Gateway system and method for protecting security data

Abstract

The present invention relates to a gateway system and method for protecting security data and may comprise: generating an information protection map that defines security data to be protected; when receiving a first message transmitted from a data provision apparatus to a learning system, encoding the first message on the basis of the information protection map and transmitting the encoded first message to the learning system; and when receiving a second message transmitted from the learning system to the data provision apparatus, decoding the second message on the basis of the information protection map and transmitting the decoded second message to the data providing apparatus.

Description

Gateway system and method for protecting security data

[0001] The following embodiments relate to a technology for protecting secure data such as personal information, confidential information, and important information provided during a learning process of a learning system.

[0002] With recent technological advancements from companies like Google, OpenAI, and Meta, businesses are increasingly integrating artificial intelligence (AI) into their operations to improve productivity.

[0003] For example, intelligent bots powered by machine learning can now write business project reports in less than a minute, summarize complex information, and even extract information, significantly reducing the time required for human tasks. The current situation has forced companies to adopt this technology.

[0004] Unfortunately, as adoption demand grows, development costs are becoming a major barrier for companies lacking adequate funding. Therefore, many third-party providers are offering services such as public or open APIs to enable companies to more easily use AI services with less development effort and cost.

[0005] Public or open API services allow businesses to easily connect and integrate with a variety of third-party services without having to start the development process from scratch.

[0006] However, using third-party API services can raise concerns about external entities collecting user data. When users interact with AI services, API providers can collect and process user data, potentially exposing sensitive information to data privacy or data breach risks.

[0007] Integrating third-party API services requires compliance with relevant privacy and regulatory requirements and a secure environment to protect data privacy.

[0008] In the age of artificial intelligence and big data, it's challenging for companies to protect their data from data breaches. Therefore, mechanisms are needed to mitigate privacy risks in AI services and protect sensitive corporate data.

[0009] The present invention aims to provide a gateway system and method for protecting security data.

[0010] A method for protecting security data in a gateway system according to one embodiment of the present invention may include the steps of: generating an information protection map defining security data to be protected; receiving a first message transmitted from a data providing device to a learning system, encoding the first message based on the information protection map and transmitting the encoded first message to the learning system; and receiving a second message transmitted from the learning system to the data providing device, decoding the second message based on the information protection map and transmitting the decoded second message to the data providing device.

[0011] At this time, the information protection map may include a homomorphic encryption technique applied to each data type, a homomorphic encryption technique applied to an entity name and entity field classified as the security data, and a homomorphic encryption technique applied to a value of a preset entity.

[0012] At this time, the step of encoding the first message based on the information protection map and transmitting the encoded first message to the learning system may include the step of checking whether the first message includes the security data defined in the information protection map; the step of homomorphically encrypting the security data using an encryption technique defined in the information protection map if the first message includes the security data; and the step of replacing the security data included in the first message with homomorphically encrypted security data to generate the encoded first message.

[0013] At this time, the step of checking whether the first message includes the security data defined in the information protection map may be performed by using rule-based named entity recognition (NER) to check whether data such as the security data defined in the information protection map exists in the first message, or by using named entity recognition (NER) based on a large language model (LLM) to check whether data such as the security data defined in the information protection map exists in the first message.

[0014] At this time, the step of decoding the second message based on the information protection map and transmitting the decoded second message to the data providing device may include: a step of checking whether the second message includes homomorphic encrypted data defined in the information protection map; a step of decrypting the homomorphic encrypted data using a homomorphic encryption technique defined in the information protection map if the second message includes the homomorphic encrypted data; and a step of replacing the homomorphic encrypted data included in the second message with decrypted data to generate the decoded second message.

[0015] At this time, the step of checking whether the second message includes the homomorphic encrypted data defined in the information protection map may be performed by using rule-based named entity recognition (NER) to check whether data such as the homomorphic encrypted data defined in the information protection map exists in the second message, or by using named entity recognition (NER) based on a large language model (LLM) to check whether data such as the homomorphic encrypted data defined in the information protection map exists in the second message.

