Web-based isolation method for controlling software services by service level

Abstract

This invention provides a web-isolated software service classification control method that controls data movement and storage in order to differentiate data file sharing and software services according to their security level. [Solution] An internal network system configured such that a client, a management server, and a data file storage server are connected to an internal network isolated from an external network and communicate with each other, the control method includes a security level setting step of setting security levels for storage locations configured on the file storage server according to software services, an attempt to access the external network of the internal network system, a virtual browsing activation step of the internal network system, a control step of constructing a control environment so that the execution of software services and data management are restricted to the storage locations, and a rendering image output step of generating and outputting a rendering image of the first execution window of the software output during virtual browsing in the relay environment.

Description

Technical Field

[0001] The present invention relates to a method for classifying and controlling software services by web isolation, which separates storage areas according to the security level of an internal network and manages access to software services according to the level of the internal network to which a user connects.

Background Art

[0002] In a business environment such as a government office, a company, or a research institute where data exposure is restricted, a closed network system (hereinafter referred to as an "internal network") that is isolated from the outside is constructed to share data among members.

[0003] Recently, a business system technology has been proposed that provides dedicated software so that a user can execute specific operations such as customer relationship management (CRM). For this purpose, software service technologies that provide dedicated software to clients, not to mention cloud-based service-type software services (SaaS; Software as a Service), have been applied in cooperation with the internal network.

[0004] Regarding the software service, for example, in a company that is one of the groups in which an internal network is constructed in a business environment, dedicated software for business systems such as a customer relationship management (CRM) system, a collaboration tool, a productivity application, and a project management system is generally widespread and used in business. Such dedicated software for business systems is accessed via the Internet, provides data storage and sharing functions, and enhances the convenience of data use.

[0005] However, when software provided over an external network executes data files, there is a high possibility of those data files being leaked externally, posing a security risk. Furthermore, even in the case of business systems where access is restricted based on the user's security level, if dedicated software for those business systems is provided without distinction, users may gain access to the restricted business systems, thus weakening business security. [Overview of the project] [Problems that the invention aims to solve]

[0006] Therefore, the present invention aims to solve the above-mentioned problems and provides a method for controlling software services by web isolation, which controls data movement and storage so that data file sharing and software services can be differentiated by security level. [Means for solving the problem]

[0007] To achieve the above objectives, the present invention provides a method for controlling software services by web isolation, comprising: an internal network system configured such that one or more clients, a management server, and a data file storage server are connected to an internal network isolated from an external network and communicate with each other; a security level setting step for classifying storage locations configured on the data file storage server by security level and setting security levels for each software service; an external network access attempt step for the internal network system to attempt to access a service server on an external network for the purpose of software services; a virtual browsing activation step for activating virtual browsing in response to web browsing of the internal network system to create a relay environment; a control step for constructing a control environment so that the execution of software services and data management are restricted to storage locations corresponding to the security level; and a rendering image output step for rendering the first execution window of the software output during virtual browsing in the relay environment to generate a rendering image, and outputting the rendering image via web browsing of the internal network system. [Effects of the Invention]

[0008] As described above, the present invention minimizes the risk of external threats infiltrating internal systems and reduces the possibility of malicious code infection and information leakage by web isolation between external and internal networks.

[0009] Furthermore, by classifying data file storage locations according to security level and differentiating software services accordingly, it is possible to prevent data files from leaking out of storage locations with designated security levels, thus ensuring the secure management of important information.

