KR20190033800A - Apparatus and method for managing security of video conference data - Google Patents

Abstract

An apparatus and a method for managing security of video conference data are disclosed. According to the present invention, the apparatus for managing security of video conference data comprises: a request receiving unit for receiving a data processing request for video conference data; a right determining unit for determining whether the data processing request is performed based on right information of a user corresponding to the received data processing request; an encrypting and decrypting unit for either performing encrypting or decrypting the data based on a security policy corresponding to the data when it determined that the data processing request is performed; and a data processing unit for processing the encrypted or decrypted data to correspond to the data processing request.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an apparatus and method for security management of data for video conferencing,

More particularly, the present invention relates to a technology for securely storing and managing data for video conferencing, and securely sharing video conferencing data based on security policy and privilege information.

With the recent development of the video conferencing system, the construction and operation of the video conferencing service system connecting the head office and the branch office between the domestic and the overseas has been greatly increased. Here, a video conference system refers to a system in which people in different areas can meet and face each other without having to directly face each other.

Videoconferencing systems can share video, voice, images, texts and other data between users in a company, and can handle their main tasks and make decisions when they are connected to a computer regardless of their geographical location.

When operating a video conferencing system, various data can be shared or created. Although the data generated or distributed in the video conferencing system is often of high importance and security, the existing video conferencing systems are only interested in the conference function for video conferencing, It is structured to entrust.

Further, the storage for managing the existing video conferencing data does not provide a data management method and a security method specialized for video conferencing data, and can not manage data on a conference-by-conference basis dynamically with the video conferencing system, .

Accordingly, there is a need to overcome the limitations and problems of the prior art and to develop a technology that can safely manage the data generated and distributed in the video conferencing system.

Korean Patent Laid-Open No. 10-2015-0080065, published on Jul. 09, 2015 (name: method of generating video data of a video conference and server, method and device for receiving video data of video conference)

It is an object of the present invention to dynamically interwork with a video conference system (video conference service server) to safely manage data generated and shared in a video conference.

It is another object of the present invention to securely share and store data for video conferencing by providing a security management apparatus for video conferencing data separated from the video conferencing system.

It is also an object of the present invention to securely share and manage video conferencing data by distinguishing conference sessions and users.

Further, an object of the present invention is to improve the user's convenience by performing encryption / decryption according to the type and characteristics of the data for video conferencing, and collectively managing keys used for encryption / decryption.

Also, an object of the present invention is to provide an API connection structure considering cloud services, and to be applied to cloud services and various applications.

According to another aspect of the present invention, there is provided an apparatus for managing security for video conferencing, the apparatus comprising: a request receiver for receiving a data processing request for video conferencing data; An encryption decryption unit for decrypting the data based on a security policy corresponding to the data when the decryption unit decides to perform the data processing request; And a data processing unit for processing the encrypted or decrypted data so as to correspond to the data processing request.

At this time, the encryption / decryption unit may identify the type of data corresponding to the data processing request and encrypt / decrypt the data based on the security policy corresponding to the type of the data.

At this time, the security policy may include a first security policy set for each type of data and a second security policy set for each data.

In this case, if both of the first security policy applied as a default and the second security policy set as an option are both set as a default, the encryption / decryption unit preferentially takes the second security policy over the first security policy, The encryption / decryption of the data can be performed based on the security policy.

At this time, the encryption / decryption unit retrieves a secret key corresponding to the data processing request, generates a derivative key based on the secret key and the security policy, and encrypts the data using the generated derivative key Or decryption.

At this time, the data processing request may include at least one of a data upload request, a data inquiry request, a data deletion request, and a data update request for the video conference data.

At least one of the identification information, the user information, and the secret key of the video conference is input to the service management unit to manage the video conference service, and at least one of the user identification information of the video conference service and the user's right information And a user management unit for managing the user of the video conference service.

At this time, the user management unit can receive voting information on the security policy of the video conference data from the user of the video conference service.

At this time, the user management unit may analyze the vote information input from the plurality of users, and may modify the basic security policy when the users whose analysis result thresholds are higher than the default security policy preset for the video conferencing service .

At this time, the video conference data includes at least one of the personal information of the user, the conference video generated at the video conference, the conference voice, voice data shared at the time of video conference, image data, image data and text data, Security data disclosed only to users of the video conference and public data disclosed to all users.

In addition, a method for security management of video conference data performed by a security management apparatus for video conference data according to an embodiment of the present invention includes receiving a data processing request for video conference data, Deciding whether to perform the data processing request based on the user's right information, performing encryption / decryption of the data based on the security policy corresponding to the data when the data processing request is determined to be performed And processing the decrypted data to correspond to the data processing request.

The method of claim 1, further comprising identifying a type of data corresponding to the data processing request, wherein performing encryption / decryption of the data comprises: encrypting or decrypting the data based on the security policy corresponding to the type of the data; It can be decoded.

At this time, the security policy may include a first security policy set for each type of data and a second security policy set for each data.

The encryption / decryption of the data based on the security policy may include: if the first security policy applied as a default and the second security policy set as an option are both set from the user, And decrypt the data based on the second security policy with the second security policy prioritized.

At this time, the step of performing encryption / decryption of the data includes: querying a secret key corresponding to the data processing request; generating a derived key based on the secret key and the security policy; And encrypting or decrypting the data using a key.

