KR20200071811A - Security Service system based on cloud - Google Patents

Abstract

According to the present invention, provided is a cloud-based security service system, which comprises: an agent rule monitoring module configured with an agent and a server for coping with a security accident which may occur by a user accessing a cloud computing system, wherein the agent sets and manages the user authority through PC login of the user and interlocking with the server; an activity recording module connecting to a cloud server to capture real-time PC usage screens of users who are using a PC and creating a video, and compressing and storing the video; and a transmission and reception module reporting and recording a PC usage status to transmit data thereon to the agent rule monitoring module. The evidence for rule violations can be stored while managing the PC usage of the user.

Description

Security service system based on cloud

The present invention relates to a cloud-based security service system, and more particularly, to a security service system for providing a secure cloud environment through cloud computing computer security elements in a cloud computing service.

Cloud computing environments are widely used to efficiently distribute corporate IT resources, reduce costs, and securely store data. A cloud computing system refers to a distributed computing system that provides independent virtual machines to multiple users on the same hardware platform where one super computer or multiple computers are connected to act like one computer.

The concept of cloud computing is developing rapidly as the demand for efficient distribution of resources in the computing environment increases in a situation where the communication infrastructure is rapidly developing.

In the cloud computing environment, the user does not need a high-end terminal, so the IT equipment investment cost is reduced at the client level, and efficient distribution of IT resources according to the use environment is possible. However, the cloud computing system has an efficient aspect by dividing and using hardware assets according to the needs of the user, but there is a risk that information contained in the cloud system may be leaked or invaded from the outside when the user uses the computer in accordance with regulations. do.

Therefore, various security solutions need to be developed that can enhance the security of the cloud computing system.

In the environment using cloud computing of the present invention, a policy for PC use is set, and when a user violates a rule and monitors the rules, the action is stored as evidence through video records to provide a security system that can enhance security. There is a purpose.

The security service system based on clouding according to the present invention is a security service system composed of an agent and a server for coping with security accidents that may occur by a user accessing a cloud computing system. An agent rule monitoring module for setting and managing user authority through interworking with a server; An activity recording module that generates a real-time capture and video of a PC usage screen of a user who is using a PC by accessing a cloud server, and compresses and stores it; A transmit/receive module that reports and records the user's PC usage status and transmits data to the agent rule monitoring module; A process hooking module that tracks the process-based real-time user program usage from the OS; And an event hooking module that analyzes and defines operating system events conforming to the agent rule monitoring scenario.

In addition, the server includes a dashboard module that visually displays information on user status, evidence storage management, and real-time storage usage and status management, and an agency linkage module that performs an interworking function with an agency-related personnel management system and an agent. A policy management module that performs policy setting functions such as rule definition and management, a storage management module that stores and records videos that record the violation of rules by users, and an agency registration and management based on users or groups It may include a user management module to perform.

Here, according to the policy set by the policy management module, the agent rule monitoring module monitors a user's suspicious behavior connected to a PC and records and stores the corresponding behavior based on video compression when an action that violates the policy occurs.

In addition, the activity recording module stores an event in which a suspicious situation is generated by the agent rule monitoring module and an operation for storing evidence starts or ends.

In addition, the storage management module is characterized in that it stores a video recording the rule violation status for each user and group, and periodically checks the storage status and the storage usage status to determine the stored status.

According to an embodiment of the present invention, when a user accesses a cloud computing environment, monitoring is performed to monitor and manage suspicious behavior using malicious, leaked, or unauthorized programs, and video compression is performed when suspicious behavior and rule violations occur There is an advantage in that the security of the cloud server can be improved by recording and managing the corresponding action on the basis.

1 is a block diagram showing the configuration of a cloud-based security service providing system according to an embodiment of the present invention

Hereinafter, the present embodiment will be described in detail with reference to the accompanying drawings, but is not limited or limited by the present embodiment. In describing the present invention, specific descriptions by known functions or configurations may be omitted to clarify the gist of the present invention.

1 is a view showing the configuration of a cloud-based security system according to the present invention. Referring to FIG. 1, a cloud-based security system according to an embodiment may include an agent 10 and a server 20 that provide security services.

The agent 10 includes an agent rule monitoring module 11 for transmitting and receiving data based on an OS, an activity recording module 12, a transmitting and receiving module 13, a process hooking module 14, and a progress hooking module 15 can do.

The agent rule monitoring module 11 serves to set and manage user rights through a user's PC login and interworking with a server. The agent rule monitoring module 11 can prevent a user's login information from being stolen by allowing the user to perform a connection based on mobile authentication when accessing the cloud server, and set authority to access data for each user And manageable.