[0010] Furthermore, since the creation of the relay environment using a virtual browser and the rendering work are shared and performed by the client, which is the primary user of the data files or software, the use of server resources can be minimized, and there is no need to unnecessarily increase the specifications of the equipment for data file management and software services. [Brief explanation of the drawing]

[0011] [Figure 1] This is a block diagram showing one embodiment of the control system according to the present invention. [Figure 2] This diagram shows one embodiment of a control method based on the aforementioned control system. [Figure 3] This is an image of a list window showing an example of software provided by a service server in one embodiment of the control system according to the present invention. [Figure 4] This is a block diagram showing another embodiment of the control system according to the present invention. [Figure 5] This is a block diagram showing yet another embodiment of the control system according to the present invention. [Modes for carrying out the invention]

[0012] The terminology used in the examples has been selected as widely used and general terms as possible, taking into account the function of the present invention; however, this may change depending on the intentions of those skilled in the art, precedents, and the emergence of new technologies. In some cases, the applicant may have arbitrarily selected terms. In such cases, the meaning of these terms will be described in detail in the description of the invention. Therefore, the terms used in this invention must not be simple term names, but must be defined based on the meaning of the term and the overall content of the present invention.

[0013] In this specification, “~device” means a part that performs a specific function. “~device” may be a defined part within a single body, or it may be an object composed of multiple components. The components and the functions provided within “~device” may be combined with fewer components and “~device” or separated into additional components and “~device”. “~device” should be understood as a unit whose form is embodied for the purpose of performing a specific function.

[0014] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that they can be easily implemented by a person with ordinary skill in the art to which the present invention pertains. However, the present invention can be embodied in a variety of different forms and is not limited to the embodiments described herein.

[0015] The present invention will now be described in detail based on the attached drawings. Figure 1 is a block diagram showing one embodiment of the control system according to the present invention. Referring to Figure 1, the control system according to the present invention includes a data management server 110 that connects to an external network such as the Internet and performs general cloud functions, a service server 120 that provides dedicated software services for business systems such as customer relationship management (CRM) systems, collaboration tools, productivity applications, and project management systems, or general software services such as word processors and accelerators, and an internal network system 130 isolated from the external network. Here, the internal network system 130 is connected to one or more clients 131 equipped with general computing functions used by users, a management server 132 that controls communication between the clients 131 and the external network, and a data file storage server 133 that protects, stores, and manages data files, all of which are able to communicate with each other via an internal network that creates a communication environment isolated from the external network.

[0016] To explain each configuration in more detail, the service server 120 connected to the external network provides a known software service to a designated client 131. In this embodiment, the service server 120 activates virtual browsing using a virtual browser VB to create a relay environment in order to provide the software service. In this embodiment, the virtual browser VB is configured on the service server 120, and virtual browsing is executed on the service server 120 (first embodiment).

[0017] However, the control method and control system according to the present invention can also be configured such that the virtual browser VB is configured on a separate security server (not shown) connected to an external network to create the relay environment (second embodiment), or on a management server 132 of an internal network system 130 to create the relay environment (third embodiment), or on a client 131 of an internal network system 130 to create the relay environment (fourth embodiment). In this description, the case in which virtual browsing is activated on the service server 120 will be described as an example.

[0018] The data management server 110 stores and manages data files executed by the service server 120's software, as well as newly generated or updated data files. The data management server 110 performs general cloud computing functions to create a data storage environment on an external network, and a separate data security device 111 can be constructed to enhance security.

[0019] However, for more stable security, data files executed by software in the internal network system 130, as well as newly generated or updated data files, can be stored and managed in a data file storage server 133 configured in the internal network system 130.

[0020] The internal network system 130, which constructs an internal network isolated from the external network, includes, as described above, a user client 131, a management server 132 that manages the communication environment and security of the internal network system 130 and manages software code and other data files received from the external network, and a data file storage server 133 that stores and manages the said data files while searching for them.

[0021] More specifically in relation to this, the client 131 is an ordinary computer, which is connected to the data file storage server 133 via an internal network and connected to the external network via a security channel specified by the management server 132. A dedicated application (not shown) for receiving software services is incorporated in the client 131, and the user connects to the service server 120 under the communication control of the management server 132 by executing the dedicated application.

