KR20240003253A - VDI integrated operation management server for providing digital working environment and method thereof - Google Patents

Abstract

The present invention relates to a VDI integrated operation management server for providing a digital work environment, comprising a connection security module that performs user authentication on user login information received from a user terminal device to access a virtual desktop, and An integrated management module that manages set user policies and administrator policies set for administrators, manages user terminal devices and virtual desktops remotely connected to the virtual desktop, and generates data while the user is working by accessing the virtual desktop through the user terminal device. It includes a digital business analysis module that analyzes digital business data, and a VDI management module that manages the VDI server that provides virtual desktops on a multi-tenancy basis.

Description

VDI integrated operation management server and method for providing a digital working environment {VDI integrated operation management server for providing digital working environment and method thereof}

The present invention relates to a VDI integrated operation management server and method for providing a digital work environment.

Recently, digital work systems such as telecommuting have been expanded in public institutions and companies, but unlike the office work environment, most telecommuting systems consist only of personal computing devices. As a result, there are limits to the telework system in implementing various functions similar to an office work environment or responding to problems when they occur.

Currently, the digital work environment most widely adopted by public institutions is the VDI (Virtual Desktop Infrastructure) environment. In order to work from home stably and securely in a network separation environment, most public institutions use the VDI environment. there is.

However, the existing digital work environment operates individual solutions such as operation management solutions, remote access management servers, attendance management servers, and PC security servers, so there are many overlapping similar functions for each solution, and these similar functions result in a lot of waste of resources. , when a problem occurs, it takes a long time to determine the cause of the problem, which solution or which server caused the problem.

In addition, the hypervisors mainly used for digital work environments are XenServer, vSphere, and Acropolis products, but these existing products cannot be migrated at the user's level, and have the disadvantages of making it difficult to manage multiple digital tasks in one place. It has the disadvantage of being weak in security, as incidents such as data leakage due to desktop use and major information leakage through hacking occur frequently.

Domestic Public Patent No. 10-2012-0085434

In order to solve the above-mentioned problems, the technical task that the present invention aims to achieve is to create a digital work environment that can compensate for the shortcomings of security vulnerabilities by managing the desktop cloud in one place and applying security function enhancement when linking the work-from-home system. The purpose is to present a VDI integrated operation management server and method for providing VDI.

The problems of the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

As a means to solve the above-mentioned technical problem, the VDI integrated operation management server for providing a digital work environment according to an embodiment of the present invention performs user authentication on the user's login information received from the user terminal device to provide a virtual work environment. an access security module that allows access to the desktop; an integrated management module that manages user policies set for users and administrator policies set for managers, and manages user terminal devices and virtual desktops remotely connected to the virtual desktop; A digital work analysis module that analyzes digital work data generated while a user works by accessing a virtual desktop through the user terminal device; and a VDI management module that manages the VDI server providing the virtual desktop on a multi-tenancy basis.

The access security module provides SSO (Single Sign On) service using login information received from the user terminal device, and inputs the user's access log into a connection abnormality detection model to analyze whether the user has abnormal access. .

The integrated management module can automate the operation of checking server resource usage, managing remote access of the user terminal device, checking for abnormalities when providing virtual desktop services, and identifying virtual desktop connection failures using RPA (Robot Process Automation). .

The digital work analysis module inputs digital work data including at least one of the user's mouse and keyboard usage log, network usage data, and access IP (Internet Protocol) from the user terminal device into a work pattern analysis model to determine the user's work status. You can analyze patterns and whether abnormal user behavior occurs.

If the digital business analysis module determines that an abnormal behavior has occurred as a result of analyzing the digital business data, it reports to the access security module, and the access security module reports the illegal data leak if the abnormal behavior that has occurred is illegal data leakage. You can insert a watermark into data that has been attempted to be leaked, or block data leakage at its source.

It may further include a streaming module that records user commands and operations of the virtual desktop performed by the user commands while the user terminal device connects to the virtual desktop and works.

It may further include a digital work collaboration module that provides a number of collaboration tools to provide a cloud-based joint work environment and a work management application that manages work for each user.

The digital work collaboration module supports work automation by linking the multiple collaboration tools and work management applications using RPA (Robot Process Automation) while the user works using the multiple collaboration tools and work management applications. You can.

Meanwhile, the VDI integrated operation management method for providing a digital work environment according to another embodiment of the present invention is (A) the access security module of the VDI integrated operation management server records the user's login information received from the user terminal device. performing user authentication to access the virtual desktop; (B) the VDI management module of the VDI integrated operation management server allocating a virtual desktop to the user terminal device and managing the VDI server providing the virtual desktop based on multi-tenancy; (C) the digital work analysis module of the VDI integrated operation management server analyzing digital work data generated while the user is working by accessing a virtual desktop through the user terminal device; and (D) the integrated management module of the VDI integrated operation management server manages user policies set for users and manager policies set for managers, and manages user terminal devices and virtual desktops remotely connected to the virtual desktop. May include ;.