[0016] At this time, the method for protecting security data in the gateway system further includes a step of generating a time-limited information protection map that is valid only until a preset expiration time, and the step of encoding the first message based on the information protection map and transmitting the encoded first message to the learning system may encode the first message based on the time-limited information protection map and transmit the encoded first message to the learning system, and the step of decoding the second message based on the information protection map and transmitting the decoded second message to the data providing device may decode the second message based on the time-limited information protection map and transmit the decoded second message to the data providing device.

[0017] At this time, the step of generating the time-limited information protection map may include generating parameters, random numbers, and secret values ​​used for homomorphic encryption, setting them to be valid only until the preset expiration time, and adding them to the information protection map to generate the time-limited information protection map.

[0018] A gateway system for protecting security data according to an embodiment of the present invention may include: an information protection map generation unit that generates an information protection map defining security data to be protected; an encoding unit that, when receiving a first message transmitted from a data providing device to a learning system, encodes the first message based on the information protection map and transmits the encoded first message to the learning system; and a decoding unit that, when receiving a second message transmitted from the learning system to the data providing device, decodes the second message based on the information protection map and transmits the decoded second message to the data providing device.

[0019] At this time, the information protection map may include a homomorphic encryption technique applied to each data type, a homomorphic encryption technique applied to an entity name and entity field classified as the security data, and a homomorphic encryption technique applied to a value of a preset entity.

[0020] At this time, the encoding unit can check whether the first message includes the security data defined in the information protection map, and if the first message includes the security data as a result of the check, can homomorphically encrypt the security data using an encryption technique defined in the information protection map, and can replace the security data included in the first message with homomorphically encrypted security data to generate the encoded first message.

[0021] At this time, the encoding unit can use rule-based named entity recognition (NER) to confirm that data such as the security data defined in the information protection map exists in the first message, or can use named entity recognition (NER) based on a large language model (LLM) to confirm that data such as the security data defined in the information protection map exists in the first message.

[0022] At this time, the decoding unit checks whether the second message includes homomorphic encrypted data defined in the information protection map, and if the second message includes the homomorphic encrypted data as a result of the check, the homomorphic encrypted data is decrypted using the homomorphic encryption technique defined in the information protection map, and the homomorphic encrypted data included in the second message is replaced with decrypted data to generate the decoded second message.

[0023] At this time, the decoding unit can use rule-based named entity recognition (NER) to confirm that data such as the homomorphic encrypted data defined in the information protection map exists in the second message, or can use named entity recognition (NER) based on a large language model (LLM) to confirm that data such as the homomorphic encrypted data defined in the information protection map exists in the second message.

[0024] The gateway system protecting the security data further includes a session generation unit that generates a time-limited information protection map that is valid only until a preset expiration time.

[0025] The encoding unit may encode the first message based on the time-limited information protection map and transmit the encoded first message to the learning system, and the decoding unit may decode the second message based on the time-limited information protection map and transmit the decoded second message to the data providing device.

[0026] At this time, the session creation unit can create the time-limited information protection map by creating parameters, random numbers, and secret values ​​used for homomorphic encryption and adding them to the information protection map by setting them to be valid only until the preset expiration time.

[0027] The present invention relates to a gateway system and method for protecting security data, wherein the system generates an information protection map defining security data to be protected, homomorphically encrypts security data included in a message transmitted from a data providing device to a learning system and transmits it to the learning system, and decrypts the homomorphically encrypted data included in a message transmitted from the learning system to the data providing device and provides it to the data providing device, thereby protecting the security data while utilizing the benefits of the artificial intelligence service of the learning system.

[0028] FIG. 1 is a schematic diagram illustrating a message flow for protecting secure data between a data providing device and a learning system in a gateway system according to an embodiment.

[0029] FIG. 2 is a diagram schematically illustrating a configuration of a gateway system according to one embodiment.

[0030] FIG. 3 is a flowchart illustrating a process for protecting secure data in a gateway system according to one embodiment.

[0031] FIG. 4 is a flowchart illustrating a process of encoding to protect security data in a gateway system according to one embodiment.