[0022] When the management server 132 attempts to connect the client 131 to the external network, it activates a security channel for communication security and specifies it to the client 131. Also, it saves the data files generated when the software service for the client 131 is executed to the data file storage server 133. For reference, when the software is directly executed on the service server 120, the software receives a data file from the data management server 110 and is executed, and the generated data file is saved to the data management server 110. However, when the software is executed in the internal network system 130, the software receives a data file from the data file storage server 133 and is executed, and the generated data file is saved to the data file storage server 133.

[0023] Security levels are set for the user or the client 131 and the software respectively. The management server 132 or the service server 120 confirms the respective security levels of the user or the client 131 and the software, and enables the client 131 to access the software that can be used. Also, the management server 132 assigns the corresponding security level to each data file.

[0024] The data file storage server 133 stores data files received by the management server 132 from the external network. When a client 131 attempts to retrieve data files for software execution, the management server 132 controls the retrieval of the data files. The retrieved data files are then transmitted to the service server 120 under the control of the management server 132.

[0025] Furthermore, the data file storage server 133 can configure storage locations according to security level, and it checks the security level of the received data file and saves it to the appropriate storage location.

[0026] The control system according to the present invention described above describes the configurations for the first and second embodiments, but the descriptions referring to Figures 4 and 5 describe the configurations for the third and fourth embodiments, respectively.

[0027] Figure 2 is a flowchart showing one embodiment of a control method based on the control system, and Figure 3 is an image of a list window showing an example of a control system according to the present invention in which the software provided by the service server is listed.

[0028] The control method according to the present invention will be explained with reference to Figures 1 to 3. S11: Safety Classification Stage In an internal network system 130 configured such that one or more clients 131, a management server 132, and a data file storage server 133 are connected to an internal network isolated from the external network and communicate with each other, the storage locations configured on the data file storage server 133 are classified by security level, and security levels are set for each software service.

[0029] The data files generated by the software may have their security level set by the software service, or they may have their security level set individually regardless of the software service. Furthermore, the data management server 110 or the data file storage server 133 stores the data files in a designated storage location according to the set security level.

[0030] When the data file is stored on the data file storage server 133, the data file is stored and managed in isolation within the internal network system 130 without being leaked to the external network. If a security level is set for each data file, the data file is not shared with storage locations other than those with the corresponding security level within the internal network system 130.

[0031] Security levels can be classified based on the level of security required for data files and software, but they can also be classified by their intended use, such as business networks, development networks, and computer networks.

[0032] S12: Attempting to access the external network For the purpose of providing software services, the internal network system 130 attempts to access the external network service server 120.

[0033] In this embodiment, for a client 131 of the internal network system 130 to approach the service server 120, the user runs a dedicated application for software services on the client 131. The dedicated application causes the client 131 to perform web browsing in order to connect to the internal network. Furthermore, the dedicated application outputs an execution window W1 displaying one or more software identification display APs, as shown in Figure 3, so that the user can directly select the software they want to use. The user can click on one or more of the identification display APs displayed in the execution window W, and the dedicated application finally confirms the software to be used as the service target based on the selection of the identification display APs.

[0034] In this embodiment, the internal network system 130 allows the user to directly select software services received from the service server 120. However, it is also possible to configure the system to automatically select a specified software service when the client 131 is started or when a dedicated application is executed.

[0035] On the other hand, when the dedicated application is executed and, in this embodiment, the client 131 connects to the management server 132 along with web browsing, the management server 132 specifies a security channel for connection to the external network. The client 131 then approaches the service server 120 via the security channel.

[0036] Regarding the communication between client 131 and the external network via the aforementioned security channel, security technologies related to data communication, authentication, and encryption are already known technologies, so a detailed explanation of them will be omitted.

[0037] S13: Virtual Browsing Activation Phase The system activates virtual browsing to support web browsing on the internal network system 130, thereby creating a relay environment.