In step (A), SSO (Single Sign On) service is provided using login information received from the user terminal device, and the user's access log is input into the connection abnormality detection model to analyze whether the user's abnormal connection is present. there is.

In step (D), the operation of checking server resource usage, managing remote access of the user terminal device, checking for abnormalities when providing virtual desktop services, and identifying virtual desktop connection failures can be automated using RPA (Robot Process Automation). there is.

In the step (C), digital work data including at least one of the user's mouse and keyboard usage log, network usage data, and access IP (Internet Protocol) are input from the user terminal device into the work pattern analysis model to determine the user's work time. You can analyze patterns and whether abnormal user behavior occurs.

In step (C), if the digital business analysis module determines that an abnormal behavior has occurred as a result of analyzing the digital business data, it reports to the access security module, and the access security module determines that the abnormal behavior that has occurred is illegal. In the case of data leakage, a watermark can be inserted into the data where the illegal data leakage was attempted, or the data leakage can be blocked at the source.

(E) recording, by the streaming module of the VDI integrated operation management server, a user command and an operation of the virtual desktop performed by the user command while the user terminal device is connected to the virtual desktop and working; You can.

(F) The digital work collaboration module of the VDI integrated operation management server provides a number of collaboration tools to provide a cloud-based joint work environment and provides a work management application that manages work for each user to enable collaboration. A processing step may be further included.

In step (F), the digital work collaboration module uses RPA (Robot Process Automation) while the user is working using the plurality of collaboration tools and work management applications. Work automation can be supported by linking.

According to the present invention, it is possible to provide a smart office environment by safely supporting non-face-to-face work, work sharing, collaboration, etc. through cloud-based VDI solutions and system reinforcement.

In addition, according to the present invention, when accessing a virtual desktop and doing digital work, abnormal work or access behavior of the user can be detected based on artificial intelligence, and external leakage of key information can be prevented.

In addition, according to the present invention, it is possible to establish digital work standardization and standardization processes in public institutions by providing a smart work cloud platform.

In addition, according to the present invention, it is possible to provide an intelligent service platform for improving work efficiency based on user information, providing systematic work processing and work content data collection and management processes.

In addition, according to the present invention, instead of purchasing and installing security solutions, digital work solutions, and remote management solutions individually for the existing digital work environment, each of these solutions is integrated into one solution, thereby reducing compatibility issues between each solution and security. It can solve problems, purchase costs, etc. and improve work convenience.

In addition, according to the present invention, it is possible to manage the desktop cloud in one place and apply enhanced security functions when linking the digital work system to compensate for the shortcomings of security vulnerabilities.

The effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a diagram illustrating a VDI integrated operation management system for providing a digital work environment according to an embodiment of the present invention;
Figure 2 is an example diagram for explaining the SSO service during digital work of the access security module 410,
Figure 3 is a diagram illustrating VPN prior authentication using VPN tunneling;
Figure 4 is a conceptual diagram to explain authentication operation when the OIDC protocol higher than OAuth 2.0 is added;
Figure 5 is an example diagram to explain the screen security function,
Figure 6 is a diagram illustrating multiple collaboration tools and work management applications;
Figure 7 is an example screen of a work management application,
Figure 8 is a diagram to explain support for integrated task automation by linking functions between RPA, collaboration tools, and collaboration apps;
Figure 9 is a diagram showing an intelligent document integrated management platform supported by the digital work collaboration module 440;
Figure 10 is a conceptual diagram for explaining the overall operation of the VDI integrated operation management system for providing a digital work environment according to the embodiment of the present invention described above, and
Figure 11 is a flowchart schematically showing a VDI integrated operation and management method for providing a digital work environment according to an embodiment of the present invention.

The above objects, other objects, features and advantages of the present invention will be easily understood through the following preferred embodiments related to the attached drawings. However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. Rather, the embodiments introduced herein are provided so that the disclosed content will be thorough and complete and so that the spirit of the present invention can be sufficiently conveyed to those skilled in the art.

In some cases, it is mentioned in advance that when describing the invention, parts that are commonly known but are not significantly related to the invention are not described in order to prevent confusion without any reason in explaining the invention.

In this specification, when terms such as first, second, etc. are used to describe components, these components should not be limited by these terms. These terms are merely used to distinguish one component from another.

Additionally, when a first component is referred to as operating or executing on a second component (ON), the first component is operating or executing in an environment in which the second component is operating or executing, or is connected to the second component. It should be understood as being operated or executed through direct or indirect interaction.

