Data protection system

Abstract

To provide a data protection system configured to prevent information leak, loss and breach from data files that do not meet acceptance conditions according to predefined data protection rules.SOLUTION: A data protection system comprises: a data protection storage device; and an agent program disposed on a user terminal or a host device serving as a service server to perform an interlocking operation with the data protection storage device through a network. The data protection system determines whether an open request meets an acceptance condition according to predefined data protection rules when there is the open request from the host device on a file stored in the data protection storage device, and returns a fake file, which is not an original file of the file to be opened, to the host device when the open request does not meet the acceptance condition.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a data protection system, and more specifically, to a data protection system that can prevent information leakage, loss, and seizure of data files that do not conform to the allowable conditions according to pre-specified data protection rules according to security policies.

Background Art

[0002] Traditional data protection for protecting data is performed by utilizing software vaccines or the like on endpoint devices (e.g., user PCs, etc.) that use data, or is performed based on a firewall at the network end. However, this requires a large computing power and has a problem that the security accuracy drops.

[0003] As a method different from the above-described endpoint protection or network protection, a technique for protecting data by protecting data in the storage where the data is stored, while minimizing the computing power required for data protection and improving the security accuracy to protect the data is called storage protection.

[0004] Such storage protection technology can be utilized for various data protections, ranging from preventing data loss due to malware such as ransomware, preventing data breach through phishing, etc., to preventing data leak by internal personnel. Therefore, there is a need for a new storage protection technology that can integrally respond to data loss, seizure, and leakage, while improving the security accuracy by data protection and enabling minimization of computing power.

Summary of the Invention

Problems to be Solved by the Invention

[0005] The present invention relates to a data protection system that is connected to a host device (e.g., a user terminal or a service server) via a network and includes another physically independent data protection storage device, and can prevent the information leakage, loss, and seizure of data files that do not comply with the allowable conditions according to the pre-specified data protection rules according to the security policy.

Means for Solving the Problem

[0006] According to one aspect of the present invention, there is provided a data protection system including: a data protection storage device; and an agent program installed in a user terminal or a service server that performs an interlocking operation through a network with the data protection storage device. At this time, when there is an open request for a file stored in the data protection storage device from the host device, the data protection system determines whether the open request complies with the allowable conditions according to the pre-specified data protection rules, and if it does not comply with the allowable conditions, returns a fake file instead of the original file of the opened file to the host device.

Effect of the Invention

[0007] According to the data protection system according to an embodiment of the present invention, it is connected to a host device (e.g., a user terminal or a service server) via a network and includes another physically independent data protection storage device, and has the effect of preventing the information leakage, loss, and seizure of data files that do not comply with the allowable conditions according to the pre-specified data protection rules according to the security policy.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Mode for Carrying Out the Invention

[0009] The present invention can be subjected to various conversions and can have various embodiments. Specific embodiments are illustrated in the drawings and will be described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all conversions, equivalents or alternatives included in the spirit and technical scope of the present invention.

[0010] In explaining the present invention, when it is determined that a specific description of related known technologies may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Also, the numbers (for example, first, second, etc.) used in the description process of this specification are merely identification symbols for distinguishing one component from other components.

[0011] Also, throughout the specification, when a component is referred to as being "connected" or "linked" to another component, it is understood that the one component can be directly connected or linked to the other component, but unless otherwise specified, it can also be connected or linked through or by means of other intermediate components. Further, throughout the specification, when a certain part "includes" a certain component, this means that, unless otherwise specified, it does not exclude other components but can further include other components.

[0012] The data protection system according to the present invention includes a data protection storage device; and an agent program attached to a host device corresponding to a user terminal or a service server, which performs an interlocking operation through a network with the data protection storage device.

[0013] At this time, when there is an open request for a file stored in the data protection storage device from the host device, the data protection system determines whether the open request meets the allowable conditions according to the pre-specified data protection rules, and if it does not meet the allowable conditions, it returns a fake file instead of the original file of the opened requested file to the host device.

[0014] Here, the fake file refers to a file that has the same file capacity as the original file of the opened requested file, but the file body is filled with a null value or a meaningless value.

[0015] Hereinafter, various embodiments of the data protection method through the data protection system of the present invention will be described in detail with reference to the accompanying drawings.

