KR100943301B1 - Server-based data security / management system - Google Patents

Abstract

 The present invention is automatically stored in a specific (designated) server at the time of saving / modifying the document generated through all the applications installed on the user's computer (PC) and the document stored in the server is managed by a specific server management tool, Access and modify documents on the server through document management systems (KMS, DMS, PMS, etc.) or client file search tools. Since the modified document is automatically stored in a specific location of the server and automatically deleted from the user's computer, it relates to a server-based data security / management system that can prevent illegal leakage by preventing an individual from intentionally leaking a document.

According to the present invention, a file I / O framework control module is embedded in each user computer connected to a network so that the file I / O framework control module can be stored and stored through all applications installed in the computer. When a modification is detected, history information about the document (e.g. user ID, document name, document creation and modification time, IP address, Windows account, Windows Workgroup name) ) Is transferred to a server on the network and stored / managed in the database and storage of the server, and the administrator checks the history information using the administrator tool.

In addition, when a document is saved and modified, it is automatically saved by sending the document to a specific server on the network, and the stored document can be accessed and modified through a specific document management system or client file search tool. To provide a breakthrough server-based data security / management system further improved.

Application, Auto Save, Illegal Outflow, File I / O Framework Control, Server Based, Data Security

Description

Server-based data security / management system {Document Chaser}

1 is a block diagram showing a schematic configuration of a server-based data security / management system of the present invention.
2 is a block diagram showing a detailed configuration of the present invention.
FIG. 3 is a flowchart illustrating a process of automatically storing a document in a server when storing / modifying a document according to the present invention.

The present invention automatically saves the document generated by all applications (Application) of the user PC in the server when saving the server-based data that can prevent important documents from leaking to the outside by preventing the user from storing the original on the PC It relates to a security / management system.
With the rapid development of computer hardware, as well as the development of various applications and digital multimedia technologies, most of the work is performed through computers, and work data as well as important corporate information are stored and used on computers.
Recently, the leakage of information of companies has become a very serious social problem, and each company is implementing various security systems to prevent the leakage of such information.
This security system introduces various technologies such as file leakage prevention and document leakage prevention. For example, it is common to decide whether to allow access according to the security level, but this is also a serious problem due to the leakage of information required for authentication. In addition, it can be said that the document leakage by the authenticated user is defenseless.
In addition, by using SBC (Server Based Computing) based solution, all data and applications are placed on the server, and all work can be done only by using the server. If it exists, you have to rely only on the server, and also, there is a problem that the performance of the paper work or the software installed on the existing user's PC becomes obsolete, which requires a double investment in the enterprise.
In the present invention, when saving the documents generated through all the applications installed on the user's PC automatically stored in a specific server, when a modification occurs, access to the server to modify and the modified document is automatically stored in the server important documents of the company It is to propose a system to prevent important documents from leaking to the outside by preventing individuals from illegally managing and leaking them.
Conventionally, the contents are encrypted or the mobile storage media of the computer are controlled, and each user is given a special authority to use the content according to the user's authority, and the application is controlled for each application to perform encryption and authority control. A company that specializes in DRM (Digital Rights Management) mainly develops products. The technologies used include application control methods and file processing methods using device drivers, but these methods are used by companies. Depending on the application and the customer's needs, a lot of additional development is required, and further development or maintenance is required even after implementation.
In addition, DRM has more products and technologies in Korea than abroad, and in overseas, Microsoft applies DRM, a document leakage prevention function, to Office products only. We are developing products that apply security.

In view of the above problems, the present invention intends to propose a system for new data security / management based on File I / O Framework control.
According to the present invention, a file I / O framework control module is embedded in each user computer connected to a network, so that the file I / O framework control module generates and modifies / stores documents through all applications installed on the user computer. When the data is created / saved at the end of creation / save, the server automatically saves the data, and the data stored in the server is managed by a specific server management tool. It can be accessed and modified only through a tool or a specific document management system, and the modified data is automatically stored in a specific location on the server so that an individual cannot intentionally leak data.