[0032] FIG. 5 is a flowchart illustrating a process of decoding to protect security data in a gateway system according to one embodiment.

[0033] FIG. 6 is a diagram illustrating an example of an information protection map defining security data to be protected in a gateway system according to one embodiment.

[0034] FIG. 7 is a diagram illustrating an example of a time-limited information protection map generated by a gateway system according to one embodiment.

[0035] FIG. 8 is a diagram illustrating an example before and after encoding in a gateway system according to one embodiment.

[0036] FIG. 9 is a diagram illustrating an example before and after decoding in a gateway system according to one embodiment.

[0037] Hereinafter, embodiments are described in detail with reference to the attached drawings. However, the embodiments may be modified in various ways, and the scope of the patent application is not limited or restricted by these embodiments. It should be understood that all modifications, equivalents, or alternatives to the embodiments are included within the scope of the patent application.

[0038] The terms used in the examples are for illustrative purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as "comprise" or "have" are intended to indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but should be understood to not preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0039] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the embodiments pertain. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and shall not be interpreted in an idealized or overly formal sense unless explicitly defined herein.

[0040] In addition, when describing with reference to the attached drawings, identical components will be assigned the same reference numerals regardless of the drawing numbers, and redundant descriptions thereof will be omitted. When describing embodiments, if a detailed description of a related known technology is judged to unnecessarily obscure the gist of the embodiment, the detailed description will be omitted.

[0041] Additionally, terms such as first, second, A, B, (a), (b), etc. may be used to describe components of the embodiments. These terms are only intended to distinguish the components from other components, and the nature, order, or sequence of the components are not limited by the terms. When a component is described as being "connected," "coupled," or "connected" to another component, it should be understood that the component may be directly connected or connected to the other component, but another component may also be "connected," "coupled," or "connected" between each component.

[0042] Components included in one embodiment and components with common functions will be described using the same names in other embodiments. Unless otherwise stated, the descriptions given in one embodiment may also apply to other embodiments, and detailed descriptions will be omitted to the extent of overlap.

[0043] Hereinafter, a gateway system and method for protecting security data according to an embodiment of the present invention will be described in detail with reference to the attached FIGS. 1 to 9.

[0044] FIG. 1 is a schematic diagram illustrating a message flow for protecting secure data between a data providing device and a learning system in a gateway system according to an embodiment.

[0045] Referring to FIG. 1, a gateway system (110) can act as a gateway between a data providing device (120) and a learning system (130).

[0046] At this time, the gateway system (110) may not simply play the role of mediating data, but may also perform the role of converting security data into protected data by homomorphic encryption, and decrypting and transmitting the homomorphically encrypted protected data.

[0047] The learning system (130) may be an artificial intelligence system or server provided by Google, OpenAI, Meta, etc. The data provider (120) may be an individual, a company, or a public institution. Therefore, the security data may include personal information, corporate information, confidential information, and public institution information.

[0048] When the gateway system (110) receives a user prompt (151) from a data providing device (120), it homomorphically encrypts the security data included in the user prompt (151), converts it into a protected user prompt (152), and transmits it to the learning system (130).

[0049] And, when the gateway system (110) receives a protected data request (153) requesting data required for learning from the learning system (130), it decrypts the homomorphic encrypted data included in the protected data request (153), converts it into a data request (155), and transmits it to the data providing device (120). The reason why the protected data request (153) includes the homomorphic encrypted data is because it is possible to request information about the homomorphic encrypted data since the data is requested based on the homomorphic encrypted data included in the protected user prompt (152).

[0050] And, when the gateway system (110) receives a data response (155) including data according to a data request (155) from a data providing device (120), it homomorphically encrypts the security data included in the data response (155) and converts it into a protected data response (156) and transmits it to the learning system (130).

[0051] And, when the gateway system (110) receives a protected analysis result (157) corresponding to the learned result from the learning system (130), it decrypts the homomorphic encrypted data included in the protected analysis result (157), converts it into an analysis result (158), and transmits it to the data providing device (120). The reason why the protected analysis result (157) includes the homomorphic encrypted data is because it is an analysis result learned based on a protected user prompt (152) and a protected data response (157).

