KR20140015642A - A file securing system based on drive - Google Patents

Abstract

The present invention relates to a drive based file security system capable of encrypting or storing user files in an area file by mounting the area file on a drive by generating the area file in the storage medium of a computer terminal. The drive based file security system comprises an area file generation unit for generating the files (the same as above) in the storage medium of the computer terminal; an area mounting unit for mounting or un-mounting the area file in the drive of the computer terminal; an area encryption unit for encrypting the area file or for decrypting the encrypted area fire; a security file storage unit for opening the user file from a security area or for storing the user file in the area of the mounted drive (security area); and a security file processing unit for mounting the area file by receiving a processing command for the user file, for executing the processing command for the user file in the security area, and for encrypting the area file when the command execution is completed. The user file is stored by mounting the generated area file in the computer terminal using the file security system based on the drive. The area file is encrypted to safely protect the user file without damages to the system of an operating system such as hooking. [Reference numerals] (30) File security system; (50) Kernel layer; (51) System processing module; (52) Disk driver; (60) Hardware; (61) Hard disk; (62) Area file; (70) Application program; (AA) User layer

Description

A File Securing System Based on Drive}

The present invention relates to a drive-based file security system that creates a region file on a storage medium of a computer terminal, mounts the region file as a drive, and stores and encrypts the user file in the region file.

In general, companies or public institutions, such as firewalls or intruder detection systems to block illegal information leakage through unauthorized access from outside and protect important confidential information and information inside I'm installing a security solution. However, this information security solution was only an application for external intruders to the local network (LAN) or PC, and was not a way to prevent the insider from leaking information.

Users within one network (or organization) can easily access other users' file resources. Because users are cumbersome, they don't encrypt files separately. In addition, when collaborating, user files are shared by shared folders. Because of this work habit, there is always a risk that user files are easily exposed to insiders within an organization or within a network.

In order to prevent this, a secure folder has been developed and used. That is, important documents or confidential documents are stored in a secure folder, and the secure folder can be accessed only by a user who is specifically authorized by encryption or the like or who knows authentication information for access.

An example of such a computer file security method is disclosed in Korean Patent No. 10-0324656, "Security Method of Computer File" (hereinafter, referred to as Prior Art 1). Prior art 1 is a technology for securing a computer file or folder by installing a dedicated program and then running the program to select a file or folder requiring security and setting a predetermined security function option on the selected file or folder. Prior art 1 does not suggest a specific security method.

An example of a technology for managing a security zone in a server is disclosed in [Korean Patent Registration No. 10-0948812, "Security Zone Management System and Its Management Method"] (hereinafter, referred to as Prior Art 2). The prior art 2 provides a security zone setting program to a user computer in a security server and monitors and controls the usage history of the connected user. In this case, the security area is determined by selecting a file, a folder, a USB memory, a hard disk drive, or the like. In the secure area, a portion of a storage medium such as a computer is allocated, and files are encrypted and stored in the allocated space. However, the prior art 2 may expose which storage space the security area is, and there is a risk that the security area itself may be removed.

Further, examples of a technology for managing a security area in a mobile storage medium such as a memory are disclosed in Korean Patent Laid-Open No. 10-2011-0132787, "Memory Device With Security Function and Security Method thereof" (hereinafter, referred to as Prior Art 3), [Korean Patent Publication No. 10-2010-0112724, "Secure Mobile Storage and Its Control Method"] (hereinafter, referred to as Prior Art 4). The prior arts 3 and 4, like the prior art 2, are encrypted by setting a secure area as a part of the memory area. However, the prior art hides or encrypts only the path of the security area to prevent access. Therefore, there is a risk that it can be exposed by just finding the path or analyzing the file at the physical level.

Therefore, a technology that can safely hide and secure user files without compromising the operating system system is urgently needed.

[Document 1] Korean Patent No. 10-0948812, "Security Zone Management System and Its Management Method" [Document 2] Korean Patent No. 10-0948812, "Security Zone Management System and Its Management Method" [Patent 3] Korean Patent Laid-Open No. 10-2011-0132787, "Memory Device With Security Function and Security Method thereof" [Patent 4] Korean Patent Publication No. 10-2010-0112724, "Secure Mobile Storage Device and Its Control Method"

SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems, and to generate a file on a storage medium of a computer terminal, and mount a file as a drive to store and encrypt a user file in the file. To provide.