The server-based data security / management system of the present invention,
Each computer connected to the network, and the file I / O framework control module, print control module, and server file explorer module are built in, and the computer automatically manages documents stored in the server when the document is created. It consists of a server consisting of a login service module, a file management service module, a file log service module, a print log service module, an administrator service module,
The file I / O framework control module embedded in the user computer provides a user interface for navigating a file of a server and selecting a file for a file open command in an application. File Open module, which is responsible for user authentication and receives the user's watermark profile from the server and stores the client in the login agent module. When a file is opened in an application, the file lock module stores the file in the temporary folder of the user's computer and prevents copying and leaking the stored file, and opens the file stored in the server. (File Access) log module to send log about open and save, and about saved file Includes a File Upload module that uploads to the server and deletes from the user's computer,
The print control module includes a watermark module for automatically inserting image or print information into a printout according to a watermark policy assigned to a user, and an output log transmission module for transmitting the extracted image and information to a log server upon output. and,
The Server File Explorer module provides a user-friendly navigation interface module that provides a Windows Explorer-like interface to user files stored on the server, and facilitates access to user files stored on the server. And an external file transfer interface module for performing a function of delivering to a user, and an external file transfer interface module for delivering a user file stored in a server to a user other than a company.
The server performs the authentication by the login request of the login agent module and the login service module which transmits the file storage information and the watermark profile assigned to the user, the user management, the watermark profile management, and the file storage management. , An administrator service module that provides services such as output log inquiry and file access log inquiry, a file log service module that stores a log of user file usage history (file creation, file open, file transfer, file storage), The print log service module stores the output image sent from the client to the server and prints the output information to the database. For the file you selected to open, It characterized in that it contains a file management service module for providing a download service.
The configuration and operation of the server-based data security / management system having the features as described above will be described below with reference to the embodiments shown in FIGS. 1 to 2 and 3.
Each computer connected to the network, the file I / O framework control module 110, the print control module 120 and the server file explorer module 130 is embedded in the user computer 100, and automatically created when creating a document on the user computer The login service module 210, the administrator service module 220, the file log service module 230, the print log service module 240, and the file management service module 250 that perform a function of managing a document stored in a server. The server 200 and the file access log module 114 and the output log transmission module 122 of the user computer 100, the log and output of the open, save for the file stored in the server transmitted to It consists of a database 300 in which output information and image files are stored.
The file I / O framework control module 110 embedded in the user computer 100 provides a file open module 112 that provides a user interface for navigating a file of a server and selecting a file for a file open command in an application. And, the login agent module 111, which is responsible for user authentication and receives a user's watermark profile from the server and stores it in the client, and opens a file stored in the server in an application. a file lock module 113 for storing in a temporary folder, and copying and storing stored files, and a file access log module 114 for transmitting a log about opening and storing a file stored in a server. ), And a file that uploads stored files to the server and deletes them from your computer. One upload module 115,
The print control module 120 includes a watermark module 121 for automatically inserting an image or print information into an output according to a watermark policy specified by a user, and an output log transmission module for transmitting the extracted image and information to a server. The server file explorer module 130 includes a user file navigation interface module 131 for providing easy access to the user file stored in the server by providing an interface similar to the window explorer, and the server file explorer module 130 stored in the server. An internal file transfer interface module 132 that performs a function of delivering a user file to another user in a company, and an external file transfer interface module 133 that performs a function of delivering a user file stored in a server to a user other than the company. It is configured to include.
The server 200 performs authentication by a login request of a login agent module and transmits the file storage information and the watermark profile designated to the user to the user computer, user management, watermark profile management, An administrator service module 220 that provides services such as file storage management, output log inquiry, and file access log inquiry, and stores a log of file usage history (file creation, file open, file transfer, file storage) of the user. The file log service module 230, a print log service module 240 for storing an output image transmitted from a user computer when printing a document to a server and storing output information in a database, and a file generated or stored by a user to a server. Save and provide navigation to files stored on the server, and open files selected by the user It is configured to include a file management service module 250 to provide a download service for.
The present invention as described above, the file I / O framework control module 110 for monitoring whether the file is generated or stored through all applications in each user computer 100 connected to the network, the print for monitoring whether The control module 120 and the server explorer module 130 for navigating the document stored in the server is installed.
The file I / O framework control module 110, the print control module 120, and the server explorer module 130 are automatically installed from the server 200, managed by the server 200, and configured to be automatically upgraded.
Included in the file I / O framework control module 110,
The file open module 112 is responsible for providing a user interface for navigating a file of a server and selecting a file for a file open command in an application.
The login agent module 111 is responsible for user authentication and receives a user's watermark profile from a server and stores the user's watermark profile in a user computer.
When the file lock module 113 opens a file stored in the server in an application, the file lock module 113 performs a function of storing a file stored in a temporary folder of the user's computer and preventing a file from being copied and leaked.
The file access log module 114 is responsible for transmitting a log for opening and storing the file stored in the server,
The file upload module 115 is responsible for uploading the stored file to the server and deleting the file from the user computer.
Included in the print control module 120,
The watermark module 121 plays a role of automatically inserting an image or print information into a printout according to a watermark policy assigned to a user.
The output log transmission module 122 is responsible for transmitting the extracted image and information to the log server at the time of output.
Included in the server file explorer module 130,
The user file navigation interface module 131 serves to provide easy access to the user file stored in the server by providing an interface similar to that of Windows Explorer.
File internal transfer interface module 132 is responsible for delivering a user file stored in the server to other users in the company,
The external file transfer interface module 133 is responsible for delivering a user file stored in a server to a user other than a company.
The login service module 210 included in the server 200 performs a function of performing authentication by a login request of a login agent module and transmitting a file storage information and a watermark profile designated to a user to a client. and,
The manager service module 220 plays a role of providing a service such as user management, watermark profile management, file storage management, output log inquiry, file access log inquiry,
The file log service module 230 plays a role of storing a log of a file usage history of a user (file creation, file opening, file transfer, file storage),
The print log service module 240 performs a function of storing an output image transmitted from a client in a server and storing output information in a database when printing a document.
The file management service module 250 is responsible for storing a file created or stored by the user in the server, providing a navigation function for the file stored in the server, and providing a download service for the file selected by the user. do.
In this case, the manager service module 220 may access the server 200 using an external network such as the Internet at a remote location without being limited to the internal network, and may obtain the above result.
Referring to the operation of the present invention having such characteristics in detail as follows.
When the user computer 100 is driven, the embedded file I / O framework control module 110 is also driven.
When a document is opened / stored / modified on an application of the user computer 100, the file I / O framework control module 110 detects this.
The file I / O framework control module 110 controls and manages the file open module 112, the login agent module 111, the file lock module 113, the file access log module 114, and the file upload module 115. do.
When the document storage / modification is detected in the user's computer as described above, the file open module 112 provides a navigation user interface for storing the document to be stored in a specific server so that the user can save the document in a specific location of the server. Selects a specific location of the server, the file lock module 113 stores the document in a specific temporary directory of the user's computer and locks the file to prevent leakage, and the file upload module 115 selects a corresponding location of the server. The document is uploaded to and deleted from the user's computer, and the file access log module 114 sends a save log for the stored document on the specific server to the server, which is stored in the database.
In addition, when the document is output on the application of the user computer 100, the print control module 120 detects this.
The print control module 120 controls and manages the watermark module 121 and the output log transmission module 122.
When the document output is detected by the user's computer, the watermark module 121 inserts the image or print information into the output according to the watermark policy specified by the user, and the output log transmission module 122 extracts the image information and the log information extracted at the output. Is transmitted to the server 200, and this information is stored in the server.
The server 200 stores the document storage information, the output information, and the output original image file in the database 300.
As such, when the document is saved, it is automatically stored in the server, and the log information about the document storage and the printed file information are stored and managed, and the watermark is inserted so that the source of the printed document can be known to prevent illegal leakage by the user. To prevent.