[0052]

[0053] FIG. 2 is a diagram schematically illustrating a configuration of a gateway system according to one embodiment.

[0054] Referring to FIG. 2, the gateway system (110) may be configured to include a processor (210), a communication unit (220), an interface unit (230), and a memory (240).

[0055] The communication unit (220) can connect communication with the data providing device (120) and the learning system (130) and mediate data between the data providing device (120) and the learning system (130).

[0056] The interface unit (230) is a device that provides an interface with a user (administrator) of the gateway system (110) and can receive input when defining security data.

[0057] The memory (240) stores an operating system, application programs, and storage data for controlling the overall operation of the gateway system (110), and also stores an information protection map requested by a user (administrator) according to the present invention, and can store a time-limited information protection map until a preset expiration time.

[0058] The processor (210) may be configured to include an information protection map generation unit (211), a session generation unit (212), an encoding unit (213), and a decoding unit (214).

[0059] The information protection map generation unit (211) can generate an information protection map defining the security data to be protected. At this time, the information protection map may include a homomorphic encryption technique applied to each data type, a homomorphic encryption technique applied to entity names and entity fields classified as security data, and a homomorphic encryption technique applied to the values ​​of preset entities. Here, an entity may represent a meaningful unit of information.

[0060] FIG. 6 is a diagram illustrating an example of an information protection map defining security data to be protected in a gateway system according to one embodiment.

[0061] Referring to FIG. 6, the information protection map (610) shows that string data types are protected using the AES-ECB 128-bit algorithm (AESECB128) with the "SECRET" value as a secret parameter. Numeric and timestamp data types are protected using the NumAdd and Timestamp Add functions, respectively. Entity names, such as table names or field names, are protected using the AES-ECB 128-bit algorithm (AESECB128) with the "ENTITYSECRET" value as a secret parameter. Furthermore, it can be seen that configurations are defined to override global configurations for multiple fields, such as "Activity," "Timestamp," and "Load," of "Finance," corresponding to a specific entity.

[0062] The session creation unit (212) can create a time-limited information protection map that is valid only until a preset expiration time. The session creation unit (212) can create parameters, random numbers, and secret values ​​used in homomorphic encryption, set them to be valid only until a preset expiration time, and add them to the information protection map to create a time-limited information protection map.

[0063] The session creation unit (212) can discard the time-limited information protection map when the preset expiration time of the time-limited information protection map is exceeded.

[0064] FIG. 7 is a diagram illustrating an example of a time-limited information protection map generated by a gateway system according to one embodiment.

[0065] Referring to FIG. 7, a time-limited information protection map (710) can be created by adding parameters, random numbers, and secret values ​​used for homomorphic encryption to the information protection map (610) and setting them to be valid only until the preset expiration time.

[0066] When the encoding unit (213) receives a first message transmitted from the data providing device (120) to the learning system (130), it can encode the first message based on the time-limited information protection map and transmit the encoded first message to the learning system (130).

[0067] More specifically, the encoding unit (213) checks whether the first message includes security data defined in the information protection map, and if the first message includes security data as a result of the check, the encoding unit (213) can homomorphically encrypt the security data using an encryption technique defined in the time-limited information protection map, and replace the security data included in the first message with homomorphically encrypted security data to generate an encoded first message.

[0068] The encoding unit (213) can use named entity recognition (NER) based on rules to confirm that data such as security data defined in the information protection map exists in the first message, or can use named entity recognition (NER) based on a large language model (LLM) to confirm that data such as security data defined in the information protection map exists in the first message.

[0069] FIG. 8 is a diagram illustrating an example before and after encoding in a gateway system according to one embodiment.

[0070] Referring to FIG. 8, when comparing the first message (810) before encoding and the encoded first message (820) after encoding, it can be confirmed that the security data included in the first message (810) is homomorphically encrypted, and the secured security data included in the encoded first message (820) is changed to homomorphically encrypted security data and stored.