At this time, the data processing request may include at least one of a data upload request, a data inquiry request, a data deletion request, and a data update request for the video conference data.

Receiving at least one of identification information, user information, and secret key of the video conference, managing a video conference service, and managing at least one of the user identification information of the video conference service and the user right information And receiving and managing a user of the video conference service.

The step of managing the user of the video conferencing service may include receiving voting information on the security policy of the video conferencing data from the user of the video conferencing service.

The step of managing a user of the video conferencing service may include analyzing the voting information input from the plurality of users, and analyzing the result of the analysis to determine whether the users of the video conferencing service exceed a predetermined basic security policy And modifying the basic security policy.

At this time, the video conference data includes at least one of the personal information of the user, the conference video generated at the video conference, the conference voice, voice data shared at the time of video conference, image data, image data and text data, Security data disclosed only to users of the video conference and public data disclosed to all users.

According to the present invention, it is possible to securely manage data generated and shared at the time of video conference by dynamically interworking with the video conference system (video conference service server).

Further, according to the present invention, it is possible to securely share and store video conference data by providing a security management apparatus for video conference data separated from the video conference system.

Further, according to the present invention, it is possible to securely share and manage video conferencing data by distinguishing a conference session and a user.

Further, according to the present invention, it is possible to improve the user's convenience by performing encryption / decryption according to the type and characteristics of the data for video conferencing, and collectively managing keys used for encryption / decryption.

Also, according to the present invention, an API connection structure considering cloud service can be applied to a cloud service and various applications.

FIG. 1 is a diagram schematically showing an environment to which an apparatus for managing security of video conference data according to an embodiment of the present invention is applied.
2 is a block diagram showing the configuration of a security management apparatus for video conference data according to an embodiment of the present invention.
3 is a flowchart illustrating a security management method for video conferencing data according to an embodiment of the present invention.
4 is a diagram for explaining an API connection structure of a security management apparatus for video conference data according to an embodiment of the present invention.
5 is a diagram for explaining a function of a security management apparatus for video conferencing data according to an embodiment of the present invention.
FIG. 6 illustrates an example of a data processing right for each user according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 7 is an exemplary diagram illustrating a security policy applied to data for video conferencing and data for video conferencing according to an embodiment of the present invention.
FIG. 8 is a flowchart illustrating a process of performing encryption / decryption of data in step S360 of FIG.
9 is a diagram illustrating an example of a key management method and an encryption / decryption method according to an embodiment of the present invention.
10 is a flowchart for explaining a process of modifying a security policy based on voting information according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the understanding of the present invention, the same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

FIG. 1 is a diagram schematically showing an environment to which an apparatus for managing security of video conference data according to an embodiment of the present invention is applied.

1, the video conferencing data security management apparatus 200 may be connected to the video conferencing service server 100 and the remote user system 300 according to an embodiment of the present invention.

Here, the video conferencing service server 100 refers to a video conferencing application server that executes a video conferencing application and provides a video conferencing service, and the remote user system 300 refers to a client system that uses a video conferencing service.

First, the video conferencing service server 100 manages one or more conference sessions and users, stores conference contents (data) corresponding to each conference session, and stores the generated and distributed data .

In particular, the video conferencing service server 100 is capable of managing conference sessions created in a video conferencing application, users in a conference session, data generated and distributed within each conference session, secret information required by security attributes of data, have. In addition, the video conference service server 100 manages security policies for data, and allows users to inquire data safely even after the conference ends.

The security management apparatus 200 for video conference data opens the service API to the video conferencing service server 100 and the remote user system 300 and manages video conferencing data that is data generated and distributed at the time of video conferencing.

Here, the video conference data may include main user information of a conference session, user (attendee) information to attend a conference session, video conference recording data, important meeting data, and the like. Video conferencing data can be a target of a malicious attacker, and the security management apparatus 200 for video conferencing data protects data for video conferencing.

The security management apparatus 200 for video conference data can be variously constructed according to requirements such as big data tools, SQL DB, and Linux system. And manages data in cooperation with the video conferencing service server 100, so that users can inquire past conference data through the remote user system 300 even after the conference ends, and provides the inquired data to the user. In addition, the security management apparatus 200 for video conferencing data can be installed and operated on a general server or a cloud.

Hereinafter, a configuration of a video surveillance data security management apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

2 is a block diagram showing the configuration of a security management apparatus for video conference data according to an embodiment of the present invention.

2, the video conferencing data security management apparatus 200 includes a request receiving unit 210, an authority determining unit 220, an encryption / decryption unit 230, a data processing unit 240, a service management unit 250, And a user management unit 260.

First, the request receiving unit 210 receives a data processing request for video conference data. Here, the data processing request may be a request for at least one of uploading of video conferencing data, inquiry of video conferencing data, deletion of video conferencing data, and updating of video conferencing data.

The data for video conferencing may include at least one of user's personal information, data generated at the time of video conferencing, and data shared at the time of video conferencing, and the data generated at the video conferencing may include a conference video, And the data shared during the video conference may include at least one of voice data, image data, image data, and text data.

In addition, the data for video conferencing can be divided into security data disclosed only to users of the video conference and public data disclosed to all users. In particular, conference video, conference voice, voice data, video data, image data and text data and user's personal information can be classified into security data.

The authority determining unit 220 determines whether to execute the data processing request based on the user's right information corresponding to the received data processing request. Here, the authority information may include information for distinguishing a main user from a general user who created a conference session of a video conference, and additional authority information may be set for each user.

