KR101315482B1 - Secret information reading service system using by a writer authentication and the control method thereof - Google Patents

Abstract

The present invention relates to a system for viewing confidential information through author authentication and a method of controlling the same. The present invention relates to a real-time authentication of a user who wants to view the corresponding information by inputting constraints for viewing the confidential information of the creator who produced the confidential information. In addition to providing access to documents only, the reader can view documents only in the allowed time and number of times and in the permitted environment, thereby ensuring the safe circulation of confidential information. And a control method thereof.
To this end, the confidential information reading service system through the author authentication according to the present invention, the authorized user connected to the predetermined confidential document through the wired / wireless network only through online authentication from the terminal (server) of the document creator side. It is made to be able to view under a certain condition at the terminal; A viewer program including a corresponding confidential document transmitted and driven to the user side terminal; An authentication module that performs authentication using the reader and the media information, an encryption module that decrypts the contents of the encrypted document using the user authentication information as the encryption key, and a document viewer that provides a viewer function to view the contents of the confidential document. Module, a completely-deleted module that completely deletes the executable file when the viewer for the confidential document is not the designated medium or the authentication error occurs a specified number of times, and the access blocking function is restricted so that the copy of the file is restricted. And a file filter driver for performing the above, and a framework for XML-based encrypted communication between the producer program and the viewer program, while the producer program mounted on the document creator side terminal; A reading authentication generation module that authorizes the reading of the confidential document using the reader and the media information, a meta information analysis module for filtering the contents of the text, tables, pictures, etc. of the document, and is mounted as a filtered document or OCX. Security document generation module that reproduces the document in the form of an executable file, an encryption module that decrypts the contents of the encrypted document using the user authentication information as the encryption key, and a file filter driver that performs an access blocking function so that copying of the file is restricted. And a framework for XML-based encrypted communication between the producer program and the viewer program.

Description

Confidential information reading service system through author certification and its control method {SECRET INFORMATION READING SERVICE SYSTEM USING BY A WRITER AUTHENTICATION AND THE CONTROL METHOD THEREOF}

      The present invention relates to a system for reading confidential information through author authentication and a method of controlling the same. More specifically, an authorized user can read confidential information only through online authentication of a corresponding document author, The present invention relates to a confidential information access service system and a control method through author authentication, which makes it impossible to view and leak a document so that security of confidential information can be secured.

      Recently, with the rapid development of the wired and wireless Internet, the importance of various information leakage in various fields including public offices, corporations, medical institutions, etc. is increasing.

      However, the conventional insider information leakage prevention system and similar solutions to prevent information leakage are provided only to prevent the first information leakage and when the first view is allowed, the seriousness of information leakage by the authorized user There is a problem that can not be prepared.

      In addition, as the management is performed only for the allowed users, a problem may occur that information leakage may be caused by a third party if the permitted user views the confidential information from the outside and leaves the information without deleting the information. Done.

Accordingly, the present invention has been made in order to improve the above-mentioned conventional problems, the object of the user to view the information by inputting constraints such as the creator who produced the confidential information can view the confidential information, etc. In addition to providing access to documents through real-time authentication, the reader can view documents only at the allowed time and number of times and in the permitted environment, thereby ensuring the safe distribution of confidential information. It is to provide a reading service system and a control method thereof.

      Confidential information reading service system through the author authentication according to the present invention for achieving the above object, through a wired or wireless network only through online authentication from the terminal (server) of the document creator side for a given confidential document It is made to be able to view under a certain condition in the connected user terminal connected; A viewer program including a corresponding confidential document transmitted and driven to the user side terminal; An authentication module that performs authentication using the reader and the media information, an encryption module that decrypts the contents of the encrypted document using the user authentication information as the encryption key, and a document viewer that provides a viewer function to view the contents of the confidential document. Module, a completely-deleted module that completely deletes the executable file when the viewer for the confidential document is not the designated medium or the authentication error occurs a specified number of times, and the access blocking function is restricted so that the copy of the file is restricted. And a file filter driver for performing the above, and a framework for XML-based encrypted communication between the producer program and the viewer program, the producer program being mounted on the terminal of the document creator. A reading authentication generation module that authorizes the reading of the confidential document using the reader and the media information, a meta information analysis module for filtering the contents of the text, tables, pictures, etc. of the document, and is mounted as a filtered document or OCX. Security document generation module that reproduces the document in the form of an executable file, an encryption module that decrypts the contents of the encrypted document using the user authentication information as the encryption key, and a file filter driver that performs an access blocking function so that copying of the file is restricted. And a framework for XML-based encrypted communication between the producer program and the viewer program.