[0071] When the decoding unit (214) receives a second message transmitted from the learning system (130) to the data providing device (120), it can decode the second message based on the time-limited information protection map and transmit the decoded second message to the data providing device (120).

[0072] To be more specific, the decoding unit (214) checks whether the second message includes homomorphic encrypted data defined in the information protection map, and if the second message includes homomorphic encrypted data as a result of the check, the homomorphic encrypted data is decrypted using the homomorphic encryption technique defined in the time-limited information protection map, and the homomorphic encrypted data included in the second message is replaced with the decrypted data to generate a decoded second message.

[0073] The decoding unit (214) can use rule-based named entity recognition (NER) to confirm that data such as homomorphic encrypted data defined in the information protection map exists in the second message, or can use named entity recognition (NER) based on a large language model (LLM) to confirm that data such as homomorphic encrypted data defined in the information protection map exists in the second message.

[0074] FIG. 9 is a diagram illustrating an example before and after decoding in a gateway system according to one embodiment.

[0075] Referring to FIG. 9, when comparing the second message (910) before decoding and the decoded second message (920) after decoding, it can be confirmed that the homomorphic encrypted data included in the second message (910) is decrypted, and the homomorphic encrypted data included in the decoded second message (920) is changed into decrypted data and stored.

[0076]

[0077] Hereinafter, the method according to the present invention configured as described above will be described with reference to the drawings below.

[0078] FIG. 3 is a flowchart illustrating a process for protecting secure data in a gateway system according to one embodiment.

[0079] Referring to FIG. 3, the gateway system (110) can generate an information protection map defining the security data to be protected (310). At this time, the information protection map can include data types, homomorphic encryption techniques for each data type, entities included in the security data, and entity fields.

[0080] In addition, the gateway system (110) can generate a time-limited information protection map that is valid only until a preset expiration time (320). In step 320, the gateway system (110) can generate parameters, random numbers, and secret values ​​used for homomorphic encryption, set them to be valid only until a preset expiration time, and add them to the information protection map to generate a time-limited information protection map.

[0081] And, when the gateway system (110) receives a first message transmitted from the data providing device (120) to the learning system (130) (330), it can encode the first message based on the information protection map and transmit the encoded first message to the learning system (130) (340).

[0082] And, when the gateway system (110) receives a second message transmitted from the learning system (130) to the data providing device (120) (350), it can decode the second message based on the information protection map and transmit the decoded second message to the data providing device (120) (360).

[0083] In addition, the gateway system (110) can check whether the session has ended by checking whether the expiration time preset in the time-limited information protection map has been exceeded (370).

[0084] If the session is not terminated as a result of the verification in step 370, the gateway system (110) can return to step 330 and repeat the series of processes.

[0085] If the session is terminated as a result of the verification in step 370, the gateway system (110) can check whether information protection has been terminated (380).

[0086] If the session is not terminated as a result of the verification in step 380, the gateway system (110) can return to step 320 and repeat the series of processes.

[0087] If the session is terminated as a result of the verification in step 380, the gateway system (110) can terminate this algorithm.

[0088]

[0089] FIG. 4 is a flowchart illustrating a process of encoding to protect security data in a gateway system according to one embodiment.

[0090] Referring to FIG. 4, the gateway system (110) can check whether the first message includes security data defined in the information protection map (410).

[0091] In step 410, the gateway system (110) can use rule-based named entity recognition (NER) to verify that data such as security data defined in the information protection map exists in the first message, or can use named entity recognition (NER) based on a large language model (LLM) to verify that data such as security data defined in the information protection map exists in the first message.

[0092] If the verification result shows that the first message contains security data (420), the gateway system (110) can homomorphically encrypt the security data using an encryption technique defined in the information protection map (430).

[0093] And, the gateway system (110) can generate an encoded first message by replacing the security data included in the first message with homomorphically encrypted security data (440).

[0094]

[0095] FIG. 5 is a flowchart illustrating a process of decoding to protect security data in a gateway system according to one embodiment.