When a component, device, or system is said to contain a component consisting of a program or software, even if explicitly stated, that component, device, or system refers to the hardware (hardware) necessary for the program or software to run or operate. For example, memory, CPU, etc.) or other programs or software (for example, drivers necessary to run an operating system or hardware, etc.).

Additionally, unless otherwise specified, it should be understood that the component may be implemented in any form of software, hardware, or both software and hardware.

Additionally, the terms used in this specification are for describing embodiments and are not intended to limit the present invention. As used herein, singular forms also include plural forms, unless specifically stated otherwise in the context. As used in the specification, 'comprises' and/or 'comprising' does not exclude the presence or addition of one or more other elements.

Additionally, in this specification, terms such as 'unit', 'module', 'server', 'system', 'platform', 'device' or 'terminal' refer to hardware and software driven by or for driving the hardware. It may be intended to refer to the functional and structural combination of. For example, the hardware here may be a data processing device including a CPU or other processor. Additionally, software driven by hardware may refer to a running process, object, executable, thread of execution, program, etc.

In addition, the above terms may mean a logical unit of hardware resources for executing a predetermined code and the predetermined code, and do not necessarily mean a physically connected code or one type of hardware. It can be easily inferred by an average expert in the technical field.

Hereinafter, specific technical details to be implemented in the present invention will be described in detail with reference to the accompanying drawings.

Each configuration of the virtual desktop service system for enhancing security functions shown in Figure 1 indicates that it can be separated functionally or logically, which means that each configuration must be divided into a separate physical device or written in separate code. An average expert in the technical field of the present invention can easily infer that this is not the case.

In addition, the administrator terminal device 100, user terminal device 200, VDI server 300, and VDI integrated operation management server 400 shown in FIG. 1 include a desktop PC (Personal Computer), a laptop PC (Laptop PC), It can be any electronic device that can install and run programs, including a storage medium and processor, such as a netbook computer or smartphone.

Storage media include flash memory, hard disk, SSD (Solid State Disk), SD card (Secure Digital Card), and RAM (Random Access) that can store instructions executed by the processor. Memory), SRAM (Static Random Access Memory), ROM (Read Only Memory), PROM (Programmable Read Only Memory), EEPROM (Electrically Erasable and Programmable ROM), and EPROM (Erasable and Programmable ROM). .

The processor may be electrically connected to a wired or wireless communication interface module, a user interface module such as a keyboard, and a storage medium. Processors include Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing unit (CPU), microcontroller, and microprocessor. The operation of each device or server can be controlled, including at least one of the following processing devices.

Additionally, DB 470 may refer to a functional and structural combination of software and hardware that stores information. The DB 470 may be implemented with at least one table, and may further include a separate DBMS (Database Management System) for searching, storing, and managing information stored in the DB 470. In addition, it can be implemented in various ways, such as a linked-list, tree, or relational DB, and includes all data storage media and data structures that can store information corresponding to the DB.

Figure 1 is a diagram illustrating a VDI integrated operation management system for providing a digital work environment according to an embodiment of the present invention.

The VDI integrated operation management system for providing a digital work environment according to the embodiment of the present invention shown in Figure 1 provides virtual desktop infrastructure (VDI) services in a network separation environment separated into an Internet network and a business network. As a system for doing so, it enables digital work using a virtual machine (VM), and can be implemented to meet the secure communication function required by the security function certification of the country or public institution to strengthen the security function. Digital work is work performed in a network separation environment, and examples of the present invention include telework and remote work.

The VDI service may include technology to virtualize another desktop running within an actual operating computer and provide it to the user environment by linking it with the VDI integrated operation management server 400.

Referring to Figure 1, the VDI integrated operation and management system for providing a digital work environment according to an embodiment of the present invention includes an administrator terminal device 100, a user terminal device 200, a VDI server 300, and VDI integrated operation management. It may include a server 400.

The administrator terminal device 100 may be a computing device for the administrator to access the VDI integrated operation management server 400, or may be a user interface such as a keyboard connected to the VDI integrated operation management server 400.

The user terminal device 200 may install and execute the user digital work program (or application) and user agent provided by the VDI integrated operation management server 200 in memory (not shown) for digital work services.

The digital work program for users can be linked with the digital work program and VDI program for managers.

The user terminal device 200 executes a digital work program for the user, allows the user to log in to the VDI integrated operation management server 400, accesses the assigned virtual desktop (i.e., virtual machine), displays the virtual desktop screen, and You can provide a user portal to perform tasks via desktop. In other words, a digital work program for users can provide a user portal to enable work in a virtual desktop environment.

The user agent is an agent that interacts with the agent of the virtual desktop assigned to the user terminal device 200 (hereinafter referred to as 'VD agent'), and can detect and block security violation events that occur in the user terminal device 200. . Security violation events include events that capture work-related screens displayed on a virtual desktop and events that collect key input information (passwords and key information, etc.) through illegal programs. Therefore, the user agent can provide screen capture prevention and keylogging prevention functions to prevent key information leakage when accessing a virtual desktop.