      Preferably, the authentication module of the viewer program, a certificate-based authentication module for decrypting the information encrypted with the public key of the viewer in the producer program in order to view the document of the executable file, the private key of the viewer, and in the form of an executable file ID / PW based authentication module that authenticates according to the viewer's ID / PW when executing the document and the terminal designated by the producer program using the user's PC information and smartphone device information when executing the document in the form of an executable file. It comprises a medium-based authentication module for performing a medium authentication so that the document can be viewed only through the above, wherein the production authentication module of the producer program, the reader's public key, the viewer's ID / PW, PC information and smart phones Characterized in that the authentication is made using the information.

      Preferably, the producer program, characterized in that the report module is further provided for reporting the record that the reader read the confidential document.

      On the other hand, the control method of the confidential information reading service system through the author authentication according to the present invention, after encrypting a predetermined confidential document created by the author side through a general document creation program through the producer program, the wired and wireless network network Generating a confidential document and transmitting the program to a user terminal of a remote site connected through the program; A user information input step of inputting user information for reading the corresponding confidential document through the reader program at the user side receiving the confidential document included in the reader program and transmitting it to the producer program side; A reading approval step of judging the information by the producer program side which has received the user information and selectively approving the reading; A document reading step of executing the confidential document through a document viewer module of the viewer program according to the approval of the reading from the producer program; After the confidential document is executed under the permitted conditions, the control is performed through a process of completely deleting the document, which is completely deleted such that it cannot be restored on the viewer program side.

      Preferably, the document viewing step comprises the steps of: receiving an authorized decryption key according to a read approval from the producer program, and proceeding to decrypt the corresponding confidential document via the authorized decryption key; After acquiring the document format, the process of reading the confidential document is performed by driving the embedded OCX.

      In addition, in the reading approval step, if the user information transmitted from the producer program receiving the user information does not meet the allowable conditions, the control proceeds to the complete document deletion step characterized in that the control is completely deleted. .

According to the present invention made as described above, in order to view a specific confidential document must be through user identification and authentication, even if the user's information is known in advance, the security element is provided so that only the corresponding terminal can be read Documents cannot be viewed, and copying and redistribution of the documents are prevented, thus ensuring the complete security.

That is, when the document is viewed, security elements such as user authentication, reading period, PC and smartphone information, and the number of readings are inserted in the document, so that the security of the document itself is very high. will be.

In addition, since there is an effect that can easily and securely view the document in a state that does not require the installation of additional software to safely view the document from the outside, there is also an effect that can provide convenience to the document viewer.

1 is a view showing a schematic configuration of a system for reading confidential information through author authentication according to the present invention;
Figure 2a is a block diagram of a reader program provided in the confidential information reading service system through the author authentication in accordance with the present invention,
Figure 2b is a block diagram of a producer program provided in the confidential information viewing service system through the author authentication in accordance with the present invention,
3 is a view showing the configuration of a filter driver provided in the program for the reader and the program for the producer of the confidential information reading service system through the author authentication according to the present invention;
4 is a view showing the architecture of a producer program of the confidential information viewing service system through the author authentication according to the present invention,
5 is a flowchart showing the overall control process of the confidential information viewing service system through the author authentication according to the present invention,
6 is a flowchart illustrating a control process of a viewer program of a confidential information reading service system through author authentication according to the present invention.

Hereinafter, the present invention configured as described above will be described in detail with reference to the accompanying drawings.

1 is a view showing a schematic configuration of a confidential information reading service system through the author authentication according to the present invention, Figure 2a is a block diagram of a program for the reader provided in the confidential information reading service system through the author authentication according to the present invention 2B is a block diagram of a producer program provided in a confidential information reading service system through author authentication according to the present invention, and FIG. 3 is a producer program and a producer for a confidential information reading service system through author authentication according to the present invention. 4 is a view showing the configuration of a filter driver provided in the program, Figure 4 is a view showing the architecture of the producer program of the confidential information reading service system through the author authentication in accordance with the present invention, Figure 5 is the author through the author authentication in accordance with the present invention Represents overall control process of confidential information access service system Low chart, Figure 6 is a flowchart showing the control process of the viewers viewing the program of confidential information service system based on certification according to the author of this invention.