[0038] In this embodiment, the creation of the relay environment by activating the virtual browsing is performed by a virtual browser on an external network. More specifically, in the first embodiment, the service server 120 configures itself as a virtual browser (VB). The virtual browser VB outputs the service server 120's website instead of the client 131's web browser, and allows the user to select a menu for each web page on the website to execute subsequent web pages or data.

[0039] The relay environment using the virtual browser VB is constructed in a web isolation area for data security. Generally, a typical web isolation technology is a sandbox. The sandbox prevents infection of software services by malicious code by executing the software execution code input from the service server 120 and the data files input from the data file storage server 133 of the internal network system 130 in the web isolation area, and transmits rendering images and data files generated during the software service process to the internal network system 130 without infection by malicious code.

[0040] Since sandbox technology is already a well-known technology, I will omit a detailed explanation of it.

[0041] In the first embodiment, the relay environment using the virtual browser VB was built on the service server 120. In the second embodiment, the virtual browser VB is installed on a separate security server (not shown) from the service server 120 to build the relay environment, and the rendered image and data files generated in the relay environment of the security server are transmitted to the internal network system 130.

[0042] S14: Software Service Decision Stage The service server 120 checks the security rating of the software to be used as requested by client 131, and verifies the security rating of the client 131 user or client 131.

[0043] If the security rating check confirms that the user or client 131 is eligible to use the software, the software service procedure will continue; if it confirms that the user is not eligible, the software service procedure will be refused.

[0044] To verify the security level, one or more of the service server 120 and management server 132, selected from among them, hold information data such as user or client 131 that includes information about the security level. When a software service request is received from client 131, the security level is verified using the information data based on the user's ID or client 131's IP address.

[0045] S15: Data control phase The internal network system 130 establishes a control environment to ensure that the execution of software services and data management are restricted to storage locations corresponding to the security level.

[0046] For this purpose, one or more of the data management server 110 and the data file storage servers 133 of the internal network system 130 are selected to form a storage facility corresponding to the security level of the user when the software service is executed, and the retrieval, storage, and updating of data files for the software service are performed only within the scope of that storage facility.

[0047] In this embodiment, one or more storage locations selected from the data management server 110 and the data file storage server 133 may already be partitioned according to security level, and the user's client 131 is already configured to only be able to access storage locations of a security level below a predetermined level. Therefore, the software currently running in the relay environment by the service server 120 in the first embodiment or the security server in the second embodiment cannot retrieve data files stored in storage locations of a security level exceeding that level.

[0048] S16: Rendering image output stage When the execution of a software service is applied to the user or client 131 based on the security level check, the first execution window of the software output during virtual browsing in the relay environment is rendered to generate a rendered image, and the rendered image is output via web browsing of the internal network system 130.

[0049] In the first embodiment, when the service server 120 transmits the rendering image to the internal network system 130 in the relay environment, or in the second embodiment, when the security server transmits the rendering image to the internal network system 130 in the relay environment, the management server 132 receives the rendering image and transmits it to the client 131.

[0050] The web browser on client 131 outputs the rendered image received from the management server 132, so the user uses the service as if the software were running on client 131.

[0051] As explained above, Remote Browser Isolation (RBI) technology, a security technology that runs a virtual browser in a web isolation area and transmits and shares only the rendered image using rendering technology, is already a well-known technology, so a detailed explanation of it will be omitted.

[0052] In the first and second embodiments described above, a relay environment was constructed on an external network to implement RBI technology. However, in the third and fourth embodiments, the relay environment is constructed on the internal network system 130 to implement RBI technology. The third and fourth embodiments will be described below.

[0053] Figure 4 is a block diagram showing another embodiment of the control system according to the present invention.

[0054] Referring to Figures 2 to 4, the control system 200 of this third embodiment includes a service server 220 and an internal network system 230. The service server 220 provides software services to the client 231, and the internal network system 230 includes the client 231, a management server 232, and a data file storage server 233.