In particular, it is an object of the present invention to provide a drive-based file security system that creates a region file on a storage medium of a computer terminal, mounts the region file as a drive, and stores and encrypts the user file in the region file.

In order to achieve the above object, the present invention relates to a drive-based file security system installed in a computer terminal for storing a user file, comprising: an area file generation unit for generating a file (hereinafter, referred to as an area file) in a storage medium of the computer terminal; An area mounting unit which mounts or unmounts the area file as a drive of the computer terminal; An area encryption unit encrypting and storing the area file or decrypting the stored area file; A security file storage unit for storing a user file in an area of the mounted drive (hereinafter referred to as a security area) or opening a user file from the security area; And, when receiving a processing command for a user file, decrypts and mounts the area file, performs a processing command for the user file in the secure area, and when the command is completed, unmounts and encrypts the area file. And a file processing unit.

In another aspect, the present invention provides a drive-based file security system, the system further comprises an interface unit providing a hierarchical folder interface of the directory structure for the user file, and receives a processing command for the user file. It is done.

In addition, in the drive-based file security system, the interface unit instructs the secure file processing unit to query the directory structure before receiving the processing command for the user file, thereby hierarchically searching the directory structure. It is characterized by displaying.

In the drive-based file security system, the secure file processing unit does not unmount the region file until the storage command is received after receiving the open command for the user file.

The present invention provides a drive-based file security system, wherein the interface unit executes a program matching an extension of the user file and opens the user file with the program after processing an open command for the user file. It features.

In the drive-based file security system, the interface unit receives and stores authentication information of a user in advance, and only an authenticated user executes a processing command of a user file.

In another aspect of the present invention, in the drive-based file security system, the area file generation unit hides the area file on a folder of the computer terminal.

In another aspect of the present invention, in the drive-based file security system, the area mounting unit hides the drive after mounting the area file as a drive.

As described above, according to the drive-based file security system according to the present invention, by mounting the area file generated on the computer terminal to store the user file and encrypts the area file, the user file without damaging the system of the operating system, such as hooking The effect is that it can be safely hidden and secured.

1 is a diagram showing an example of the overall system configuration for implementing the present invention.
2 is a block diagram of a software and hardware configuration of a computer terminal for implementing the present invention.
3 is a block diagram of a configuration of a drive-based file security system according to an embodiment of the present invention.
4 illustrates an example of an interface screen according to an embodiment of the present invention.
5 is a flowchart illustrating a file security method through authentication according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In the description of the present invention, the same parts are denoted by the same reference numerals, and repetitive description thereof will be omitted.

Next, examples of the overall system configuration for implementing the present invention will be described with reference to FIG. As shown in Figures 1a to 1c, the drive-based file security system according to the present invention can be implemented as a program system on a computer terminal or an external storage medium, or a server system on a network.

As shown in FIG. 1A, an example of the entire system for implementing the present invention may include a computer terminal 10 and a file security system 30 installed in the computer terminal 10. That is, each function of the file security system 30 is implemented as a computer program and installed in the computer terminal 10. The file security system 30 configures a file security area for a storage medium 11 of the computer terminal 10, for example, a storage medium image such as a hard disk, an external disk, or a USB memory.

At this time, one file is created in the storage medium 11 as a space (or area) to secure the file. This file is called a zone file. The file security system 30 mounts the area file as a drive so that the computer terminal is recognized as a separate virtual drive.

In addition, as shown in FIG. 1B, another example of the entire system for implementing the present invention may include a computer terminal 10 and a file security system 30 installed in the external storage medium 12. At this time, the system 30 installed in the external storage medium 12 is executed by the computer terminal 10.

In this case, the file security system 30 generates an area file in the storage medium 11 of the computer terminal, and mounts the area file as a virtual driver in the computer terminal. And store the files to be secured in the virtual drive.

Next, as shown in FIG. 1C, another example of the entire system for implementing the present invention is composed of a computer terminal 10 and a file security system 30 and connected to each other via a network 20. It is also possible to further include a database 40 for storing necessary data.

The computer terminal 10 is a typical computing terminal such as a PC, a notebook, or a netbook used by users in an organization.

The file security system 30 is connected to the network 20 as a normal server, directly accesses the storage medium 11 of the computer terminal 10, generates an area file on the storage medium 11, and stores the area file. Mount as a virtual driver on the computer terminal. And store the files to be secured in the virtual drive. The file security system 30 extracts information about the security files and records the extracted data in the database 40. For example, information such as keywords and indexes for quickly searching security files may be extracted and stored.