      Confidential information reading service system through the author authentication according to the present invention, the user who produced the confidential information, the user who wants to read the information by inputting constraints and the like that can view the confidential information through the producer program (10) In addition to viewing the document only through real-time authentication of the viewer, the viewer is implemented to allow the reading of the document only in the allowed time and number of times, the allowed environment through the program for the viewer 20.

      To this end, in the confidential information reading service system through the author authentication according to the present invention, the author side terminal 100 for a predetermined confidential document and the user side terminal 200 for reading the confidential document mutual wired and wireless Internet network. In the state connected via 300, the user side terminal 200 is driven by the producer program 10 mounted on the creator side terminal 100 and the viewer program 20 driven by the user side terminal 200. ) Allows access to the confidential documents under acceptable conditions.

      At this time, the format of the documents for the confidential information may be used HWP Korean OCX, MS-OFFICE-based XSL, PPT, DOC, and PDF and CAD OCX that are used universally.

      Here, the viewer program 20 mounted in the user terminal 200 includes a plurality of authentication modules 22a, 22b, and 22c, an encryption module 25, a document viewer module 24, and a complete program. The deletion module 23, the file filter driver 26, the framework 27, etc. are comprised.

      The authentication module (22a, 22b, 22c) is a module for performing authentication by using the reader and the media information, which is information encrypted with the public key of the viewer in the producer program 10 to view the document in the form of an executable file The certificate-based authentication module 22a for decrypting the document with the viewer's private key, the ID / PW-based authentication module 22b for authenticating according to the viewer's ID / PW when executing the document of the executable file type, and the executable file type. Performs media authentication so that documents can only be viewed through the terminal specified by the producer program using the user's PC information (such as IP and MAC addresses) and smartphone device information (phone number and device unique number). Can be classified into a medium-based authentication module (22c).

      In addition, the encryption module 25 performs a function of decrypting the contents of the encrypted document by using the authentication information of the user as an encryption key, and the document viewer module 24 is a corresponding secret transmitted from the producer program 10. It is configured to provide a display function to check the contents of the document.

      The completely erasing module 23 performs a function of completely deleting a secret document made of an executable file when the viewer for the secret document is not a designated medium or an authentication error occurs a specified number of times. To be done.

      The complete deletion in the complete deletion module 23 refers to a function of completely deleting a file or folder in Windows so as not to recover in any way, and in an operating system such as Windows 95/98 / ME / NT / 2000 / XP. When the file is deleted, only the information (FAT, MFT, file name and size, etc.) of the file is deleted, and the contents of the deleted file remain in the actual data area. Therefore, the file's contents remain forever unless you delete the file and overwrite it with other data. Therefore, not only the information about the file but also the contents of the file cannot be recovered. By using this principle, when a document is viewed in an unauthorized range or when an unauthorized user views the document, the document is completely deleted.

      In addition, the file filter drive 26 is configured to perform an access blocking function to restrict the copying of the file when the document using the embedded OCX through the reader program, the framework 27 is the producer The application program 10 and the viewer program 20 are provided to perform XML-based encrypted communication between each other.

      The file filter drive 26 will be described in more detail with reference to FIG. 3. When an application issues a command to read a file, the I / O manager receives the request, generates an IRP, and stores the generated IRP file. It is passed to the system driver. When the file system determines that the first file access to data occurs, it initiates file caching. The file filter driver 26 sets a policy when the file filter driver 26 is loaded for a processor for accessing a file so that only the corresponding process (a process for a viewer) can access the confidential information. It is possible to prevent spills due to copying or moving.

      On the other hand, the producer program 10 mounted on the creator side terminal 100, the reading authentication generation module 12, meta information analysis module 15, security document generation module 14, encryption module ( 13), a reporting module 16, a file filter driver 17, a framework 18, and the like.

      The reading authentication generation module 12 performs a function of authenticating the reading of the confidential document by using the corresponding reader and the medium information, wherein the reading authentication generation module 12 is the program for the reader 20 It is preferable to be configured to authenticate the reading by using the public key of the reader, the ID / PW of the reader, PC information and smart phone information, etc., in association with each authentication module (22a, 22b, 22c).

      The encryption module 13 decrypts the contents of the encrypted document using the authentication information of the user as the encryption key.