[0016] Here, FIG. 1 is a drawing showing a data protection method according to a first embodiment through the data protection system of the present invention, FIG. 2 is a drawing showing a data protection method according to a second embodiment through the data protection system of the present invention, FIG. 3 is a drawing showing a data protection method according to a third embodiment through the data protection system of the present invention, FIG. 4 is a drawing showing a data protection method according to a fourth embodiment through the data protection system of the present invention, FIG. 5 is related to FIG. 4, and is an example of a screen when a user tries to "open in edit mode" or "switch to edit mode" a specific file after the storage space of a data protection storage device is mounted on a network drive by Windows Explorer, and FIG. 6 is a drawing showing a data protection method according to a fifth embodiment through the data protection system of the present invention.

[0017] Each of the embodiments described below is an example of a case where data protection rules conforming to security policies are applied differently. However, it goes without saying that according to the system design method or security policy, two or more data protection rules can be applied to the embodiments described below at the same time.

[0018] As will be clearly understood through the description below, the data protection rules are set in any one or a combination of two or more of the following allowable conditions: an allowable condition that allows only access to files by a pre-registered execution program (the case of FIG. 1), an allowable condition that allows only access to files by a pre-registered execution program designated for each file (the case of FIG. 2), an allowable condition that allows only file open requests by legitimate users who are designated as accessible for each file (the case of FIG. 3), and an allowable condition that allows only file open requests by selecting an edit mode (the case of FIG. 4). At this time, the setting of the data protection rules can require additional authentication (for example, user authentication such as OTP (one time password) authentication or biometric authentication) through an authentication mechanism regarding whether the user who registered the setting corresponds to a user having the setting authority of the data protection rules.

[0019] [Description of FIG. 1] In the data protection system according to the embodiment of FIG. 1, an allowable condition that only allows access to files by an execution program registered in advance is applied in the data protection rule. Such a data protection rule is registered (stored) in the data protection storage device.

[0020] The agent program is connected to the data protection storage device through a network so that the file storage area of the data protection storage device is mounted on a host device such as a user PC in the form of a network drive (this is the same in FIGS. 2 to 6 below). Such an agent program can be added in the form of a menu with a shell extension to a file explorer (Explorer.exe) (for example, Windows Explorer) (this is the same in FIGS. 2 to 6 below).

[0021] Thereafter, when there is an open request for a file stored in the data protection storage device from the host device, the agent program transmits information on the execution program that accesses the open-requested file to the data protection storage device.

[0022] At this time, the data protection storage device or software (hereinafter described in an integrated manner as a device) verifies the received information on the execution program, and in the case of an open request through a program other than the pre-registered execution program, returns a fake file instead of the original of the open-requested file to the host device, and in the case of an open request through a pre-registered execution program, can return the original of the open-requested file to the host device.

[0023] Here, in the information (identification information or identification value) of the pre-registered execution program, the full path regarding the storage location of the execution program driven on the host device Among the path information of the path), the binary hash information of the corresponding execution program, and the process ID information of the execution program assigned by the host device on which the corresponding agent program was executed, any one, at least two combinations, or a value or hash value generated using at least two combinations can be used.

[0024] For example, if full path information or binary hash information is used as the information of the execution program, the data protection storage device verifies whether the full path information or binary hash information based on the execution program information received from the agent program matches the full path information or binary hash information of the designated program registered by itself. If the two match, the opened original file is returned to the host device. If the two do not match, a fake file instead of the original file of the opened file is returned.

[0025] [Description of FIG. 2] In the data protection system according to the embodiment of FIG. 2, in the data protection rule, an allowable condition that only allows access to a file by a pre-registered execution program designated for each file is applied. Such a data protection rule can be registered (stored) in the data protection storage device.

[0026] When there is an open request for a file stored in the data protection storage device from the host device, the agent program transmits the information of the opened file and the information of the execution program that accesses the opened file to the data protection storage device.

[0027] At this time, when the data protection storage device verifies the information of the received execution program and it is an open request through a program other than the pre-registered execution program specified for each file, the data protection storage device returns a fake file rather than the original of the opened file to the host device. When it is an open request through the pre-registered execution program specified for each file, the data protection storage device can return the original of the opened file to the host device.

[0028] Here, for the information (identification information or identification value) of the pre-registered execution program, similar to FIG. 1 described above, any one of the path information of the full path regarding the storage location of the corresponding execution program, the binary hash information of the corresponding execution program, the process ID information of the execution program assigned by the host device on which the corresponding agent program is executed, a combination of at least two of them, or a hash value generated using a combination of at least two of them can be used.