The database 40 is a conventional storage medium for storing data required by the file security system 30 and stores information about a security file, user access information, and the like. Data stored in the database 40 may be stored in the storage medium 11 or the external storage medium 12 in the example of FIGS. 1A and 1B.

As described above, the drive-based file security system according to the present invention may be various embodiments. For convenience of explanation, the following description will be given as a program system installed in the computer terminal of the embodiment of FIG.

Next, a software and hardware configuration of a computer terminal for implementing the present invention will be described with reference to FIG.

As shown in FIG. 2, the computer terminal 10 for implementing the present invention is composed of an operating system 50, hardware 60, and an application program 70.

The application program 70 is programs executed on the operating system 50, and the operating system 50 is divided into a user layer on which the application programs 70 are executed and a kernel layer on which the operating system is executed. Preferably, operating system 50 is a Windows system.

The hard disk 61 is a hardware device 60 as a storage medium. The hard disk 61 is controlled by the disk driver 52 of the operating system, and the application program 70 calls the system processing module 51, such as a system call, to the hard disk 61 through the disk driver 52. I can access it. That is, the application program 70 may perform file operations such as creating, deleting, updating, and moving files (hereinafter, referred to as user files) in the hard disk 61.

At this time, the hard disk 61 is recognized (mounted) and controlled by the disk driver 52 as one drive. The hard disk 61 is formatted in a file system structure such as FAT32 or NTFS, and stores user files. In particular, the file system is a directory structure having a hierarchical structure and represented in a hierarchical folder form.

The file security system 30 is a program 30, which is a program installed and executed in the user layer of the operating system 50. File security system 30 is a type of security client that secures files.

The file security system 30 creates one zone file 62 in the hard disk 61 and mounts the zone file 62 as a virtual disk so that the disk driver 52 is recognized as one drive. . Therefore, the space (area) allocated to the area file is recognized as one drive and can be accessed with the same file system as the hard disk.

That is, the application program 70 recognizes the space in the area file 62 as one drive, and can access and use the system processing module 51-disk driver 52-area file 62. FIG.

On the other hand, if the file security system 30 unmounts the area file 62, the area file 62 is not recognized as a drive, and thus the application 70 accesses the space (or area) in the area file 62. Can not. The file security system 30 may not simply expose or unmount the zone file 62 to expose user files in the zone file 62 to other applications 70.

In addition, the file security system 30 may prevent the application 70 from accessing the area file 62 itself by encrypting and storing the area file or hiding the area file.

Also, even if you set the “Show hidden files” option in the operating system (OS), the security zone is mounted / unmounted as a single disk, so it is not visible in the operating system (OS) even when mounted, and is not displayed in the computer disk manager.

Next, a drive-based file security system according to an embodiment of the present invention will be described in more detail with reference to FIG. 3.

As shown in FIG. 3, the file security system 30 according to an embodiment of the present invention includes an area file generation unit 31, an area mounting unit 32, an area encryption unit 33, and a security file storage unit 34. And a security file processing unit 35. In addition, the interface unit 36, the monitoring unit 37, the index unit 38 may be configured to further include.

The area file generation unit 31 generates a file (hereinafter, referred to as an area file) on the storage medium 61 of the computer terminal. As described above, the storage medium 61 refers to a space for storing data, such as a hard disk, and the area file is generated as one file.

Specifically, a file is created by using CreateFile (), which is one of the application programming interfaces (APIs) of the Windows operating system. It uses DeviceIOControl to communicate with a separate driver to create raw data with the same header structure as NTFS.

In addition, the area file generation unit 31 hides the area file on the folder of the computer terminal. The hard disk of the computer terminal is recognized as a drive, has a hierarchical directory structure, and is displayed in a hierarchical folder form. At this time, the operating system of the computer terminal has a function of hiding folders or files. The zone file generation unit 31 hides the zone file using the file hiding function of the operating system.

The area mounting unit 32 mounts or unmounts the area file as a drive of the computer terminal. As described above, when a region file is mounted as a drive, the storage space of the region file may be used as one virtual file system. Therefore, a directory structure such as a folder can be created in the zone file, and user files can be stored in the created folder. In this way, the file system in the zone file becomes a secure zone.

When the area mounting unit 32 mounts a zone file, a user file may be stored or opened in a file system (or secure zone) configured in the zone file, and when the zone file is unmounted, the user may be placed in the secure zone. You cannot save / open files. In other words, simply unmounting the zone file can prevent the security zone from being exposed to the outside.

