corresponding to the event A as an execution policy and the security policy corresponding to the event A may be applied to the terminal 106. [

6, when a code-out parameter corresponding to event A (i.e., " CASE 1 " in the example above) is called from the period system 102, the server 104 sets the default policy, And thus the basic policy can be applied to the terminal 106. [

FIG. 7 is a diagram illustrating priorities of security policies set by the event management unit 204 according to an embodiment of the present invention. As described above, the event management unit 204 can receive a priority from a user regarding a plurality of security policies.

7, a security policy corresponding to "testUser", a security policy corresponding to "testApp", a security policy corresponding to "testSim", a security policy corresponding to "testGate", a security policy corresponding to "testTime" And "testWiFi" are set to 1, 2, 3, 4, 5 and 6, respectively.

8 to 10 illustrate a process of applying a security policy in consideration of a priority order of a terminal 106 according to an embodiment of the present invention.

As described above, when a plurality of events are triggered, the terminal 106 can execute all the security policies corresponding to the triggered event. At this time, when the security policies corresponding to the triggered event are both compatible and unfeasible (for example, the security policies corresponding to the triggered event each include the "camera prohibited" policy and the "camera allowed" policy) 106 may execute at least one of the security policies taking into account the priority of the security policies corresponding to each event.

Referring to FIG. 8, the terminal 106 may execute a default policy set prior to the triggering of an event: a "camera allowed" policy, a "Wi-Fi not set" policy, Accordingly, the use of the camera of the terminal 106 is allowed and the use of the microphone of the terminal 106 is prohibited.

9, when the "testGate" event and the "general" event are triggered, the terminal 106 can execute both the security policy corresponding to the "testGate" event and the security policy corresponding to the "General" event have. At this time, in the case of the Wi-Fi module and the microphone, since the security policy corresponding to the "testGate" event differs from the security policy corresponding to the "general" event, the terminal 106 transmits the security corresponding to the " Policy, the "Wi-Fi allowed" policy, and the "Allow microphone" policy. Accordingly, use of the camera, Wi-Fi module, and microphone of the terminal 106 is allowed.

10, when the "testUser" event, the "testGate" event and the "general" event are triggered, the terminal 106 transmits a security policy corresponding to the "testUser" event, a security corresponding to the "testGate" Policy, and security policy corresponding to " General " event. At this time, because the security policies corresponding to the triggered event are both compatible and can not be executed, the terminal 106 can execute the security policy corresponding to the event having the highest priority "testUser". If there is a sub-item for which detailed policy is not set among sub-items of the security policy corresponding to the event having the highest priority "testUser", the terminal 106 stores the details It is possible to execute the detailed policy of the security policy having the highest priority among the security policies to which the policy is set. In the above example, since the detailed policy is not set for the Wi-Fi module among the details of the security policy corresponding to the " testUser " event, the terminal 106 determines whether the detailed policy for the Wi- Wi-Fi security policy, i.e., " Wi-Fi allowed " policy, corresponding to the highest priority " testGate " event. Accordingly, the use of the camera 106 and the microphone 106 is prohibited, and the use of the Wi-Fi module is permitted.

11 is a flowchart illustrating a security management method according to an embodiment of the present invention. In the illustrated flow chart, the method is described as being divided into a plurality of steps, but at least some of the steps may be performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, One or more steps may be added and performed.

In step S102, the timeline system 102 sends information about the event to the server 104. [ The information on the event may be, for example, information on the name and type of the event, the identification code of the event defined in the system 102, the condition under which the event is triggered, and the like.

In step S104, the server 106 sets a code corresponding to the event and a security policy corresponding to the code according to a user's input.

In step S106, the server 106 shares the set code with the period system 102. [ At this time, the server 106 may share a "code-in" parameter for calling the code and a "code-out" parameter for terminating the calling of the code.

In step S108, the subsystem 102 calls the code via the code-in parameter.

In step S110, the server 104 sets the security policy corresponding to the called code as an execution policy.

In step S112, the server 104 transmits information on the set execution policy to the terminal 106. [

In step S114, the terminal 106 executes the execution policy. If a plurality of events are triggered, the terminal 106 executes all the security policies corresponding to the triggered event, and if the security policies corresponding to the triggered events are both compatible and impossible to execute, And execute at least one of the security policies in consideration of the priority.

In step S116, the subsystem 102 terminates the call of the code through the code-out parameter.

In step S118, the server 104 changes the set basic policy to the execution policy.

In step S120, the server 104 transmits information on the changed execution policy to the terminal 106. [

In step S122, the terminal 106 executes the execution policy.