[0029] At this time, as the identification information or identification value for identifying the corresponding file, any one of the path information of the full path regarding the storage location of the corresponding file, the binary hash information of the corresponding file, a combination of two of them, or a hash value generated using a combination of two of them can be used.

[0030] The data protection method according to the embodiment of FIG. 2 described above is only applicable to target files (protected target files) that require data protection (for example, files specified in advance, files that hold predefined character strings, files that hold personal information patterns, etc.), and is not applicable to general files that are not protected target files. In this way, the protected target files can be selectively specified (configured) by the user, or can be automatically specified when the agent program or the data protection storage device filters the text of the corresponding file and contains the predefined target character string. At this time, the setting of the protected target files can be divided into grade intervals of low, medium, and high levels as needed, in addition to whether the protected target files are acceptable.

[0031] Also, at this time, in the case of general files that are not protected target files, instead of returning false files, the corresponding files can be provided in read-only mode (that is, the files are provided in a state where reading of the corresponding files is allowed, but changes such as writing, modification, and deletion are not allowed). This can be similarly applied to other embodiments according to FIG. 1 described above, FIGS. 3 and 4 described below, etc.

[0032] [Description of FIG. 3] In the data protection system according to the embodiment of FIG. 3, in the data protection rules, an allowable condition that only allows file open requests by legitimate users who are specified for each file and are accessible is applied. Such data protection rules can be registered (stored) in the data protection storage device.

[0033] When there is an open request for a file stored in the data protection storage device from the host device, the agent program transmits the open-requested file information and the user information of the user who made the file open request to the data protection storage device.

[0034] At this time, the data protection storage device verifies the received user information. If the open request is made by a user other than the legitimate user authorized for the file, the data protection storage device returns a fake file rather than the original file of the opened file to the host device. If the open request is made by the legitimate user designated for the file, the data protection storage device can return the original file of the opened file to the host device. In addition, similar to the grade of the protected file described above, the data protection storage device adds and sets a security grade for each user as needed. Then, when comparing the security grade level of the received open request target file with the security grade of the corresponding user, if the security grade of the user is lower than the security grade of the target file, the data protection storage device can also return a fake file to the host device.

[0035] [Description of FIGS. 4 and 5] In the data protection system according to the embodiment of FIG. 4, in the data protection rule, an allowable condition that only allows file opening by selecting an edit mode is applied.

[0036] The selection of the edit mode refers to a situation where, if it is recognized that it is a user operation (that is, not an attempt to open a file by malware or a machine that mimics a human act, but an obvious file operation act by a human) clearly distinguishable from an attempt to open a file by malware, etc., the free file operation act of the corresponding user is allowed, which corresponds to a data protection processing method.

[0037] For example, as shown in FIG. 5, the user positions the cursor on the file to be opened and performs an act of right-clicking the mouse, which is clearly a human act. Through this, the user can freely operate on the corresponding file by selecting "Open in Edit Mode" from the pop-up menu items that can be seen.

[0038] For this purpose, the agent program provides selection information (see the "Open in Edit Mode" and "Switch to Edit Mode" menus in FIG. 5) that allows a user to select to open in edit mode a storage file in the data protection storage device mounted in the form of a network drive on the host device, and can transmit information regarding a file open request due to the edit mode selection to the data protection storage device. At this time, when the file open request is not due to the edit mode selection, the data protection storage device can return a fake file rather than the original of the opened file to the host device.

[0039] The above example is a case where only the condition allowing file opening by edit mode selection is applied. However, according to the implementation method of the system, data security can be further enhanced by the following processing procedures even with such edit mode selection.

[0040] That is, even when a user selects to open in edit mode for a specific file, if the storage location of the corresponding file is in the data protection storage device and the execution program attempting to access the corresponding file due to the corresponding file open request is not a security program registered in advance but another execution program, the data protection storage device can also return a fake file rather than the original of the requested file.

[0041] [Description of FIG. 6] In the data protection system according to the embodiment of FIG. 6, in the data protection rules, at least one of the above-described data protection rules of FIGS. 1 to 4 (that is, the permission condition that only allows access to files by a pre-registered execution program, the permission condition that only allows access to files by a pre-registered execution program specified for each file, the permission condition that only allows a file open request by a legitimate user who can access the file specified for each file, and the permission condition that only allows a file open request by selecting an edit mode) can be applied. At this time, the data protection rules can be registered (stored in a management ledger) in the agent program.