The VDI server 300 provides infrastructure for providing virtual desktops to multiple users. The VDI server 300 can execute a VDI program to individually assign virtual desktops to each user and activate a VD agent that interacts with the virtual desktop assigned to the user.

The VD agent may perform integrity verification while the virtual desktop is booting and store the event results of the integrity verification in the DB 470. In detail, the VD agent receives data required for integrity verification by calling the API (Application Programming Interface) of the VDI integrated operation management server 400 while the virtual desktop to be assigned to the user is booting, and receives a plurality of data from the DB 470. You can receive a list of files.

Data required for integrity verification received from the VDI integrated operation management server 400 may include at least one of a whitelist and a blacklist. The multiple file lists received from DB 470 include executable files, settings, processes, libraries, etc., and each has a file name and a hash ID.

The VD agent performs integrity verification to determine whether the hash ID has been changed by comparing the hash ID of multiple file lists with at least one of the whitelist and blacklist, and records the integrity verification result as an audit record of DB 470 through the API. It can be stored in a table. This is because the hash ID also changes when hacking, virus intrusion, or forced changes to the executable file occur.

If the integrity verification result determines that there is no problem, that is, the hash ID has not been changed, the DDC (Desktop Delivery Controller) server (not shown) sends the integrity verification result received from the VD agent to the VDI integrated operation management server ( 400). The VDI integrated operation management server 400 displays a screen for logging into the virtual desktop on the user terminal device 200.

Since user authentication has been completed in the Active Directory (AD) server (not shown), the DDC server (not shown) can assign a booted virtual desktop to the user terminal device 200 and connect a user session with the assigned virtual desktop.

The VDI integrated operation management server 400 performs user authentication by transmitting the user ID and password input from the user to the AD server (not shown). When user authentication is completed, the DDC server (not shown) connects the booted virtual desktop and the user session, whereby the VDI server 300 provides a virtual desktop environment to the user terminal device 200, and the user terminal device ( 200) can remotely connect to the virtual desktop and display the screen of the virtual desktop.

The user performs the desired task through the screen displayed on the user terminal device 200. While the user accesses the virtual desktop through the user terminal device 200 and performs work, the VD agent monitors whether a security-related event occurs, and when a security-related event occurs, it can control the virtual desktop.

Security-related events include, for example, attempts to change the IP (Internet Protocol) assigned to the virtual desktop, attempts to share non-shareable folders, and attempts to execute non-executable files, and include hacking of the user terminal device 200 or It can be caused by viruses, etc. When a security-related event is detected, the VD agent can control the virtual desktop to block IP changes, block folder sharing, or prevent files from being executed.

Meanwhile, the VDI integrated operation management server 400 operates and manages integrated security solutions, digital business solutions, and VDI operation management solutions to provide digital business services, thereby improving not only the user's business convenience but also the administrator's business convenience. there is.

The VDI integrated operation management server 400 can install and run a digital work program for administrators to provide digital work services. The digital work program for administrators is a virtualization environment integrated operation management solution that provides an administrator portal for automatic provisioning and operation management in conjunction with the user digital work program, DDC server program, AD server program, and VDI program.

The VDI integrated operation management server 400 runs a digital business program for administrators and comprehensively provides user management functions linked to an AD server (not shown), monitoring functions for stable operation and failure management, and internal/external security reinforcement functions. It can provide a solution that facilitates user accessibility in various browsers through a Java-based web application.

In addition, the VDI integrated operation management server 400 runs a digital business program for administrators to enable resource management in one space for comprehensive and efficient operation and management of virtualized IT resources, and enables the life cycle of virtualization systems and images. We can provide an integrated operation management solution for virtualized environments that supports management. In particular, account management for authorized users in preparation for security-related incidents such as data leakage through virtual desktops and illegal acquisition of key information through illegal program installation, system protection function due to integrity damage due to illegal hacking, and prevention of forced termination of major processes. Encryption function can be provided to prevent information leakage due to plain text communication between functions.

To this end, the VDI integrated operation management server 400 includes a connection security module 410, an integrated management module 420, a digital business analysis module 430, a digital business collaboration module 440, a streaming module 450, and a VDI management module. It may include (460) and DB (470).

The access security module 410 may operate or manage access to a virtual desktop by performing user authentication on the user's login information received from the user terminal device 200. The access security module 410 can provide security for a remotely accessed terminal (user terminal device 200 or virtual desktop), user security using a user authentication protocol, and screen security functions.

First, to describe the remote access terminal security function, the access security module 410 provides a SSO (Single Sign On) service using login information (e.g., ID and password) received from the user terminal device 200. can be provided.