      This is preferably implemented as a module capable of supporting both international standard cryptographic algorithms (AES, 3DES, etc.) and domestic cryptographic algorithms (SEED, ARIA).

      The secure document generation module 14 is configured to reproduce a filtered document or a document mounted as an OCX in the form of an executable file, and the meta information analysis module 15 includes a text and a table included in the confidential document. , Filtering the contents of the picture, etc.

      That is, the confidential document provided through the viewer program 20 according to the present invention is a document file (EXE) that can be executed without a separate viewer program after reading the contents of the text, tables, pictures, etc. through the document filter system It is provided in the form.

      The reporting module 16 is provided to report the record of the user reading the confidential document through the operation of the viewer program 20, which, together with the illegal leakage prevention function of the encrypted electronic document, Through control and tracking of usage, the security of the confidential documents can be improved.

      To describe this in more detail, the reporting function is to view and search the information of the reader, the number of views and search by the reader for the confidential information, the inquiry and search of the reading equipment for the confidential information, the reader inquiry and search for the confidential information, by the reader Functions such as inquiry of confidential information reading record and inquiry of malicious user's browsing attempt log about confidential information are provided.

      The file filter driver 17 and the framework 18 included in the producer program 10 have the same functions as the file filter driver 26 and the framework 27 included in the viewer program 10. Will be performed.

Reference numeral 11 and reference numeral 21 denote a UI module for inputting and selecting user information as a user interface on the viewer program 20 side, and a UI for input and selection of viewing conditions as a user interface on the producer program 10 side, respectively. Represents a module.

      Next, a process of controlling the confidential information reading service system through the author authentication according to the present invention made as described above will be described with reference to FIG.

      Confidential information reading service system through the author authentication according to the present invention, a confidential document generation and program transmission step (S 1), user information input step (S 2), reading approval step (S 3), document viewing step (S 4) and, through the process of complete document deletion step (S 5), the control is made, through which the confidential information can be read only through the authentication of the document creator in the information transfer between P2P, through this Information leakage by an allowed viewer can be prevented.

      First, the confidential document generation and program transmission step (S 1) in the state that the predetermined confidential document created through the general document creation program is reproduced in the form of encrypted executable file through the producer program 10, It is transmitted to the user terminal 200 through the wireless Internet network (300).

      The confidential document reproduced in the form of the executable file is generated and included in the viewer program 20 through an encryption module and a hash module, and the viewer program 20 is applied only to the document.

      The confidential document is transmitted to the user terminal 200 in the form of an encrypted confidential document included in the viewer program 20 in a state in which the confidential document is encrypted through a symmetric key encryption algorithm using the reader information.

      Thus, in the user information input step (S 2), the user side receiving the confidential document enters user information for reading the corresponding confidential document through the reader program 20, wherein the user through the user information input As described above, authentication is performed through an authentication module such as certificate-based, ID / PW-based, media-based, and the like.

      In other words, the user's password and password can be entered, or the certificate DN owned by the viewer can be used. If the user's authentication information is not known, the OTP, which is a one-time password, can also be used.

      In the medium authentication, IP and MAC addresses can be used for a PC, and a phone number and a device unique number can be used for a smart phone.

      Thereafter, in the reading approval step (S 3), the producer program 10 that has received the user information selectively approves the reading of the confidential document under a predetermined condition, in which case the producer program 10 Upon approval of reading, the authorized document is transmitted to the viewer program 20, and then decryption of the secret document proceeds through the authorized decryption key, and after the document format is acquired, the embedded OCX is driven. Through the document viewing module (S4) is performed through the document viewer module 24 to view the confidential document through.

      At this time, the confidential document is embedded in the viewer program 20 using the OCX provided by the S / W for Hangul files, office files, CAD, PDF files, the embedded OCX program is In the menu configuration, the menu functions such as Save and Save As are removed, and are designed to be read only through the corresponding viewer program 20.

      In addition, the reading of the confidential document is possible only within the designated number of times and the period through the approved reader program 20, of course.

      On the other hand, in the reading approval step (S 3), if the user information on the producer program 10 side that has received the user information does not satisfy the allowable conditions, the process proceeds directly to the complete document deletion step (S 5).

      Lastly, after the confidential document is executed under the permitted conditions, the document erasing step (S 5) which is completely deleted to be impossible to restore on the viewer program side causes the user to completely delete the module 23 of the viewer program 20. As it progresses through, the leakage of information, including redistribution and copying of the confidential documents, is completely blocked, thereby ensuring stability.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the scope of the appended claims.

