WO2017078198A1

WO2017078198A1 - Data security system

Info

Publication number: WO2017078198A1
Application number: PCT/KR2015/011844
Authority: WO
Inventors: 배종상
Original assignee: (주)와우소프트
Priority date: 2015-11-05
Filing date: 2015-11-05
Publication date: 2017-05-11

Abstract

A data security system according to the present invention may not only manage the document life cycle of an organization member but also enhance security by preventing leakage of security information during printing and sharing of documents. Further, as the data security system is provided with a function of transferring an electronic document in consideration of the authority of each user in a server-based electronic document management system, it is possible to enable smooth business cooperation while maintaining security, and when an electronic document is stored or outputted, it is possible to automatically detect security information and prevent leakage of the security information.

Description

Data security systems

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server-based electronic document management system, and more particularly, to a data security system for preventing security information from being leaked in a process of printing and sharing a document.

In an information society, all information inside an organization is treated as an electronic document. Therefore, it is very important to prevent the leakage of electronic documents containing security information.

Accordingly, various systems have been implemented, and the present applicant has implemented a system based on Korean Patent Publication No. 10-0943301 (name of the invention "server-based data security / management system").

In other words, we have implemented a system that detects all files generated by the application of the user computer and saves or modifies them and automatically uploads them to a specific server.

However, since the patent-based system processes based on the server explorer, there has been a problem that business cooperation with other users in the organization is not smooth. In other words, it is inconvenient for the electronic document file delivery because it cannot be set in the Windows Explorer of the local PC.

In addition, there is a problem that the system based on the patent lacks a function to prevent leakage by paying attention to specific security information. In other words, when a user wants to save or print an electronic document, if specific security information is included, the user cannot automatically detect and take action.

The technical problem of the present invention is to provide a data security system that can facilitate cooperation while maintaining security by providing a function for delivering electronic documents in consideration of user-specific authority in a server-based electronic document management system. .

An object of the present invention is to provide a data security system that can automatically detect the security information when you want to store or output the electronic document in the server-based electronic document management system so that the security information does not leak.

The present invention, in the data security system comprising a security agent 100 and the server 200,

A) detecting, by the security agent 100, that the user starts a document processing application installed on his PC;

B) the security agent 100 detecting that the user loads a document file or creates a new document through the server 200 explorer;

C) the security agent 100 when the user saves the file in the local temporary folder after saving the local temporary file locks or stores in a secure folder;

D) when the user closes the document, the security agent 100 stores the file stored in the local temporary folder or the secure folder on the server and deletes the file;

E) the security agent 100 transmits a log for opening, editing, and storing the file to the server 200; And

F) If the user deletes the document file loaded or the document being created in step B), the security agent 100 includes the step of transmitting a log for this to the server 200,

When the user wants to share the document file in step B) or C),

a) the security agent 100 providing a shared interface in the server 200 searcher;

b) security agent 100, providing a interface for a user to transfer document files to a shared folder and to select another user or group to share;

c) The server 200 may not meet the settings by selectively considering the security level of the document file to be shared, the user's authority, the authority of another user to share the file, the authority of the file sharing folder, or the authority of the group to share the file. In case of sharing, stopping the sharing procedure; And

d) In the case of sharing in accordance with the setting in step c), the server 200 allows sharing, and the security agent 100, characterized in that it comprises the step of transmitting a log for this, the data security system To solve the technical problem by providing.

In addition, when a specific pattern or keyword is detected in the document file or the document being created in step B) or C),

e) the security agent 100 transmitting a log thereof to the server 200; And f) the server 200 is to solve the technical problem by providing a data security system, characterized in that it comprises the step of isolating the detected document file or the document being created in a specific folder according to the setting.

In addition, when the user wants to output the document file or the document being created in step B) or C),

g) the security agent 100 transmitting a log including the output image to the server 200;

h) when the security agent 100 detects a specific pattern or keyword, it transmits a log thereof to the server 200, and the server 200 performs a pattern masking or approval procedure according to the setting; And

i) The security agent 100 is to solve the technical problem by providing a data security system, characterized in that it comprises the step of outputting a document by applying a watermark profile received from the server 200.

The data security system according to the present invention not only manages a document life cycle of an organization member, but also has an effect of enhancing security by preventing security information from being leaked during a process of printing and sharing a document.

Data security system according to the present invention, by providing a function to deliver the electronic document in consideration of the user-specific authority in the server-based electronic document management system, it is possible to smoothly work while maintaining security.

The data security system according to the present invention may automatically detect security information when a server-based electronic document management system attempts to store or output an electronic document so that the security information does not leak.

1 is a diagram illustrating a network environment to which a data security system according to the present invention is applied.

2 is a diagram showing the main configuration of a data security system according to the present invention.

3 is a diagram showing the main configuration of the manager service module 250 of the data security system according to the present invention.