Next, the encryption / decryption unit 230 encrypts or decrypts data based on a security policy corresponding to the data when it is determined to perform the data processing request. The data processing unit 240 processes the encrypted or decrypted data so as to correspond to the data processing request.

The encryption / decryption unit 230 can identify the type of data corresponding to the data processing request and encrypt or decrypt the data based on the security policy corresponding to the type of the data.

At this time, the encryption / decryption unit 230 inquires the secret key corresponding to the data processing request. The encryption / decryption unit 230 may generate a derived key based on the inquired secret key and the security policy, and may encrypt or decrypt the data using the generated derived key.

Here, the security policy may include at least one of a first security policy set for each type of data and a second security policy set for each data. If both the first security policy and the second security policy are set, the encryption / decryption unit 230 may encrypt or decrypt the data by prioritizing the second security policy over the first security policy.

The first security policy refers to a policy that the security management apparatus 200 for video conferencing data encrypts personal information, conference video, conference voice, meeting data, etc. according to the encryption policy for each data type. At this time, the first security policy operates when there is no separate designation for the video conference data.

On the other hand, the encryption policy can be separately set for the video conference data that the user himself uploads (generates and shares). For example, the user may not want to share the video conference data uploaded by the user with the user participating in the conference session at the end of the video conference. At this time, the security management apparatus 200 for video conferencing data may provide a second security policy, which is a separate data encryption option.

The second security policy takes precedence over the first security policy. For example, even if encryption is not set in the first security policy for each data type defined according to the conference session ID, if encryption is set in the second security policy, which is an encryption option individually requested by the user, The management apparatus 200 may perform separate encryption to store video conference data.

In this case, the security management apparatus 200 for video conferencing data does not use the encryption key assigned to the conferencing session ID as an encryption key, and does not use an encryption key calculated from the seed, but a separate user seed It is possible to perform encryption and decryption of data with a key generated using Seed. Here, the second security policy may be an on-demand method, and may be a method of specifying the application of the secondary encryption when requesting data processing.

The security management apparatus 200 for video conferencing data may be configured to encrypt data for video conferencing in a case where the security policy is not set in the data for video conferencing, It is possible to share the video conference data with each other, or to operate the system so that the video conference data is released to other users. In addition, in terms of user authority management for data that does not require encryption, it may be operated in a manner of assigning authority to users of other conference sessions.

The service management unit 250 receives at least one of the identification information, the user information, and the secret key of the video conference, and manages the video conference service.

Finally, the user management unit 260 receives at least one of the user identification information of the video conference service and the user's right information, and manages the user of the video conference service.

The user management unit 260 may receive voting information on the security policy of the video conference data from the user of the video conference service. In particular, the user management unit 260 may receive voting information on the preset basic security policy. Here, the basic security policy means a security policy preset in the video conferencing service, and may mean a first security policy.

The user management unit 260 analyzes voting information input from a plurality of users and can modify a first security policy, which is a basic security policy preset in the video conferencing service, based on the analysis result. For example, when the users having a predetermined threshold value or more vote to the contrary to the first security policy, the user management unit 260 may modify the predetermined first security policy.

Hereinafter, a security management method for video conferencing data performed by the video conferencing data security management apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

3 is a flowchart illustrating a security management method for video conferencing data according to an embodiment of the present invention.

First, the security management apparatus 200 for video conferencing data registers the video conferencing service information and manages the registered video conferencing service (S310).

The security management apparatus 200 for video conferencing data can manage the video conferencing service by receiving the service registration message from the video conferencing service server 100 or can terminate the video conferencing service by receiving the service termination message.

Here, the service registration message may include at least one of a video conference application ID, a video conference service server access information, a conference session ID, a meeting date, a meeting name, a main user ID, and a secret key. In the service registration process, the main user ID is transferred to the service manager of the security management apparatus 200 for video conference data, and the service manager can manage the received series of information. And the service termination message may include at least one of a video conference application ID and a conference session ID.

When the video conferencing is completed, the security management apparatus 200 for video conferencing data can receive the service termination message, and when receiving the service termination message, the video conferencing data security management apparatus 200 manages the end of the conference session And the user registration for the ended conference session can not be established.

The process for registering and managing video conferencing service information by the video conferencing data security management apparatus 200 will be described in more detail with reference to FIGS. 4 and 5, which will be described later.

The security management apparatus 200 for video conferencing data registers information of a user who uses the video conferencing service and manages the registered user (S320).

The video conferencing data security management apparatus 200 registers the video conferencing service and then registers the user information. The user information is registered to identify a user to participate in a conference session of the video conference service, and the process of registering user information is performed as part of the video conference service registration process in step S310, or is performed in a separate process .

When the process of registering the user information is performed in a separate process from the process of registering the video conference service (step S320), the process of registering the user information may be performed by the remote user system 300. [

After performing the video conference service registration process and the user registration process, the security management apparatus 200 for video conferencing data receives a data processing request (S330) and determines whether to perform the received data processing request (S340) .

When the video conferencing service and the user are pre-registered, the security management apparatus 200 for video conferencing data according to an exemplary embodiment of the present invention omits the execution of steps S310 and S320, Step can be performed.