Figure 2 is an example diagram for explaining the SSO service during digital work of the access security module 410.

Referring to FIG. 2, the access security module 410 uses login information entered during the initial virtual desktop boot to perform VPN (Virtual Private Network) tunneling for encrypted communication, VPN prior authentication, and terminal control server (e.g., DDC server or AD server), a VDI integrated operation management server 400 that provides a VDI management portal, and an SSO service that provides integrated login to the VDI server 300 can be provided.

Additionally, the access security module 410 can provide a dynamic authentication service to enable authentication when using multiple applications (eg, collaboration tools) and services provided by the present invention using the input login information.

In addition, the access security module 410 stores the login information used in the authentication process in the form of a token in the SSO Daemon through PAM (Pluggable Authentication Modules), and the stored token can be used to run an integrated business portal and VDI. It can be managed or processed so that it can be managed or processed.

Figure 3 is a diagram to explain VPN prior authentication using VPN tunneling.

Referring to FIG. 3, the access security module 410 prevents security risks that may arise from external intrusions such as hacking and malware from external remote access terminal devices attempting to access the user terminal device 200 or the virtual desktop. To prevent this, VPN pre-authentication can be performed. The access security module 410 performs VPN tunneling through a network connected at the kernel end immediately after starting the Network service Deamon during the booting process of the user terminal device 200 or a virtual desktop to be assigned to the user terminal device 200 for prior authentication of the VPN. can be concluded. Through the connected VPN tunneling, after the integrity review, the remaining Service Demons required for booting are run and the OS shell that can be manipulated by the user is executed, and the operation of the terminal OS is completed.

Next, the user security and screen security functions using the user authentication protocol will be described. The access security module 410 can perform OAuth/OIDC (Open Authorization / OpenID Connect)-based authentication.

Figure 4 is a conceptual diagram to explain the authentication operation when the OIDC protocol higher than OAuth 2.0 is added.

Referring to FIG. 4, the access security module 410 can provide an open standard protocol that can authenticate application user login information without providing it to an external app. In other words, the access security module can request authentication from or to another application, enabling the provision of resources and services to each other. This is an Authorization Code Grant method that allows the use of linked apps without separate login when the refresh token is permanently stored on the server. Based on the OAuth 2.0 protocol, authentication can be easily processed at the upper layer. OIDC requests service by transmitting the Access Token and ID Token to the application server, stores user information in an encrypted token through JWT (JSON Web Token), and contains user information in the ID Token, so no API call is required. This can reduce the number of calls.

Next, when explaining the screen security function, the access security module 410 applies a watermark to the content using its own screen transmission protocol rather than the MS RDP (Remote Desktop Protocol) used in existing VDI solutions. After insertion, it can be transmitted to the user terminal device 200.

Figure 5 is an example diagram for explaining the screen security function.

Referring to FIG. 5, when a user requests image downloading from a virtual desktop, the access security module 410 requests the watermark engine to insert a watermark, and the virtual desktop sends the watermarked image to the user terminal device. You can download it at (200). As a result, document forgery and alteration in the user terminal device 200 can be fundamentally prevented.

Additionally, the access security module 410 may input the user's access log into a connection abnormality detection model to analyze whether the user has abnormal access. The connection abnormality detection model is an artificial intelligence model that can detect connection abnormalities by learning the connection log data of multiple users. The access security module 410 can detect abnormal access logs by inputting a number of access log data, such as the user's login pattern, login location, and IP change of the login terminal, into a connection anomaly detection model. If it is detected that a user has made an abnormal connection, the access security module 410 may terminate the connected user session or block user login.

Additionally, the access security module 410 can strengthen security authentication by allowing login using a biometric authentication method based on SNS (Social Network Service) or supporting a vOTP (Virtual One Time Password) method.

Referring again to FIG. 1, the integrated management module 420 manages the user policy set for the user and the administrator policy set for the manager, and the user terminal device 200 remotely connected to the virtual desktop and the VDI that provides the virtual desktop. The server 300 can be integrated and managed. The user policy may, for example, disconnect the session if no logs, events, etc. occur from the user terminal device 200 for a certain period of time.

Additionally, the integrated management module 420 can support operational automation using RPA (Robot Process Automation). [Table 1] shows an example of operational automation support using RPA.

Referring to [Table 1], the integrated management module 420 checks the resource usage of the VDI integrated operation management server 400, manages remote access of the user terminal device 200, and checks for abnormalities in the virtual desktop when providing virtual desktop services. And the identification of virtual desktop access failures can be automated using RPA.

The digital work analysis module 430 can analyze digital work data generated while a user works by accessing a virtual desktop through the user terminal device 200.