4 to 7 are schematic diagrams illustrating the operation of the data security system according to the present invention.

In the data security system comprising a security agent 100 and a server 200,

When the user wants to share the document file in step B) or C),

b) the security agent 200, providing a interface for a user to transfer document files to a shared folder and to select another user or group to share;

d) In the case of sharing in accordance with the setting in step c), the server (200) allows sharing, and the security agent (100), characterized in that it comprises the step of transmitting a log for this, the data security system.

The terms or words used in this specification and claims are not to be construed as limiting in their usual or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. Based on the principle, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention.

A plurality of user PCs are connected to a network, and an electronic document can be output to a local printer or a network shared printer.

In addition, it is an environment in which the security agent 100 installed in each user PC continuously communicates with the server 200 while monitoring the I / O (INPUT / OUTPUT) and printing process of the user's electronic document file.

The data security system according to the present invention includes a security agent 100 and a server 200. The security agent 100 is automatically installed in the user PC and operates simultaneously with the booting of the PC to continuously monitor the user PC. The security agent 100 is configured to be managed and automatically upgraded by the server 200. Depending on the design conditions, the PC may not be used unless the user logs in to the security agent 100.

The security agent 100 is configured to include a login agent module 110, a file input / output control unit 120, a file navigation unit 130, and a security control unit 140.

The login agent module provides an interface for the user to log in to the security agent 100 at the same time the user PC is booted.

The file input / output control unit 120 includes a file open module, a file lock module, a file access log module, and a file uplog module.

The file open module is a user interface for navigating a file on a server and selecting a file for a file open command in a document processing application (eg, MS-WORD, MS-EXCEL, etc.) that a user wants to use. Play the role of providing.

The file lock module plays a role of saving a file stored in the server in a temporary folder of the user's computer when the application is opened in an application and preventing copying and leaking of the stored file.

Or, depending on the design conditions, you can designate a security zone folder on your computer and save it only to this folder. That is, the security zone is an area in which only allowed processes among the processes of the user computer can process files in the security zone folder. In addition, whether or not to allow a process may be set according to a user's authority.

Or, depending on the design requirements, users with low privileges may not be able to save files in a temporary folder or a secure folder at all.

The file access log module is responsible for transmitting logs for opening and storing files stored in the server.

The file upload module is responsible for uploading the stored file to the server and deleting the file from the user's computer.

The file navigation means 130 includes a user file navigation interface module and a shared interface module.

The user file navigation interface module provides a window explorer-like interface to user files stored on the server to facilitate easy access.

The shared interface module provides an interface for transferring files to a shared folder and selecting other users in order to deliver user files stored on the server to other users in the company. Here, when selecting another user, the individual or department can be selected.

In addition, in order to maintain security, the server 200 may be designed to allow sharing in consideration of both the rights of the user to be shared and the rights of the selected user.

The security control means 140 includes an output log transmission module, an authority storage module, a watermark module and a pattern detection module.

The output log transmission module performs a function of generating an image and information extracted from the electronic document as a log and transmitting it to the server when the user outputs the electronic document to the printer.

The authority storage module provides information to the server 200 by monitoring whether the user performs according to the correct authority while storing the user-specific authority transmitted from the server 200 and performing file input / output, sharing setup, and printing.

The watermark module performs a function of automatically inserting image or print information into a printout according to a watermark policy assigned to a user. In addition, when a pattern or keyword including security information is detected, a function of masking security information is performed.

The pattern detection module detects whether a pattern or keyword according to security information is included in the document generated by the user and the output document. That is, the server 200 receives information about the pattern of the social security number or the key word keyword and automatically detects whether the pattern or the keyword is included.

The server 200 is configured to include a login service module 210, a file log module 220, a file management service module 230, a print log module 240, an administrator service module 250, and a database 260. .

When the user enters his ID and password, the login service module 210 confirms the user and automatically upgrades the security agent 100 in association with other modules in the server 200. In addition, the user authority, watermark profile, and pattern detection information are stored in the user's computer.

The file log module 220 stores a log generated when a user opens, edits, stores, or deletes a file stored in a server.

It also saves the file log generated when a pattern or keyword is detected in a saved document or a document to be printed, or when sharing is set up.

In other words, it manages the user's file usage history (file creation, file open, file modification, file deletion, file storage, pattern detection and file sharing) so that administrators can track the distribution path of files and manage security information. Make sure

The file management service module 230 performs a function of storing a file created or stored by a user in a server, providing a navigation function for a file stored in the server, and providing a download service for a file selected by the user. do.

In addition, when a specific pattern or keyword is detected in the file processed by the user, it is managed to maintain security. In particular, an electronic document in which a specific pattern or keyword is detected may be stored in an isolation folder to inform an administrator.

In addition, it can search the user's PC as a whole to search the user's personal files.