When the remote user system 300 or the remote user system is requested to upload video conferencing data, the video conferencing data security management apparatus 200 can perform the login procedure first. In addition, the video conferencing data security management apparatus 200 provides the video conference application ID and conference session ID information related to the user ID to the user, selects the video conference application ID and the conference session ID from the user, .

The security management apparatus 200 for video conferencing data may receive a data processing request including at least one of a data upload request, a data inquiry request, a data deletion request, and a data update request.

For example, the data processing request message requesting the data upload may include [video conferencing application ID, conference session ID, user ID, data upload, encryption or not] It means that the request message is encrypted, and the encryption means that encryption processing is required for the data.

The security management apparatus 200 of the video conference data having received the data processing request determines the authority of the user who has transmitted the data processing request, and when it is determined that the user has the corresponding authority, do.

In addition, the security management apparatus 200 for video conferencing data provides a web UI environment or a GUI to provide appropriate data according to a user's authority to a user, and requests a data inquiry, a data deletion request, ) Request.

If it is determined in step S340 that the data processing request is not to be performed (NO in step S340), the security management apparatus 200 for video conferencing data may terminate the security management process of the video conferencing data in FIG.

On the other hand, if it is determined to perform the data processing request (YES at S340), the security management apparatus 200 for video conferencing data identifies the type of data (S350).

The security management apparatus 200 for video conferencing data according to an embodiment of the present invention identifies the type of data corresponding to a data processing request in order to apply a different encryption method to each type of data.

At this time, the security management apparatus 200 for video conferencing data can identify the type of data based on the extension name of the data. If the type of data is not identified based on the extension name of the data, the security management apparatus 200 for video conferencing data can provide a separate data management API for each type of data.

After identifying the type of data in step S350, the security management apparatus 200 for video conferencing data performs encryption / decryption of data based on the security policy (S360).

Here, the security policy determines whether encryption is applied according to the type of data, in order to conceal data for video conferencing. The security policy may include a first security policy set for each type of data and a second security policy set for each data. The first security policy is a default security policy unless it is set as a default policy, and the second security policy may mean a video conference service or a policy (on-demand policy) determined when a user requests.

For example, when the data processing request received in step S330 is a data uploading request, the security management apparatus 200 for video conferencing data encrypts data in accordance with the security policy. If the data processing request is one of a data inquiry request, a data deletion request, and a data modification request, the data can be encrypted or decrypted in a manner corresponding to the security policy.

At this time, the security management apparatus 200 for video conferencing data inquires a secret key corresponding to a data processing request, and generates a derivative key based on the inquired secret key and security policy. The video conferencing data security management apparatus 200 can encrypt data using the generated derived key or decrypt the encrypted data.

The process of encrypting and decrypting data of the video conference data security management apparatus 200 will be described in more detail with reference to FIGS. 8 and 9, which will be described later.

Finally, the security management apparatus 200 for video conference data processes the encrypted data (S370).

The security management apparatus 200 for video conference data processes the encrypted or decrypted data in a process corresponding to the data processing request in step S360.

Hereinafter, a service management and data management method for a video surveillance data security management apparatus according to an exemplary embodiment of the present invention will be described in detail with reference to FIGS. 4 and 5. FIG.

4 is a diagram for explaining an API connection structure of a security management apparatus for video conference data according to an embodiment of the present invention.

4, the video conferencing data security management apparatus 400 may be connected to the video conferencing service server 510 and the remote user system 520 through an API. The video surveillance data security management apparatus 400 is separate from the video conferencing service server 510 and is not dependent on the specific video conferencing application server (video conferencing service server). In order to secure the data (video conferencing data) generated from the video conferencing service server 510, the video conferencing data security management apparatus 400 stores the video conferencing data in the database 450, which is a specialized storage.

The video conference data security management apparatus 400 may indicate whether the video conference data is encrypted or not and store the data in the database 450. [ Basically, data for video conferencing created and distributed within the conferencing session can be designed to be shared by all users of the conferencing session.

Since the video conference data is managed based on the secret key issued according to the conference session ID, if the data inquiry right is provided to other users in the conference session not requiring the encryption, the data can be decrypted and operated so as to be inquired have. And the confidentiality of the data can be maintained even if data for video conferencing is leaked to users outside the conference session.

In addition, the video conferencing data security management apparatus 400 provides a procedural API for managing users, services, and data of a video conferencing application, and includes a function module and a processing procedure for managing the procedural API.

As shown in FIG. 4, an API may be used for transmission and reception of actual data, as well as commands for management and control, and large-capacity data transmission may be performed in conjunction with a separate data transmission / reception method.

The video management data security management apparatus 400 includes an API controller 410 connected to at least one of a service management API, a user management API, and a data management API, a service manager 420, a security manager 430, Manager 440. < / RTI >

The video management data security management apparatus 400 manages the service management API, the user management API, and the data management API through the service manager 420 and the data manager 440, Encryption and decryption of data can be performed.

First, the video conferencing service server 510 can use the video conferencing data security management device 400 through the service management API. Here, the service management API may be managed by the service manager 420 of the security management apparatus 400 for video conferencing data.

The video conference service server 510 can register and manage one or more conference sessions. In the process of creating a conference room or after creating a conference room, the video conference application server 510 calls a service management API, An application for registering a session ID and the like, and a session registration process.

At this time, the video conferencing service server 510 receives a service including at least one of video conferencing application ID, access information of the video conferencing service server, additional information such as conference session ID, conference date, And transmits the registration message to the security management apparatus 400 of the video conference data.