[0096] Referring to FIG. 5, the gateway system (110) can check whether the second message includes homomorphic encrypted data defined in the information protection map (510).

[0097] In step 510, the gateway system (110) can use rule-based named entity recognition (NER) to verify that data such as homomorphic encrypted data defined in the information protection map exists in the second message, or can use named entity recognition (NER) based on a large language model (LLM) to verify that data such as homomorphic encrypted data defined in the information protection map exists in the second message.

[0098] If the verification result shows that the second message contains homomorphic encrypted data (520), the gateway system (110) can decrypt the homomorphic encrypted data using the homomorphic encryption technique defined in the information protection map (530).

[0099] In addition, the gateway system (110) can generate a decoded second message by replacing the homomorphic encrypted data included in the second message with decrypted data (540).

[0100]

[0101] The method according to the embodiment may be implemented in the form of program commands that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may store program commands, data files, data structures, etc., singly or in combination. The program commands recorded on the medium may be those specially designed and configured for the embodiment or may be those known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands, such as ROMs, RAMs, and flash memories. Examples of the program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiment, and vice versa.

[0102] Software may include a computer program, code, instructions, or a combination of one or more of these, and may configure a processing device to perform a desired operation or, independently or collectively, command the processing device. The software and / or data may be stored on any type of machine, component, physical device, virtual equipment, computer storage medium, or device, for interpretation by the processing device or for providing instructions or data to the processing device. The software may also be distributed over networked computer systems, and stored or executed in a distributed manner. The software and data may be stored on one or more computer-readable recording media.

[0103] Although the embodiments described above have been described with limited drawings, those skilled in the art will appreciate that various technical modifications and variations can be applied based on the above. For example, appropriate results can still be achieved even if the described techniques are performed in a different order than described, and / or components of the described systems, structures, devices, circuits, etc. are combined or combined in a different manner than described, or are replaced or substituted with other components or equivalents.

[0104] Therefore, other implementations, other embodiments, and equivalents to the claims also fall within the scope of the claims described below.

Claims

1. Step of creating an information protection map that defines the security data to be protected; When receiving a first message transmitted from a data providing device to a learning system, a step of encoding the first message based on the information protection map and transmitting the encoded first message to the learning system; and A step of receiving a second message transmitted from the learning system to the data providing device, decoding the second message based on the information protection map, and transmitting the decoded second message to the data providing device. A method for protecting secure data in a gateway system including:

2. In paragraph 1, The above information protection map is, Includes a homomorphic encryption technique applied to each data type, a homomorphic encryption technique applied to the entity name and entity field classified as the above-mentioned secure data, and a homomorphic encryption technique applied to the value of a preset entity. How to protect secure data in gateway systems.

3. In paragraph 1, The step of encoding the first message based on the information protection map and transmitting the encoded first message to the learning system is as follows: A step of checking whether the first message includes the security data defined in the information protection map; If the first message contains the security data as a result of the verification, a step of homomorphically encrypting the security data using an encryption technique defined in the information protection map; and A step of generating the encoded first message by replacing the security data included in the first message with homomorphically encrypted security data. A method for protecting secure data in a gateway system including:

4. In paragraph 3, The step of checking whether the above first message includes the security data defined in the information protection map is as follows: Using rule-based named entity recognition (NER), verify that data such as the security data defined in the information protection map exists in the first message, or Using named entity recognition (NER) based on a large language model (LLM), it is confirmed that data such as the security data defined in the information protection map exists in the first message. How to protect secure data in gateway systems.

5. In paragraph 1, The step of decoding the second message based on the information protection map and transmitting the decoded second message to the data providing device is: A step of checking whether the second message includes homomorphic encrypted data defined in the information protection map; If the second message contains the homomorphic encrypted data as a result of the verification, a step of decrypting the homomorphic encrypted data using the homomorphic encryption technique defined in the information protection map; and A step of generating the decoded second message by replacing the homomorphic encrypted data included in the second message with decrypted data. A method for protecting secure data in a gateway system including:

6. In paragraph 5, The step of checking whether the second message includes the homomorphic encrypted data defined in the information protection map is as follows: Using rule-based named entity recognition (NER), verifying that data such as the homomorphic encrypted data defined in the information protection map exists in the second message, or Using named entity recognition (NER) based on a large language model (LLM), it is confirmed that data such as the homomorphic encrypted data defined in the information protection map exists in the second message. How to protect secure data in gateway systems.