[0055] The client 231 and data file storage server 233 configured in the control system 200 of the third embodiment have the same basic functions as the client 131 and data file storage server 133 configured in the control system 100 of the first and second embodiments. However, unlike the first or second embodiment, the management server 232 configured in the control system 200 of the third embodiment includes a virtual browser VB for virtual browsing, thereby enabling the management server 232 to build the relay environment and perform rendering functions.

[0056] Therefore, when a dedicated application of client 231 requests a software service from service server 220, service server 220 transmits the requested software code to internal network system 200. Upon receiving the software code, management server 232 of internal network system 200 has a virtual browser VB execute and render the software in the relay environment and transmit the rendered image to client 231.

[0057] The control method of the third embodiment is described as follows: In the attempt to access the external network (S12), an attempt to access the service server 220 on the external network for the software service is made via web browsing by a client 231 configured on the internal network system 230.

[0058] In the virtual browsing activation phase (S13), the creation of the relay environment by activating the virtual browsing is performed by the management server 232 configured in the internal network system 200 using the virtual browser VB. Accordingly, the management server 232 receives code for software execution from the service server 220 and data files for software services from the data file storage server 133.

[0059] In the rendering image output stage (S16), the rendering image is output via web browsing on a client 231 configured in the internal network system 200.

[0060] Figure 5 is a block diagram showing yet another embodiment of the control system according to the present invention.

[0061] Referring to Figures 2, 3, and 5, the control system 300 of this fourth embodiment includes a service server 320 and an internal network system 330. The service server 320 provides software services to the client 331, and the internal network system 330 includes the client 331, a management server 332, and a data file storage server 333.

[0062] The data file storage server 333 configured in the control system 300 of the fourth embodiment has the same basic functions as the data file storage servers 133 and 233 configured in the control systems 100 and 200 of the first to third embodiments. However, unlike the first to third embodiments, the client 331 configured in the control system 300 of the fourth embodiment includes a virtual browser VB for virtual browsing, thereby enabling the client 331 itself to build the relay environment and perform rendering functions.

[0063] Furthermore, the management server 332 transmits the software code received by the service server 320 to the client 331.

[0064] More specifically, regarding the client 331 of the fourth embodiment, an attempt to access the service server 320 on the external network for software services is made by web browsing of the client 331 configured on the internal network system 330. The client 331 is divided into a general area Z1 that is publicly accessible on the internal network and an isolated area Z2 that is isolated from the internal network and where data communication to the service server 320 takes place.

[0065] In other words, when the dedicated application for client 331 is executed, client 331 is divided into a general area Z1 where the rendering image is output and an isolated area Z2 where the relay environment is formed and the rendering function is performed.

[0066] In an environment where client 331 is divided into a general area Z1 and an isolated area Z2, the attempt to access the external network (S12) includes the steps of: having client 331 run a dedicated application for software services in the general area Z1; having client 331 perform web browsing in the general area Z1; outputting a second execution window displaying one or more software identification display APs during the execution of the dedicated application; and determining the target software service by selecting the identification display AP.

[0067] On the other hand, in the virtual browsing activation stage (S13), the creation of a relay environment by activating the virtual browsing is performed by the virtual browser VB in the isolated area Z2 of the client 331. Therefore, the rendering image output stage (S16) includes the step of rendering the third execution window of the software output during virtual browsing in the relay environment of the isolated area Z2 to generate a rendering image, and the step of outputting the rendering image in the general area Z1 via web browsing.

[0068] Ultimately, when the client 331's dedicated application requests a software service from the service server 320, the service server 320 transmits the requested software code to the internal network system 300. The management server 332 of the internal network system 300, upon receiving the software code, transmits it to the client 331's isolated area Z2. The virtual browser VB in the isolated area Z2 then executes and renders the software in the relay environment and transmits the rendered image to the client 331's general area Z1.

[0069] For software services in isolated area Z2, data files are searched for on data file storage server 333, and data files generated during software services are saved on data file storage server 333.