The video conferencing service server 510 may transmit a service termination message including the video conferencing application ID and the conferencing session ID to the security management apparatus 400 for video conferencing data.

Here, the video conferencing application ID is information for identifying the video conferencing service server, and is used so that the video conferencing data security management apparatus 400 does not depend on the specific video conferencing service server 510. [ However, in the case where the security management apparatus 400 for video conferencing data is dependent on the specific video conferencing service server 510, that is, when it is not necessary to distinguish the video conferencing application, the video conferencing application ID may be omitted.

The connection information of the video conferencing service server may mean additional information about the video conferencing service server 510, such as the IP address and port number of the video conferencing service server. The conference session ID is identification information of one conference session created by the user of the video conference. Random information of a specific length can be used to distinguish the conference session from other conference sessions. The additional information such as the meeting date, And the like.

In addition, the main user ID refers to the user ID information that generated the conference session, and the device 400 for managing the video conference data according to an embodiment of the present invention may include a main user Can be clearly specified to give the main user only the right to delete and change the confidentiality or preservation of the video conference data.

The secret key is a key for encrypting or decrypting video conference data, or a key used as a seed for generating a derivative key for encryption / decryption of video conference data. When the secret key is directly used as a key for encrypting or decrypting data for video conferencing, the security management apparatus 400 for video conferencing data may omit the process of generating a derivative key using the secret key. On the other hand, a method of encrypting and decrypting data for video conferencing when the secret key is utilized as a seed will be described in more detail with reference to FIG. 8, which will be described later.

Next, the video conferencing service server 510 can perform a user (participant) registration process of registering a user through the user management API. Here, the user management API may be managed by the service manager 420 of the security management apparatus 400 for video conference data, or may be managed by a separate user management module.

When the registration for the video conferencing session is completed, the video conferencing service server 510 receives the video conferencing application ID, conference session ID, user ID, user right, user additional information, login password, And transmits the user registration message including at least one of the voting information to the security management apparatus 400 for video conference data.

When the video conferencing service server 510 supports the user registration function, the video conferencing data security management apparatus 400 can receive user registration from the video conferencing service server 510. [ At this time, the video conferencing service server 510 can support a message processing function to register a plurality of users included in the user information list at a time, or to perform a registration process for each user individually.

If the user participating in the video conference trusts the video conferencing service server 510, the user can allow the video conferencing service server 510 to manage the user's login password for the security management device 400 of the video conferencing data have. , The user's login password can be used as login information when accessing the security management apparatus 400 of the video conference data separately from the remote user system 520 in the future.

In addition, the security management apparatus 400 for video conference data can receive a user registration from a separate remote user system 520. In order to prevent the user's login password from being exposed to the video conferencing service server 510, after the video conferencing service server 510 completes the video conferencing service registration process, the remote user system 520 performs the user registration process separately .

At this time, the remote user system 520 may input the user ID and password to the security management apparatus 400 for video conferencing data, log in, and transmit the user registration information to the security management apparatus 400 for video conferencing data.

The user registration information may include at least one of a video conference application ID, a conference session ID, a user ID, user authority information, user additional information, and voting information on the first security policy.

Here, the video conference application ID and the conference session ID are the same information as the information generated in the video conference service registration process, and are used for linking the video conference application and the conference session with the user information. The user ID means the personal identification information of the user, and the user right information includes information that can distinguish the main user or the general user, and the authority of the additional user can be set. The user additional information means user's personal information.

The login password means password information required when the user logs into the security management apparatus 400 for video conference data. If the video conferencing application ID and the conferencing session ID do not exist, or the conferencing session has already ended, the security management apparatus 400 for video conferencing data does not allow the user to register. Through this, the security management apparatus 400 for video conference data can block participation of unauthorized (uninvited) users, viewing of data, and the like.

The video conferencing data security management apparatus 400 can receive the data processing request through the data management API and process and manage the video conferencing data to correspond to the data processing request. The data management API encrypts and stores the video conference data for each conference session, and the user accesses the security management apparatus 400 for the video conference data to inquire the video conference data for each conference session of the video conference have. At this time, the video conferencing data security management apparatus 400 may perform a separate login procedure for the user.

The data manager 440 of the security management apparatus 400 for video conferencing data manages data processing rights and security policies for each user for data processing. In addition, the video surveillance data security management apparatus 400 can manage data access privileges only to users (conference attendees) corresponding to the conference session IDs.

When the data manager 440 of the video management server 400 receives the request message from the API controller 410, the data manager 440 distinguishes which data is requested to be processed by the received request message, And then performs a data processing procedure. At this time, the data manager 440 can determine the authority of the user according to the data processing right per user as shown in FIG. 6, which will be described later.

Here, the data manager 440 stores, updates, inquires, and deletes video conferencing data in association with information such as application IDs, conference session IDs, user IDs, and user privileges created and registered in the service registration process or the user registration process And the like can be managed and processed.

When it is determined that the data processing right corresponding to the data processing request is given to the user (when it is determined that the data processing request is valid), the security management apparatus 400 for video conferencing data determines the type of data, And encrypts or decrypts the video conference data by the encryption / decryption method corresponding to the type of the video conference.