12 is a block diagram illustrating and illustrating a computing environment including a computing device suitable for use in the exemplary embodiments. In the illustrated embodiment, each of the components may have different functions and capabilities than those described below, and may include additional components in addition to those described below.

The illustrated computing environment 10 includes a computing device 12. In one embodiment, the computing device 12 may be one or more components included in the subsystem 102, the server 104, or the terminal 106.

The computing device 12 includes at least one processor 14, a computer readable storage medium 16, The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiment discussed above. For example, processor 14 may execute one or more programs stored on computer readable storage medium 16. The one or more programs may include one or more computer-executable instructions, which when executed by the processor 14 cause the computing device 12 to perform operations in accordance with the illustrative embodiment .

The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, the computer-readable storage medium 16 may be any type of storage medium such as a memory (volatile memory such as random access memory, non-volatile memory, or any suitable combination thereof), one or more magnetic disk storage devices, Memory devices, or any other form of storage medium that can be accessed by the computing device 12 and store the desired information, or any suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12, including processor 14, computer readable storage medium 16.

The computing device 12 may also include one or more input / output interfaces 22 and one or more network communication interfaces 26 that provide an interface for one or more input / output devices 24. The input / output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input / output device 24 may be connected to other components of the computing device 12 via the input / output interface 22. The exemplary input and output device 24 may be any type of device, such as a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touch pad or touch screen), a voice or sound input device, An input device, and / or an output device such as a display device, a printer, a speaker, and / or a network card. The exemplary input and output device 24 may be included within the computing device 12 as a component of the computing device 12 and may be coupled to the computing device 12 as a separate device distinct from the computing device 12 It is possible.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I will understand. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

10: Computing environment
12: computing device
14: Processor
16: Computer readable storage medium
18: Communication bus
20: Program
22: I / O interface
24: input / output device
26: Network communication interface
100: Security Management System
102: The system of the period system
104: Server
106: terminal
202: First interface
204: Event management unit
206: Policy application section
208: Second interface

Claims (12)

An event management unit for receiving information on an event from a main system and setting a code corresponding to the event and a security policy corresponding to the event in accordance with an input of a user and sharing the code with the system; And
And a policy application unit configured to set a security policy corresponding to the code as an execution policy when the code is called from the main system, and to transmit information on the execution policy to the terminal.
The method according to claim 1,
Wherein the policy application unit changes the execution policy to a set basic policy when the calling of the code is terminated.
The method according to claim 1,
Wherein the information about the event comprises at least one of an identification code of the event defined in the subsystem and a condition under which the event is triggered.
The method according to claim 1,
Wherein the event management unit receives a priority from a user regarding a plurality of security policies.
A server according to any one of claims 1 to 4; And
And a terminal for receiving at least one of the security policies from the server in response to a priority of a plurality of security policies and considering a priority of security policies corresponding to each event when a plurality of events are triggered , Security management system.
The method of claim 5,
Each of the security policies comprising detailed policies for a plurality of details,
The terminal executes the security policy having the highest priority among the security policies, and when there is a detail item in which the detailed policy is not set among the details of the security policy having the highest priority, The detailed policy of the security policy having the highest priority among the security policies for which the detailed policy for the detailed item is set is executed.
Receiving information on an event from the system of the base station in an event management unit of the server;
Setting, in the event management unit, a code corresponding to the event and a security policy corresponding to the code according to a user's input;
Sharing the code with the main system in the event management unit;
Setting a security policy corresponding to the code as an execution policy when the code is called from the subsystem; And
And transmitting, at the policy application unit, information on the execution policy to the terminal.
The method of claim 7,
After the step of setting the security policy corresponding to the code as the execution policy when the code is called,
And changing the execution policy to a set basic policy when the calling of the code is terminated in the policy application section.
The method of claim 7,
Wherein the information about the event includes at least one of an identification code of the event defined in the subsystem and a condition under which the event is triggered.
The method of claim 7,
After setting the security policy,
Further comprising receiving, at the event management unit, a priority of a plurality of security policies from the user.
The method of claim 10,
After receiving the priority from the user,
Receiving, at the terminal, information on the priority order from the server; And
Further comprising the step of executing at least one of the security policies by considering the priority of security policies corresponding to each event when a plurality of events are triggered in the terminal.
The method of claim 11,
Each of the security policies comprising detailed policies for a plurality of details,
Wherein the step of executing at least one of the security policies comprises: executing a security policy having the highest priority among the policies, wherein, among the detailed items of the security policy having the highest priority, The detailed policy of the security policy having the highest priority among the security policies for which the detailed policy for the detailed item is set is executed for the detailed item.

Images