[0070] In the fourth embodiment, tasks such as creating a relay environment using the virtual browser VB, rendering, and outputting rendered images are divided and performed separately for each client 331. This reduces the burden on the service server 320 or the management server 332 of the internal network system 300 for tasks related to the software services requested by the client 331, thereby minimizing the use of server resources. Furthermore, since there is no need to upgrade the equipment specifications of the service server 320 or the management server 332 for the software services, the cost burden for constructing the service server 320 or the management server 332 can be reduced.

[0071] In addition, the client 331 of this embodiment incorporates a web editor ED for viewing and editing data files stored on the data file storage server 333. When the web editor ED of the client 331 is in use, local saving to the client 331 is blocked, so security can be expected to be limited to the unauthorized leakage of data files stored on the data file storage server 333.

[0072] While the above-mentioned detailed description of the present invention has been based on preferred embodiments, a person skilled in the art or someone with ordinary knowledge of the art will understand that the present invention can be modified and altered in various ways without departing from the spirit and technical domain of the invention as described in the claims below.

Claims

1. An internal network system configured such that one or more clients, a management server, and a data file storage server are connected to an internal network isolated from the external network and communicate with each other, comprising a security level setting stage in which the storage locations configured on the data file storage server are classified by security level and security levels are set for each software service, For software services, the internal network system attempts to approach the service server on the external network in an external network access attempt phase, A virtual browsing activation stage is performed to activate virtual browsing in response to web browsing of the internal network system and to create a relay environment. A control phase involves establishing a control environment to ensure that the execution of software services and data management are restricted and carried out in storage facilities corresponding to the security level. The process includes a rendering image output stage in which the first execution window of the software output during virtual browsing in the relay environment is rendered to generate a rendering image, and the rendering image is output via web browsing of the internal network system, A method for controlling software services by web isolation, including a gradual control method.

2. The aforementioned attempt to access the external network is, The step of running a dedicated application for software services on the aforementioned internal network system, The steps include: Performing web browsing on the aforementioned internal network system; During the execution of the aforementioned dedicated application, a second execution window is output displaying the identification of one or more software programs. A method for controlling software services by web isolation according to claim 1, comprising the step of determining the software service to be used by the selection of the identification display.

3. The web isolation method for controlling software services by classification according to claim 1, wherein a sandbox is created in the relay environment to perform rendering processing for the first execution window of the software.

4. The method for controlling software services by web isolation according to claim 1, wherein in the virtual browsing activation stage, the creation of a relay environment by activating the virtual browsing is performed by a virtual browser on an external network.

5. During the attempt to access the external network, the attempt to access the service server on the external network for the software service is made via web browsing of a client configured in the internal network system. The method for controlling software services by web isolation according to claim 1, wherein, in the virtual browsing activation stage, the creation of a relay environment by activating the virtual browsing is performed by a virtual browser in the client's isolated area.

6. An attempt to access the service server on an external network for the aforementioned software service is made via web browsing by a client configured in the internal network system, and the client is divided into a general area exposed on the internal network and an isolated area isolated from the internal network where data communication to the service server takes place. The aforementioned attempt to access the external network is, The aforementioned client runs a dedicated application in the general area for software services, The step of allowing the aforementioned client to perform web browsing in the general area, During the execution of the aforementioned dedicated application, a second execution window is output displaying the identification of one or more software programs. The step includes determining the software service to be used based on the aforementioned identification display selection, The rendering image output stage is as follows: The process involves rendering the third execution window of the software output during virtual browsing in the relay environment of the aforementioned isolated area to generate a rendered image, A method for controlling software services by web isolation according to claim 5, comprising the step of outputting the rendered image in a general area via web browsing.

7. An attempt to access the external network service server for the software service is made via web browsing by a client configured in the internal network system. The method for controlling software services by web isolation according to claim 1, wherein, in the virtual browsing activation stage, the creation of a relay environment by activating the virtual browsing is performed by a virtual browser on a management server configured in the internal network system.

Images