For convenience of explanation, the security management apparatus 400 for video conference data judges the type of data and decrypts the data. However, the present invention is not limited to this, and the security management apparatus 400 for video conference data may determine that the data processing request is valid If security processing is not set, the security manager 430 proceeds to process the corresponding data. If security processing is set, the security manager 430 performs encryption / decryption processing, Processing can be performed.

The security manager 430 of the security management apparatus 400 for video conferencing data encrypts and decrypts data when security processing is set in the security policy. In particular, the security manager 430 may provide an encryption policy and a key management method in order to protect data for video conferencing. At this time, the encryption policy and the key management method can be processed with close association.

The security manager 430 manages the encryption policy for each data type and applies different encryption policies depending on the type of video conference data generated from the video conference or shared during the video conference. Also, the key format required according to the encryption policy may be different. The process for the security manager 430 to decrypt the data will be described in more detail with reference to FIG. 8, which will be described later.

For example, the encryption policy for each data type applies a format preservation encryption algorithm to user personal information, and the key format can be 128 bits. The conference video and image data may be scrambled by a scrambling encryption algorithm, the key format may be a specific key, the conference voice and voice data may be subjected to a streaming encryption algorithm, and the key format may be set to be a random sequence.

5 is a diagram for explaining a function of a security management apparatus for video conferencing data according to an embodiment of the present invention.

As shown in Fig. 5, the API controller of the security management apparatus 400 for video conferencing data receives a request corresponding to service management and data management. The API controller then forwards the received request to a processing module corresponding to the request among the service manager, the security manager and the data manager. At this time, it is assumed that the API connection between the video conferencing data security management apparatus 400, the video conferencing service server, and the remote user system is secure.

The security management apparatus 400 for video conferencing data receives the application login / logout information from the video conferencing service server and registers or terminates the video conferencing application, receives the login information of the user, and registers and logs in the user . In addition, the security management apparatus 400 for video conference data can receive a request for changing information such as user information from the user.

The security management apparatus 400 for video conferencing data may receive a data processing request for data management and the data processing request may include Put (Add), Update (Modify), Get, Delete, and Get-Streaming .

And the data processing request for data management in the video conferencing service server and the remote user system may be different. In the case of the video conferencing service server, the communication session between the corresponding conference session of the video conferencing service server and the security management apparatus 400 for the video conferencing data is continuously maintained, and the application ID and the conference session ID information are transmitted to the security management apparatus The video conference service server can process the data only by the user ID and the data processing request command.

On the other hand, if it is not such a situation, the data processing request message requesting data upload may include [video conference application ID, conference session ID, user ID, data upload, encryption or the like].

Hereinafter, the processing right of data and security policies of data according to an embodiment of the present invention will be described in more detail with reference to FIG. 6 and FIG.

FIG. 6 illustrates an example of a data processing right for each user according to an exemplary embodiment of the present invention. Referring to FIG.

As shown in FIG. 6, one video conference application may include one or more conference sessions, and one or more user-specific data processing rights may be set for each conference session. At this time, within the range depending on the video conferencing application ID and the conferencing session ID, the processing request from the video conferencing service server allows all the processing right (inquiry, deletion, modification, upload) of all data, The processing request may be set to have permission to proceed on a user-by-user basis.

If necessary, users of other conferences or other conferencing sessions can also be given access to view if they need to share the conference data, in which case they can be authorized to view unencrypted data.

In addition, the data processing right for each user can be set by distinguishing between a main user and a general user (attendee), and a general user can be classified into a general attendee, a committee attendee, and an advisory attendee.

FIG. 7 is an exemplary diagram illustrating a security policy applied to data for video conferencing and data for video conferencing according to an embodiment of the present invention.

The video conferencing data created or distributed at the time of executing the video conferencing application of the video conferencing service server 100 may include user's personal information, conference video generated at the video conferencing, conference voice, voice data shared at the video conferencing, And at least one of text data and text data. The video conferencing data can be divided into security data that is disclosed only to users of the video conference and public data that is disclosed to all users.

Here, the user's personal information may be defined and input fixedly during the user registration process. The conference video and the conference voice data are uploaded through a separate data upload API provided by the video conferencing service server 100 after the conclusion of the conference .

That is, the security management apparatus 200 for video conferencing data can distinguish general conference data, user personal information, and video conferencing data (conference video, conference voice) from the same type of data. Through this, the security management apparatus 200 for video conferencing data can divide the video conferencing data and manage the data with an encryption policy suitable for each, in order to protect the data generated at the video conferencing.

The security management apparatus 200 for video conferencing data can manage classified data as confidential information for data security, and can set a first security policy 710 to confidential information to perform encryption / decryption by default have.

As shown in FIG. 7, the first security policy 710 may be set as a default by encrypting the user's private information, and the number of users who oppose the first security policy 710, which is the default policy, The security policy can be set to encrypt only when it is less than half. The process for the video surveillance data security management apparatus 200 to modify the security policy based on the voting information will be described in more detail with reference to FIG.

As shown in FIG. 7, the second security policy 720 may be set in an on-demand manner. The second security policy 720 specifies the encryption application at each data processing request or sets the encryption application policy in a lump regardless of the type of data, The management API can determine whether encryption is applied.

Here, the priority of the second security policy 720 is higher than that of the first security policy 710, and the security management apparatus 200 for video conference data according to an embodiment of the present invention includes a first security policy 710, When all of the second security policies 720 are set, the second security policy 710 is preferentially placed over the first security policy 710 to perform encryption / decryption of data have.