The digital work analysis module 430 inputs digital work data including at least one of the user's mouse and keyboard usage log, network usage data, and access IP (Internet Protocol) from the user terminal device 200 into the work pattern analysis model. You can analyze the user's work patterns and whether abnormal user behavior occurs. The work pattern analysis model is a machine learning-based data analysis model created by learning the user's previous mouse and keyboard use logs, network usage data, and access IP. It includes not only the user's work start and end time, but also information that deviates from the usual work pattern. Abnormal behavior and abnormal work can also be detected. For this purpose, the user's usual work patterns can be learned.

The digital work analysis module 430 may report to the access security module 410 if it is determined that an abnormal behavior has occurred as a result of the work pattern analysis model analyzing the digital work data. The access security module 410 analyzes the reporting, and if the abnormal behavior occurring in the user terminal device 200 is an illegal data leak, it inserts a watermark into the data where the illegal data leak was attempted, or inserts a watermark into the virtual desktop to block the data leak at the source. You can request it from .

The digital work collaboration module 440 provides a number of collaboration tools to provide a cloud-based joint work environment and can provide a work management application that manages work for each user.

Figure 6 is a diagram to explain a number of collaboration tools and work management applications.

Referring to Figure 6, multiple collaboration tools include messengers, notes, drives, and calendars, and a task management app refers to a task management application.

Messenger supports communication between workers, that is, between users, transfers and stores images, videos, files, etc., provides real-time notifications when messages are received, links with external apps through webhooks, and handles real-time messaging through websockets. can be provided.

Notes provide an editor (e.g., HTML) for users to write simple notes and memos, and can provide note management using chapter or page division, history storage, and external sharing and downloading of notes.

Drive can provide functions for uploading, downloading, renaming files and folders, previewing files, and sharing files externally via URL.

The calendar can provide registration and management of the user's personal schedule, registration and management of the schedule of the user's group, linking and sharing of external calendars in iCal data format, and schedule notification functions through the scheduler.

Figure 7 is an example screen of a work management application.

Referring to FIG. 7, the task management application can allocate tasks between users and provide individual task management functions. To explain in more detail, the task management application creates groups on a project basis to enable user task registration and management. The work management application defines user work in task units and sets a person in charge to manage the status of the task (to-do, in process, completed, pending, etc.). In addition, the work management application allows detailed progress to be shared with department members or group members through other users' comments, files, and to-dos written for each task. Individual users or groups can monitor work progress in real time through the status of tasks.

In addition, the digital work collaboration module 440 can support work automation by linking multiple collaboration tools and work management applications using the RPA method while the user works using multiple collaboration tools and work management applications. .

Figure 8 is a diagram to explain support for integrated task automation by linking functions between RPA, collaboration tools, and collaboration apps.

Referring to FIG. 8, the digital work collaboration module 440 uses the RPA function to notify Person A and Person B of the work to be done and automatically share the schedule when the time to start work on the calendar arrives. . In addition, when person in charge A completes work processing, the digital work collaboration module 440 can automatically share or automatically deliver the work processing results to person in charge B using the RPA function and support communication between person A and B.

In addition, the digital work collaboration module 440 uses the RPA function to automatically request decisions from managers A and B, automatically links video conferences to provide non-face-to-face meetings for decision-making, and provides information on shared opinions and meeting history. You can manage your history by automatically writing things into notes.

In addition, the digital work collaboration module 440 can use the RPA function to store and manage work processing results and decision-making results on a drive and set/support data sharing between personnel.

In addition, the digital work collaboration module 440 can use the RPA function to automatically register as a task in the work management application when user intervention is required during RPA work. As a result, a new task can be automatically registered in the To-Do list in FIG. 7. When the task status of the person in charge (i.e., the user) is changed to Complete, the digital work collaboration module 440 can automatically re-perform another or the same RPA task.

In addition, the digital work collaboration module 440 uses a messenger bot account among the RPA functions to provide a task notification to the person in charge when a work bottleneck section occurs, thereby eliminating the work bottleneck section.

Figure 9 is a diagram showing an intelligent document integrated management platform supported by the digital work collaboration module 440.

Referring to FIG. 9, the digital work collaboration module 440 can further perform an intelligent document integrated management function. The digital work collaboration module can process documents with various extensions so that multiple users can co-edit them in real time on the cloud. For example, when a group wants to jointly edit a Korean document, when person in charge 1 changes the font, the digital work collaboration module 440 shares the changed font on the screen with other people in the group, and multiple people in charge You can manage the change history and the conversion authority of each person in charge.