The print log module 240 performs a function of storing an output image transmitted from a client in a server and storing output information in a database when outputting a document.

The manager service module 250 includes a user-specific permission setting module, a pattern setting module, a pattern masking module, a file history search module, an output approval module, and a sharing setting module. Mainly, functions to provide services such as user authority management, watermark profile management, file storage management, pattern management, log inquiry, output approval, and sharing settings (see FIG. 3).

For example, you can set certain patterns or security keywords to be masked when they are printed. In addition, if a specific pattern or security keyword is detected, an approval procedure may be set. In addition, when transferring files by transferring files to a shared folder, sharing can be set according to user's authority.

According to the design condition, the manager service module 250 may not be limited to the internal network but may access the server 200 using an external network such as the Internet at a remote location to obtain the above result.

The database 260 stores all of a user's authority, document file, watermark profile, pattern or security keyword, log information, output image, and the like, and sets a plurality of backup copies for the case.

1) When a user starts a document processing application installed in his PC, the security agent 100 detects this and starts monitoring.

2) The user uses the server 200 explorer to load an existing document stored in his or her folder or start creating a new document.

3) When the user saves the document, navigate to the Server Explorer folder and select the path. In this process, the document is saved as a local temporary file, the document is stored on the server after the temporary file is locked, and the local temporary file is deleted. Alternatively, the document may be stored in the local security area and then deleted. In this case, the folder in the security area may be set so that files in the folder may not be deleted or copied arbitrarily according to the permission of the process and the user. Alternatively, users with low privilege levels may be designed so that documents are not stored at all.

4) Logs for opening, editing and saving documents are sent to the server.

5) If a user deletes an existing document or deletes a document that is being created, the log for this is sent to the server. (Not shown)

When a user prints while generating a document or after storing a document, the operation is performed as shown in FIG. 5.

1) First, create a user output log and send it to the server. Here, the output log contains an image of the document to be printed.

2) Detect patterns or security keywords in the document to be printed.

3) If a pattern or security keyword is detected, pattern masking is performed according to the server setting.

4) If approval procedure is established, the supervisor will perform the approval.

5) After that, print the watermark reflecting the user profile.

When a user detects a pattern or security keyword while creating a document or after saving a document, a file log is generated and transmitted to the server. (See Figure 6)

You can also quarantine document files in separate folders and alert administrators with a warning message.

When a user wants to share a document, it operates as shown in FIG. 7.

1) The user sends the document file to a separate shared folder.

2) Select users or departments to share. If the server determines that the sharing is out of authority setting, it can notify the administrator, prevent the sharing procedure from being performed, or allow the approval process. For example, if the user's permission is not allowed to share the document, the user cannot share the document to a user with a lower level of security than the document's security level, or if the permissions of the shared folder do not match those of the user to be shared. The setting can be mentioned.

3) Send filelog about share to server.

Claims

In the data security system comprising a security agent 100 and a server 200,

A) detecting, by the security agent 100, that the user starts a document processing application installed on his PC;

B) the security agent 100 detecting that the user loads a document file or creates a new document through the server 200 explorer;

C) the security agent 100 when the user saves the file in the local temporary folder after saving the local temporary file locks or stores in a secure folder;

D) when the user closes the document, the security agent 100 stores the file stored in the local temporary folder or the secure folder on the server and deletes the file;

E) the security agent 100 transmits a log for opening, editing, and storing the file to the server 200; And

F) If the user deletes the document file loaded or the document being created in step B), the security agent 100 includes the step of transmitting a log for this to the server 200,

When the user wants to share the document file in step B) or C),

a) the security agent 100 providing a shared interface in the server 200 searcher;

b) security agent 100, providing a interface for a user to transfer document files to a shared folder and to select another user or group to share;

c) The server 200 may not meet the settings by selectively considering the security level of the document file to be shared, the user's authority, the authority of another user to share the file, the authority of the file sharing folder, or the authority of the group to share the file. In case of sharing, stopping the sharing procedure; And

d) In the case of sharing in accordance with the setting in step c), the server (200) allows sharing, and the security agent (100), characterized in that it comprises the step of transmitting a log for this, the data security system.
The method according to claim 1,

When a specific pattern or keyword is detected in the document file or the document being created in step B) or C),

e) the security agent 100 transmitting a log thereof to the server 200; And f) the server (200) is capable of isolating the detected document file or the document being created in a specific folder according to a setting.
The method according to claim 1 or 2,

When the user wants to output a document file or a document in writing in step B) or C),

g) the security agent 100 transmitting a log including the output image to the server 200;

h) when the security agent 100 detects a specific pattern or keyword, it transmits a log thereof to the server 200, and the server 200 performs a pattern masking or approval procedure according to the setting; And

i) The security agent (100), characterized in that it comprises the step of applying the watermark profile received from the server (200) to output the document.