10: producer program, 11, 21: UI module,
12: reading authentication generation module, 13, 25: cryptographic module,
14: secure document generation module, 15: meta information analysis module,
16: reporting module, 17, 26: file filter driver,
18,27: framework, 20: viewer program,
22a, 22b, 22c: authentication module, 23: complete deletion module,
24: document viewer module, 100: author side terminal,
200: user terminal, 300: internet network.

Claims (6)

For a certain confidential document, it is made possible to view under a certain condition in an authorized user terminal connected through a wired / wireless network network only through online authentication from a document creator side terminal (server);
A viewer program including a corresponding confidential document transmitted and driven to the user side terminal;
A certificate-based authentication module that decrypts information encrypted with the public key of the viewer in the producer program to read the document in the form of an executable file, and authenticates the ID / PW of the viewer according to the input when executing the document in the form of an executable file. This ID / PW-based authentication module, and the medium-based to perform the media authentication so that the document can be viewed only through the terminal specified by the producer program using the user's PC information and smartphone device information when executing the document in the form of an executable file An authentication module for performing authentication using an authentication module;
An encryption module for decrypting contents of an encrypted document using user authentication information as an encryption key;
A document viewer module that provides a viewer function to view the contents of the confidential document;
When the viewer for the confidential document is not specified media or if the authentication error occurs a specified number of times, a permanent deletion module that completely deletes the executable file is impossible to recover,
A file filter driver that performs an access blocking function to restrict copying of the file, and
It consists of a framework for XML-based encrypted communication between producer programs and viewer programs.
The producer program mounted on the document creator side terminal;
A reading authentication generation module for authenticating a reading of the corresponding confidential document by using the reading information and the media information;
Meta information analysis module for filtering the content of text, tables, pictures, etc. of the document,
A secure document generation module which reproduces the filtered document or the document loaded as an OCX as an executable file;
An encryption module for decrypting contents of an encrypted document using user authentication information as an encryption key;
A file filter driver that performs an access blocking function to restrict copying of the file, and
And a framework for XML based encrypted communication between the producer program and the viewer program. The method of claim 1,
The authentication module of the viewer program,
A certificate-based authentication module for decrypting the information encrypted with the public key of the viewer in the producer program to read the document in the form of an executable file with the private key of the viewer,
ID / PW based authentication module that performs authentication according to the viewer's ID / PW when executing the document in the form of an executable file, and
It includes a media-based authentication module for performing a media authentication so that the document can be viewed only through the terminal designated by the producer program using the user's PC information and smartphone device information when executing the document in the form of an executable file,
Accordingly, the reading authentication generation module of the producer program,
Confidential information viewing service system through the author authentication characterized in that the authentication is made using the reader's public key, the reader's ID / PW, PC information and smartphone information. The method of claim 1,
In the producer program,
Confidential information viewing service system through the author authentication, characterized in that the reporting module further comprises a reporting module for reporting the record that the reader read the confidential document. Generating a confidential document and transmitting the program by encrypting a predetermined confidential document created by a creator through a general document creation program through a producer program, and then transmitting the confidential document to a user terminal of a remote site connected through a wired or wireless network;
A user information input step of inputting user information for reading the corresponding confidential document through the reader program at the user side receiving the confidential document included in the reader program and transmitting it to the producer program side;
A reading approval step of judging the information by the producer program side which has received the user information and selectively approving the reading;
A document reading step of executing the confidential document through a document viewer module of the viewer program according to the approval of the reading from the producer program;
Control is made through a process of completely deleting a document which is completely deleted such that the confidential document is executed under an authorized condition and cannot be restored on the viewer program side;
The document viewing step,
Receiving an authorized decryption key in accordance with a read approval from the producer program;
Decrypting the confidential document via the authorized decryption key;
After the document format is acquired, the method of controlling the confidential information viewing service system through the author authentication characterized in that the step of proceeding to view the corresponding confidential document by driving the embedded OCX embedded. delete 5. The method of claim 4,
In the reading approval step, if the user information transmitted from the producer program receiving the user information does not satisfy the allowable conditions, the author authentication is characterized in that the control proceeds to the complete document deletion step to completely delete the document. Method of controlling confidential information viewing service system through.

Images