Referring again to FIG. 1, the streaming module 450 performs commands generated by the user terminal device 200 and operations of the virtual desktop performed by user commands while the user terminal device 200 is working by accessing the virtual desktop. All user operations can be recorded, including: For example, all user operations, such as the user's typing status, the name of the executed program, and data read from the DB 470 by the virtual desktop, can be recorded. When a security incident occurs in the virtual desktop later, the user operation recorded by the streaming module 450 is reversed in the access security module 410 or the integrated management module 420 to determine whether the user issued a command related to a security violation. Can be used for tracking.

The VDI management module 460 can manage the VDI server 300, which provides an independent virtual desktop for each user, on a multi-tenancy basis. The VDI management module 460 can control the configured hypervisor, broker service, and AD, and manage the life cycle (VM LifeCycle) of the virtual desktop. For example, the VDI management module 460 provides Daas (Device as Service) VDI service on a multi-tenancy basis, and in this case, XenServer, vSphere, or Acropolis can be used as a hypervisor, but this is limited to this as an example. It doesn't work.

Figure 10 is a conceptual diagram for explaining the overall operation of the VDI integrated operation management system for providing a digital work environment according to the embodiment of the present invention described above.

Referring to FIG. 10, when the user terminal device 200 connects to the VDI integrated operation management server 400, the VDI integrated operation management server 400 performs user authentication by strengthening the security authentication method, and at this time, If abnormal access is detected based on AI, user access can be blocked. The VDI integrated operation management server 400 controls the multi-tenancy-based VDI server 300, and the VDI server 300 allocates virtual desktops (VDs) to users.

The user performs digital work by accessing the virtual desktop and the work server 10 through the user terminal device 200. At this time, the VDI integrated operation management server 400 analyzes the user work pattern based on AI and detects abnormalities. Work can be detected.

In addition, when a video conference is in progress, the VDI integrated operation management server 400 records the video conference streaming in conjunction with the video conference server 20 and stores it in the DB 470, and stores the saved streaming in the streaming server 30. It may also be processed to be compressed and transmitted to the user terminal device 200.

Therefore, the VDI integrated operation management system, or VDI integrated operation management server 400, for providing a digital work environment according to the embodiment of the present invention described above includes a security authentication function (SNS / vOTP), a multi-tenancy support function, and DaSS. It can provide integrated VDI management functions, VM LifeCycle management functions, access statistics/history management functions, work pattern analysis functions, and PC/VM integrated security management functions.

Figure 11 is a flowchart schematically showing a VDI integrated operation and management method for providing a digital work environment according to an embodiment of the present invention.

The VDI integrated operation management method shown in FIG. 11 can be operated by the VDI integrated operation management server 400 described with reference to FIGS. 1 to 10, and detailed description is omitted as it has been described above.

Referring to FIG. 11, the access security module 410 of the VDI integrated operation management server 400 performs user authentication on the user's login information received from the user terminal device 200, and when authentication is completed, the user terminal device ( 200) can be processed to access the virtual desktop (S1110).

In step S1110, an SSO service can be provided using login information received from the user terminal device 200, and the user's access log can be input into a connection abnormality detection model to analyze whether the user has abnormal access.

The VDI management module 460 may allocate a virtual desktop to the user authenticated user terminal device 200 and manage the VDI server providing the virtual desktop on a multi-tenancy basis (S1120).

The digital work analysis module 430 can analyze digital work data generated while the user works by accessing the virtual desktop through the user terminal device 200 (S1130).

In step S1130, digital work data including at least one of the user's mouse and keyboard usage log, network usage data, and access IP occurring in the user terminal device 200 is input into the work pattern analysis model to determine the user's work pattern and the user's work pattern. It is possible to analyze whether abnormal behavior (e.g., illegal downloading, screen capture, etc.) has occurred.

In addition, in step S1130, if it is determined that an abnormal behavior has occurred as a result of analyzing the digital business data, the digital business analysis module 430 reports to the access security module 410, and the access security module 410 reports the abnormal behavior that has occurred. In the case of illegal data leakage, a watermark can be inserted into the data where the illegal data leakage was attempted, or data leakage can be blocked at the source.

The digital work collaboration module 440 provides a number of collaboration tools to provide a cloud-based joint work environment, and provides a work management application that manages work for each user to enable collaboration between users (S1140) . Step S1140 can support work automation by linking multiple collaboration tools and work management applications using RPA (Robot Process Automation) while the user works using multiple collaboration tools and work management applications.

The streaming module 450 may record user commands and operations of the virtual desktop performed by user commands while steps S1130 and S1140 are performed, that is, while the user terminal device 200 is connected to the virtual desktop and working. There is (S1150).

The integrated management module 420 manages the user policy set for the user and the administrator policy set for the manager while steps S1110 to S1150 are performed, and the status of the user terminal device 200 remotely connected to the virtual desktop and the virtual desktop. , you can manage the server status for digital work such as security (S1160). In step S1160, the operation of checking the resource usage of the servers 300 and 400, managing remote access of the user terminal device 200, checking for abnormalities when providing virtual desktop services, and identifying virtual desktop access failures can be automated using RPA. .