7. In paragraph 1, Steps to create a time-limited information protection map that is valid only until a preset expiration time. Including more, The step of encoding the first message based on the information protection map and transmitting the encoded first message to the learning system is as follows: Based on the above time-limited information protection map, the first message is encoded and the encoded first message is transmitted to the learning system, The step of decoding the second message based on the information protection map and transmitting the decoded second message to the data providing device is: Based on the above time-limited information protection map, decoding the second message and transmitting the decoded second message to the data providing device. How to protect secure data in gateway systems.

8. In paragraph 7, The steps for creating the above time-limited information protection map are: Generate parameters, random numbers, and secret values ​​used in homomorphic encryption, and add them to the information protection map to make them valid only until the preset expiration time, thereby generating the time-limited information protection map. How to protect secure data in gateway systems.

9. A computer-readable recording medium characterized in that a program for executing the method of any one of claims 1 to 8 is recorded thereon.

10. Information protection map generation unit that creates an information protection map that defines the security data to be protected; An encoding unit that receives a first message transmitted from a data providing device to a learning system, encodes the first message based on the information protection map, and transmits the encoded first message to the learning system; and A decoding unit that receives a second message transmitted from the learning system to the data providing device, decodes the second message based on the information protection map, and transmits the decoded second message to the data providing device. A gateway system that protects secure data, including:

11. In paragraph 10, The above information protection map is, Includes a homomorphic encryption technique applied to each data type, a homomorphic encryption technique applied to the entity name and entity field classified as the above-mentioned secure data, and a homomorphic encryption technique applied to the value of a preset entity. A gateway system that protects secure data.

12. In paragraph 10, The above encoding section, Verify that the above first message contains the security data defined in the information protection map, If the verification result shows that the first message contains the security data, the security data is homomorphically encrypted using the encryption technique defined in the information protection map, Replacing the security data included in the first message with homomorphically encrypted security data to create the encoded first message. A gateway system that protects secure data.

13. In paragraph 12, The above encoding section, Using rule-based named entity recognition (NER), verify that data such as the security data defined in the information protection map exists in the first message, or Using named entity recognition (NER) based on a large language model (LLM), it is confirmed that data such as the security data defined in the information protection map exists in the first message. A gateway system that protects secure data.

14. In paragraph 10, The above decoding unit, Verify that the second message contains homomorphic encrypted data defined in the information protection map, If the second message contains the homomorphic encrypted data as a result of the verification, the homomorphic encrypted data is decrypted using the homomorphic encryption technique defined in the information protection map, Replacing the homomorphic encrypted data included in the second message with decrypted data to create the decoded second message. A gateway system that protects secure data.

15. In paragraph 14, The above decoding unit, Using rule-based named entity recognition (NER), verifying that data such as the homomorphic encrypted data defined in the information protection map exists in the second message, or Using named entity recognition (NER) based on a large language model (LLM), it is confirmed that data such as the homomorphic encrypted data defined in the information protection map exists in the second message. A gateway system that protects secure data.

16. In paragraph 10, A session creation unit that creates a time-limited information protection map that is valid only until a preset expiration time. Including more, The above encoding section, Based on the above time-limited information protection map, the first message is encoded and the encoded first message is transmitted to the learning system, The above decoding unit, Based on the above time-limited information protection map, decoding the second message and transmitting the decoded second message to the data providing device. A gateway system that protects secure data.

17. In paragraph 16, The above session creation unit, Generate parameters, random numbers, and secret values ​​used in homomorphic encryption, and add them to the information protection map to make them valid only until the preset expiration time, thereby generating the time-limited information protection map. A gateway system that protects secure data.

Images