For example, assume that a public policy that does not perform encryption on the conference voice is set as the first security policy 710, and a second security policy 720 that performs encryption on the on-demand basis is set. At this time, the security management apparatus 200 for video conferencing data can determine whether or not the conference voice is encrypted by prioritizing the second security policy 720 over the first security policy 710.

That is, even if the encryption is not performed in the first security policy 710, since the encryption is set to be performed in the second security policy 720, the security management apparatus 200 for video conferencing data, Quot; encryption "

Hereinafter, a process of performing encryption / decryption of data according to an embodiment of the present invention will be described in detail with reference to FIG. 8 and FIG.

FIG. 8 is a flowchart illustrating a process of performing encryption / decryption of data in step S360 of FIG.

First, the security management apparatus 200 for video conference data inquires a secret key corresponding to a data processing request (S810).

At this time, the security management apparatus 200 for video conferencing data can identify the type of data corresponding to the data processing request in step S350 of FIG. 3, and inquire the secret key corresponding to the data processing request.

Here, the secret key is used as a seed for generating an encryption / decryption key (derivative key) for encryption / decryption of video conference data, and may be generated and registered in the service registration process according to the conference session ID.

Then, the security management apparatus 200 for video conferencing data generates a derivative key based on the secret key and the security policy (S820).

The security management apparatus 200 for video conferencing data is an input for generating a derivative key based on an encryption method and a key format, and may use the secret key searched in step S810.

The derived key generated in step S820 may be stored and managed in the security management apparatus 200 for video conferencing data for efficiency, and may be reused to perform encryption / decryption on the same type of data.

9 is a diagram illustrating an example of a key management method and an encryption / decryption method according to an embodiment of the present invention.

As shown in Fig. 9, the security management apparatus 200 for video conferencing data can inquire the secret key corresponding to the user ID and determine the key format by inquiring the encryption policy for each data type. Then, the derived key can be calculated (computed) using the determined key format and the secret key, and the calculated derived key can be stored.

At this time, the encryption work algorithm may include at least one of a format preservation encryption algorithm, a scrambling encryption algorithm, a streaming encryption algorithm, and an AES encryption algorithm. The key format according to the encryption algorithm may be 128 bits, a specific key length, a random sequence, and the like, but is not limited thereto.

Referring back to Fig. 8, the security management apparatus 200 for video conferencing data encrypts the video conferencing data using the generated derived key or decrypts the encrypted video conferencing data (S830).

After encrypting or decrypting the video conference data using the derivative key, the security management apparatus 200 for video conference data performs step S370 in FIG. 3 to process encrypted video conference data or decrypted video conference data have.

For convenience of explanation, the security management apparatus 200 for video conferencing data has been described as generating a derivative key using a secret key and encrypting or decrypting data for video conferencing using the generated derivative key. However, , The video conferencing data security management apparatus 200 may encrypt or decrypt the video conference data using the inquired secret key to perform data processing corresponding to the data processing request.

At this time, the secret key may be one registered by the video conferencing service server 100 and the user, or automatically assigned by the security manager of the security management apparatus 200 for video conferencing data. The secret key can be generated so as to be distinguished according to the conference session ID, and can be stored and managed in the security management apparatus 200 for video conferencing data.

When receiving the data processing request from the user of the video conferencing service, the security management apparatus 200 for video conferencing data inquires the secret key registered in the conference session ID and encrypts / decrypts the video conferencing data with the inquired secret key So that the data can be processed.

The generation of the secret key and the encryption and decryption of the data for video conferencing can be performed by the security manager of the security management apparatus 200 for video conferencing data, Encryption and decryption can be performed through the secret key. At this time, the security manager inquires the security policy set for each data type by using the secret key, and can encrypt / decrypt the data requiring security.

Since the secret key is basically generated and managed by the security manager, users do not need to directly manage or remember the key to decrypt encrypted video conferencing data.

Hereinafter, a security policy modification process according to an embodiment of the present invention will be described in detail with reference to FIG.

10 is a flowchart for explaining a process of modifying a security policy based on voting information according to an embodiment of the present invention.

First, the security management apparatus 200 for video conference data receives and analyzes voting information from users (S1010).

The security management apparatus 200 for video conference data receives voting information on the first security policy as a basic security policy when the user is registered from the video conferencing service server 100, Upon receipt, it is possible to input voting information on the first security policy.

Next, the security management apparatus 200 of the video conference data calculates the opposite ratio of the first security policy (basic security policy) (S1020). If the inverse ratio of the first security policy is larger than the threshold, the security management apparatus 200 of the video conferencing data modifies the first security policy (S1040).

For example, if the first security policy is set to encrypt conference video and conference voice data, and more than half of the users participating in the conference are opposed to the encryption of conference video and conference voice data, When it is desired to release the conference voice data, the security management apparatus 200 for video conference data can modify the predetermined first security policy for the conference video and conference voice data.

On the other hand, when the inverse ratio of the first security policy is below the threshold value, the security management apparatus 200 for video conferencing data may terminate the security policy modification process of FIG. That is, when the certain condition is not satisfied, the security management apparatus 200 for video conferencing data can be set to operate in the first security policy (default policy).