In the present invention, by installing the File I / O Framework control module on a networked enterprise computer, all documents generated on the user's computer are automatically stored in a specific server and the user's computer Prevents users from leaking important documents illegally, and centrally manages / monitors document storage history and output information to monitor document history information generated by users in real time. Use the information to enable follow-up tracking.

Claims (11)

For every file created by an application on your computer, When a file is saved / modified after creation, it is automatically detected and uploaded to a specific (designated) server, and automatically deleted from the user's computer. The server-based data security / management system, characterized in that to perform a file lock (File Lock) function to maintain the security of the file temporarily stored in the user computer generated when the automatic upload (upload) to the server. The method of claim 1, wherein when all files generated by an application of the user's computer are automatically stored in the server, a log of file usage history (file creation, file opening, file transfer, file storage) is generated and transmitted to the server. Server-based data security / management system, characterized in that to provide a query service for the transmitted log. 2. The server-based data security / management system of claim 1 including providing a user interface for navigation and selection of files stored on the server and downloading the selected files to the local system. delete The method of claim 1, further comprising a function of preventing local system drive navigation and inducing server drive navigation when automatically storing all files generated through an application of a user computer on a server. Server-based data security / management system. The server-based data security / management system of claim 1, wherein the server-based data security / management system provides an interface function to deliver a file automatically stored in the server to other users in the company. The server-based data security / management system of claim 1, wherein the server-based data security / management system provides an interface function for delivering a file automatically stored in a server to a user other than a company. The method of claim 5, wherein the server-based data security for server drive navigation (server drive navigation) to provide a separate file search function to provide the user to save the file on the server rather than the user computer when the file is stored Management system. The method according to claim 1, wherein when all files generated through an application of the user's computer are automatically stored in the server, the file I / O framework of the operating system (OS) is controlled to generate and store the file of the application. Server-based data security / management system, characterized in that the monitoring / detection of modifications. The method according to claim 1, wherein when printing a document on a user's computer, document history information (user ID, document name, document creation / open / modification time, IP address, Windows account, Windows workgroup name, modification / open / save etc.) The server-based data security / management system, characterized in that for generating a log for the transmission to the server, and providing a query service for the transmitted log. The method of claim 1, wherein, when all files generated through an application of the user's computer are automatically stored in the server, the file is automatically stored in the server by the file I / O framework control module without restriction according to the application. Server based data security / management system.

Images