In the above, even though all the components constituting the embodiment of the present invention have been described as being combined or operated in combination, the present invention is not necessarily limited to this embodiment. That is, as long as it is within the scope of the purpose of the present invention, all of the components may be operated by selectively combining one or more of them. In addition, although all of the components may be implemented as a single independent hardware, a program module in which some or all of the components are selectively combined to perform some or all of the combined functions in one or more pieces of hardware. It may also be implemented as a computer program with . The codes and code segments that make up the computer program can be easily deduced by a person skilled in the art of the present invention. Such a computer program can be stored in a computer-readable storage medium and read and executed by a computer, thereby implementing embodiments of the present invention.

Meanwhile, although the preferred embodiments have been described and illustrated to illustrate the technical idea of the present invention, the present invention is not limited to the configuration and operation as shown and described, and does not deviate from the scope of the technical idea. Without limitation, those skilled in the art will understand that many changes and modifications can be made to the present invention. Accordingly, all such appropriate changes, modifications and equivalents should be considered to fall within the scope of the present invention. Therefore, the true scope of technical protection of the present invention should be determined by the technical spirit of the attached registration claims.

100: Administrator terminal device
200: User terminal device
300: VDI server
400: VDI integrated operation management server

Claims (9)

In the VDI (Virtual Desktop Infrastructure) integrated operation management server that provides a digital work environment,
an access security module that performs user authentication on the user's login information received from the user terminal device and allows access to the virtual desktop;
an integrated management module that manages user policies set for users and administrator policies set for managers, and manages user terminal devices and virtual desktops remotely connected to the virtual desktop;
A digital work analysis module that analyzes digital work data generated while a user works by accessing a virtual desktop through the user terminal device; and
a VDI management module that manages the VDI server providing the virtual desktop on a multi-tenancy basis;
VDI integrated operation management server to provide a digital work environment including.
According to paragraph 1,
The access security module is,
A digital work environment that provides SSO (Single Sign On) service using login information received from the user terminal device and analyzes whether the user has abnormal access by inputting the user's access log into a connection abnormality detection model. VDI integrated operation management server to provide.
According to paragraph 1,
The integrated management module is,
A digital work environment characterized by automating the operation of checking server resource usage, managing remote access of the user terminal device, checking for abnormalities when providing virtual desktop services, and identifying virtual desktop access failures using RPA (Robot Process Automation). VDI integrated operation management server to provide.
According to paragraph 1,
The digital business analysis module is,
In the user terminal device, digital work data including at least one of the user's mouse and keyboard usage log, network usage data, and access IP (Internet Protocol) is input into the work pattern analysis model to generate the user's work pattern and user's abnormal behavior. VDI integrated operation management server to provide a digital work environment characterized by analyzing whether or not
According to paragraph 4,
The digital business analysis module is,
If it is determined that abnormal behavior has occurred as a result of analyzing the digital work data, it is reported to the access security module,
The access security module is,
If the abnormal behavior that occurred is an illegal data leak, a VDI integrated operation management server for providing a digital work environment characterized by inserting a watermark into the data where the illegal data leak was attempted or blocking the data leak at the source.
According to paragraph 1,
a streaming module that records user commands and operations of the virtual desktop performed by the user command while the user terminal device connects to the virtual desktop and works;
A VDI integrated operation management server for providing a digital work environment, further comprising:
According to paragraph 1,
A digital work collaboration module that provides a number of collaboration tools to provide a cloud-based joint work environment and a work management application that manages work for each user;
A VDI integrated operation management server for providing a digital work environment, further comprising:
In clause 7,
The digital work collaboration module is,
A digital task characterized by supporting work automation by linking the plurality of collaboration tools and work management applications using RPA (Robot Process Automation) while the user works using the plurality of collaboration tools and work management applications. VDI integrated operation management server to provide an environment.
In the VDI integrated operation management method of the VDI (Virtual Desktop Infrastructure) integrated operation management server that provides a digital work environment,
(A) allowing the access security module of the VDI integrated operation management server to perform user authentication on the user's login information received from the user terminal device to access the virtual desktop;
(B) the VDI management module of the VDI integrated operation management server allocating a virtual desktop to the user terminal device and managing the VDI server providing the virtual desktop based on multi-tenancy;
(C) the digital work analysis module of the VDI integrated operation management server analyzing digital work data generated while the user is working by accessing a virtual desktop through the user terminal device; and
(D) the integrated management module of the VDI integrated operation management server manages user policies set for users and manager policies set for managers, and manages user terminal devices and virtual desktops remotely connected to the virtual desktop;
VDI integrated operation management method to provide a digital work environment that includes.

Images