For convenience of explanation, it has been described that the opposite ratio of the first security policy is compared with the threshold to determine whether to modify the first security policy. However, the present invention is not limited to this, It may be implemented in a form of determining whether to modify the first security policy by comparing the number of users who oppose the security policy with a threshold value.

As described above, the apparatus and method for security management of data for video conferencing according to the present invention are not limited to the configuration and method of the embodiments described above, but the embodiments may be modified in various ways All or some of the embodiments may be selectively combined.

100: Video conferencing service server
200: security management device for video conference data
210: request receiving unit 220:
230: encryption / decryption unit 240: data processing unit
250: service management unit 260: user management unit
300: Remote user system
400: Security administrator of data for video conferencing
410: API controller 420: Service manager
430: security manager 440: data manager
450: Database 510: Video conferencing service server
520: remote user system 710: first security policy
720: SECOND SECURITY POLICY

Claims (20)

A request receiver for receiving a data processing request for video conference data,
An authorization decision unit for deciding whether to perform the data processing request based on the authorization information of the user corresponding to the received data processing request,
An encryption / decryption unit for performing encryption / decryption of the data based on a security policy corresponding to the data when the data processing request is determined to be performed;
And a data processing unit for processing the encrypted or decrypted data so as to correspond to the data processing request,
And a security management unit for managing security of the video conference data. The method according to claim 1,
The encryption /
Identifies the type of data corresponding to the data processing request, and encrypts or decrypts the data based on the security policy corresponding to the type of the data. 3. The method of claim 2,
The security policy includes:
A first security policy set for each type of data, and a second security policy set for each data. The method of claim 3,
The encryption /
When the first security policy applied as a default and the second security policy set as an option are both set as an option, the second security policy is prioritized over the first security policy, and the data Decryption of the video conference data is performed. The method according to claim 1,
The encryption /
Wherein the data processing apparatus inquires the secret key corresponding to the data processing request, generates a derivative key based on the secret key and the security policy, and encrypts or decrypts the data using the generated derivative key. Apparatus for security management of data for video conferencing. The method according to claim 1,
The data processing request includes:
And a data update request for the video conference data, a data inquiry request, a data deletion request, and a data update request for the video conference data. The method according to claim 1,
A service management unit for receiving at least one of identification information of the video conference, user information, and a secret key to manage a video conference service, and
A user management unit for receiving at least one of the user identification information of the video conference service and the user right information and registering and managing a user of the video conference service,
Further comprising the step of: detecting the security of the video conference data. 8. The method of claim 7,
The user management unit,
And receives voting information on a security policy of the video conference data from a user of the video conference service. 9. The method of claim 8,
The user management unit,
And analyzes the voting information input from the plurality of users and modifies the basic security policy when the users whose analysis result thresholds are higher than the predetermined basic security policy set for the video conferencing service Security management device. The method according to claim 1,
The video conference data includes:
Wherein the information includes at least one of personal information of the user, a meeting image generated at the time of the video conference, a meeting voice, voice data shared at the time of video conference, image data, image data, and text data, And the public data to be disclosed to all users. A method for security management of data for video conferencing performed by a security management apparatus for video conferencing data,
Receiving a data processing request for video conferencing data,
Determining whether to perform the data processing request based on the user's right information corresponding to the received data processing request,
Performing encryption and decryption of the data based on a security policy corresponding to the data when it is determined to perform the data processing request,
Processing said decrypted data to correspond to said data processing request
Wherein the video conference data is managed by the management server. 12. The method of claim 11,
Further comprising identifying a type of data corresponding to the data processing request,
The step of performing encryption /
And encrypting or decrypting the data based on the security policy corresponding to the type of the data. 13. The method of claim 12,
The security policy includes:
A first security policy set for each type of data, and a second security policy set for each data. 14. The method of claim 13,
Wherein the step of performing encryption / decryption of the data based on the security policy comprises:
When the first security policy applied as a default and the second security policy set as an option are both set as an option, the second security policy is prioritized over the first security policy, and the data Decryption of the video conference data is performed. 12. The method of claim 11,
The step of performing encryption /
Inquiring a secret key corresponding to the data processing request,
Generating a derived key based on the secret key and the security policy, and
Encrypting or decrypting the data using the generated derived key
Wherein the security management information includes at least one of a password and a password. 12. The method of claim 11,
The data processing request includes:
And a data update request for the video conference data, a data inquiry request, a data deletion request, and a data update request for the video conference data. 12. The method of claim 11,
Receiving at least one of identification information of the video conference, user information, and a secret key to manage a video conference service; and
Receiving at least one of the user identification information of the video conferencing service and the user's privilege information to register and manage a user of the video conferencing service
Further comprising the steps of: receiving the video conference data; 18. The method of claim 17,
Wherein the managing of the user of the video conference service comprises:
Receiving voting information on a security policy of the video conference data from a user of the video conference service
Wherein the security management information includes at least one of a password and a password. 19. The method of claim 18,
Wherein the managing of the user of the video conference service comprises:
Analyzing voting information input from the plurality of users, and
Analyzing the basic security policy if the users whose thresholds are more than a threshold value are opposed to the basic security policy preset in the video conferencing service
Wherein the security management information includes at least one of a password and a password. 12. The method of claim 11,
The video conference data includes:
Wherein the information includes at least one of personal information of the user, a meeting image generated at the time of the video conference, a meeting voice, voice data shared at the time of video conference, image data, image data, and text data, And the public data is disclosed to all users.

Images