[0042] In the case of FIG. 6, when there is an open request for a file stored in the data protection storage device from the host device, the agent program determines whether the open request conforms to the permission condition according to the pre-specified data protection rules. If it does not conform to the permission condition, a fake file is returned to the host device instead of the original file of the opened file. If it conforms to the permission condition, information can be transmitted to the data protection storage device so that the original of the opened file is provided from the data protection storage device to the host device.

[0043] For example, assuming that as a data protection rule, a permission condition that only allows access to files by a pre-registered execution program specified for each file is applied, the agent program registers the value of the corresponding data file and the identification value of the accessible execution program in the data management ledger in advance. Each time the corresponding file is accessed, an access program identification value that causes the data protection storage device to provide the real file is transmitted only when the accessed execution program is registered as the access target program of the specified file. Otherwise, a fake file with the same original file and file capacity can be generated and returned to the host device.

[0044] According to the data protection system according to each embodiment of the present invention as described above, it includes a physically independent separate data protection storage device connected to a host device (for example, a user terminal or a service server) via a network, and instead of storing the main data files in the storage of the host device, it stores them in a data protection storage device equipped with a storage protection function (for example, a network file server independent outside the host device). Although the host device can freely generate files in the network drive, it is a technology that provides files to the host device so that the outflow, loss, or seizure of the corresponding files after file generation is not possible, and it can protect the data files in the data protection storage device from the host device.

[0045] When accessing a file stored in a data protection storage device with a storage protection function, by applying a data protection rule to check whether it is a legitimate program or a legitimate user that can access the corresponding file and providing the data file to the host device, even if the host device is completely controlled by a hacker or malware (malicious code), etc., it has the effect of preventing the outflow, loss, or seizure of the data files stored in the data protection storage device.

[0046] Although the embodiments of the present invention have been described above with reference to the embodiments, it can be easily understood that those with ordinary knowledge in the relevant technical field can make various modifications and changes to the present invention within the scope not departing from the idea and scope of the present invention described in the following claims.

Claims

1. 1. A data protection system, comprising: a data protection storage device; and an agent program that is installed in a host device that is physically independent from the data protection storage device and that performs an interoperable operation with the data protection storage device through a network; The data protection storage device is configured to receive an open request and execution program information regarding an original file stored in the data protection storage device of the host device through the agent program, determine whether the open request by the execution program is permitted based on a preset data protection rule, and return a fake file or the original of the file requested to be opened based on the determination result, The data protection system is characterized in that the data protection rule is set under a condition that only an open request from an executable program pre-registered by an authenticated user having setting authority is permitted.

2. 2. The data protection system of claim 1, wherein the data protection storage device returns a fake file to the host device instead of the original of the file requested to be opened when the open request is made through a program other than the pre-registered executable program.

3. The data protection rules include a permission condition that allows only file access by a pre-registered executable program designated for each file, The agent program transmits the file information requested to be opened and the execution program information to the data protection storage device.

2. The data protection system of claim 1, wherein the data protection storage device returns a fake file to the host device instead of the original of the file requested to be opened when the open request is made through a program other than a pre-registered execution program designated for each file.

4. The data protection system of claim 2 or 3, characterized in that the information on the pre-registered executable program is any one, a combination of at least two, or a value or hash value generated using a combination of at least two of the following: full path information regarding the storage location of the executable program run on the host device; binary hash information of the executable program; and process ID information of the executable program assigned by the host device on which the agent program is executed.

5. The data protection regulations further include a permission condition that allows only file opening requests from legitimate users who have access designated for each file, The agent program transmits the user information that requested the file open to the data protection storage device.

2. The data protection system of claim 1, wherein the data protection storage device returns a fake file to the host device instead of the original of the file requested to be opened when an open request is made by a user other than a legitimate user who can access the file as specified for each file.

6. 6. The data protection system of claim 5, wherein the data protection storage device compares the security level of the file requested to be opened with the security level of a legitimate user who can access the file, and if the security level of the user is lower than the security level of the file, returns a fake file to the host device.

7. The data protection rule further includes a permission condition that allows only a file open request by selecting an edit mode, the agent program provides selection information for allowing a user to select to open a file stored in the data protection storage device mounted in the form of a network drive on the host device in an edit mode, and transmits information about the edit mode selection to the data protection storage device; 2. The data protection system of claim 1, wherein the data protection storage device returns a fake file to the host device instead of an original file requested to be opened if the file open request is not due to the selection of the edit mode.

8. The data protection system of any one of claims 1 to 7, wherein the fake file has the same file size as the original file requested to be opened, but the body of the file is filled with null values ​​or meaningless values.

Images