In addition, it is possible to monitor and manage suspicious behavior using malicious, leaked, and unauthorized programs, and record and manage video compression-based behavior when suspicious behavior and rule violations occur. To this end, programs corresponding to malicious, leaked, and unlicensed can be selected and updated and stored as a list, and rules to be observed when accessing a PC may be clearly defined.

The agent rule monitoring module 11 performs overall operation, operation, and management of the agent software, and when an issue corresponding to a security incident occurs, reports it to an administrator in real time and records the situation.

The activity recording module 12 may access a cloud server and generate a video based on a real-time capture and ffmpeg of a user's PC usage screen using a PC, and compress and store it. The activity recording module 12 may report an event in which a suspicious situation is generated by the agent rule monitoring module and an operation for storing evidence starts or ends.

The transmission/reception module 13 reports and records the user's PC usage status and transmits the data to the agent rule monitoring module 11, and captures the user's PC usage screen when a security accident is detected. And video evidence can be reported to the manager in real time. In addition, an event on the operation status of the agent rule monitoring module can be reported to the administrator.

The process hooking module 14 tracks the process-based real-time user program usage status from the OS. In addition, it is possible to detect suspected use of programs such as malicious, leaked, and unauthorized based on agent rules and detect violations of rules.

Accordingly, module events for agent rule monitoring can be reported when a process of monitoring and rule violations is detected.

The event hooking module 15 may analyze and define operating system events corresponding to the agent rule monitoring scenario. In addition, operating system events for user login, logout, and proactive monitoring can be detected, and module events for agent rule monitoring can be reported when events for monitoring and rules are detected.

The cloud-based security system according to the embodiment may include a server 20 that provides a security service. The server 20 includes a dash mode view module 21, an agency linkage module 22, a policy management module 23, a storage management module 24, a user management module 25, and a qualification management module 26 can do.

The server 20 may include a dashboard view module 21 for visualizing the operation status of security monitoring. In the dashboard view module 21, information on user status, evidence storage management, and real-time storage usage and status management may be visually displayed, and an area for processing policy status and management according to a user level is visually displayed. Can be.

The agency linkage module 22 may perform an interworking function with an agency linked personnel management system. It functions to define a protocol for interworking with the organization-specific personnel management system and can make it an API. In addition, it is possible to define a protocol for linking authority for personnel policy payment by institution, and to make it an API.

The policy management module 23 may perform policy setting functions, such as agent rule definition and management. Here, management can include editing, adding, deleting, and setting permissions. The policy management module 23 can edit, add, and delete the list of programs available for each user and group, and can edit, add, and delete permission to access usage data for each user and group.

The storage management module 24 plays a role of storing and managing a video recording a rule violation situation. You can store videos that record the violations of rules for each user and group, and periodically check the storage status and manage storage usage (used/remaining capacity) to determine the stored status.

The user management module 25 may register and manage agencies based on users and groups, and may perform a management role of adding, deleting, and modifying information of users or groups.

The qualification management module 26 may receive information of a user or group from a database and perform a role of determining whether a user who is currently accessing has access to the qualification.

As described above, when the user accesses the cloud computing environment, the agent 10 monitors and manages suspicious behaviors using malicious, leaked, or unauthorized programs, and the server 20 suspicious behaviors and rule violations When an action occurs, the security of the cloud server can be improved by recording and managing the recorded action based on video compression.

In the above, the present invention has been mainly described with respect to its preferred embodiment, but this is merely an example and does not limit the present invention, and a person having ordinary knowledge in the field to which the present invention belongs does not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications not illustrated above are possible. For example, each component specifically shown in the embodiments of the present invention can be implemented by modification. And differences related to these modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

Claims (3)

A security service system composed of an agent and a server to cope with security incidents that may occur by users accessing the cloud computing system.
The agent includes: an agent rule monitoring module for setting and managing user rights through user's PC login and interworking with a server;
An activity recording module that generates a real-time capture and video of a PC usage screen of a user who is using a PC by accessing a cloud server, and compresses and stores it;
A transmit/receive module that reports and records the user's PC usage status and transmits data to the agent rule monitoring module;
A process hooking module that tracks the process-based real-time user program usage from the OS;
A cloud-based security service system that includes an event hooking module that analyzes and defines operating system events that match the agent rule monitoring scenario. According to claim 1,
The server,
Dashboard modules that visually display information on user status, evidence storage management, and real-time storage usage and status management, agency linkage modules that perform interworking functions with agency-related human resource management systems, and agent rule definition and management The policy management module that performs the policy setting function, the storage management module that stores and manages the video recording the rule violation by the user, and the user management module that registers and manages the agency based on the user or group. Including cloud-based security service system. According to claim 2,
According to the policy set by the policy management module, the agent rule monitoring module monitors the suspicious behavior of users connected to the PC and records and stores the behavior based on video compression when an action that violates the policy is stored. system.

Images