For example, a Linux folder is made up of files and you can mount this file to another area using Symbolic Link. Using this concept, you create the same file as the Windows NTFS structure and mount it directly using IoCreateSymbolicLink. This causes Windows to recognize it as if another disk exists.

It also uses the Windows API ZwCreateFile to release the attached disk using the IoDeleteSymbolicLink API with a handle to the recognized volume.

Meanwhile, the area mounting unit 32 hides the drive after mounting the area file as a drive. When you mount a zone file, anyone within the zone file can access it. Therefore, to prevent this, hide the mounted region file.

Specifically, hide the mounted disk by setting the following entry in the registry of the Windows operating system.

[HLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]

When the mounted area is released, the registry item is released to restore the disk to its original state.

The area encryptor 33 encrypts and stores the area file or decrypts the stored area file.

By adding the encryption function, even if the general user opens the source file, the structure cannot be understood. The file created in this step is encrypted using the AES encryption algorithm.

The secure file storage unit 34 stores a user file in an area of the mounted drive (hereinafter referred to as a secure area) or opens a user file from the secure area.

Preferably, the secure file storage unit 34 encrypts and stores the user file. Specifically, after encrypting using the AES encryption algorithm, the encrypted file is stored in the secure area using the SaveFile () Windows API. After reading the stored file (user file), the user file is decrypted and provided.

When the security file processing unit 35 receives a processing command for a user file, the security file processing unit 35 decrypts and mounts the area file, performs a processing command for the user file in the secure area, and when the command is completed, frees the area file. Mount and encrypt

After receiving the open command for the user file, the secure file processor 35 does not unmount the area file until the save command is received. This is because the user file must be accessed continuously in the security zone while the user file is opened and used.

The interface unit 36 provides a hierarchical folder interface of a directory structure for the user file and receives a processing command for the user file. In particular, the interface unit 36 instructs the security file processing unit 35 to query the directory structure before receiving the processing command for the user file, and displays the inquired directory structure as a hierarchical folder.

The interface unit 36 has a normal file management function for the secure area. In other words, it has the same function as the file explorer of the Windows operating system. That is, the processing command for the user file includes file list inquiry, opening / modifying / deleting / moving the user file, and the like. The interface unit 36 receives such a command and executes the processing command by the secure file processing unit 35 or the like.

Meanwhile, as shown in FIG. 4, the interface unit 36 provides an interface screen for managing a user file to the user. In FIG. 4, the left screen shows the folder structure hierarchically, and the right screen shows detailed information about the stored files.

First, the interface unit 36 may query a file list of a security area. When copying or moving a file to the security area, the file information is entered into the local DB (own storage space that is directly used only in the file security system) and is searched using a dedicated explorer. Since the routine of saving and deleting in the security area is done in the internal area, it can be managed in the local DB without monitoring the copy and deletion in real time.

Next, you can open or modify the file in the secure area. When the user tries to open the data (or user file) stored in the secure area, the interface unit 36 reads the file information to be executed and modified from the local DB in the secure area, and the window recognizes the secure area. Mount it so you can.

In addition, the interface unit 36 processes the open command for the user file, executes a program matching the extension of the user file, and opens the user file with the program. In other words, user files can be executed and modified. In this case, when the user file is an MS-OFFICE document or a Korean document, the corresponding software is preferably installed. In case the corresponding software is not installed, a dedicated viewer may be installed.

Next, delete the user file from the security zone. This is done in the same way as storing user pie in the secure area. After confirming that the file saved in the security area is completely deleted, delete the information from the local DB and notify the user.

In addition, the interface unit 36 receives and stores authentication information of a user in advance, and only an authenticated user performs a processing command of the user file.

As shown in FIG. 5, the user ID and password are used as authentication information to allow only the authenticated user to access the security area, or retrieve information about the security area. In FIG. 5, when there is no application program to open the opened file document, the dedicated viewer opens and displays the file document.

In addition, the file security system 30 according to an embodiment of the present invention, in addition to the basic file management function as described above, the monitoring unit 37, the index unit 38, etc. for the continuous monitoring function and user file search as an agent. Configure additionally.

The monitoring unit 37 monitors the user file in real time and moves to the security area when a user file is generated or modified.

In addition, the index unit 38 generates a hash value by obtaining information about a user file stored in a storage medium or a secure area of the computer terminal. This allows for faster and more accurate retrieval of stored user files. Preferably, the contents of the document of the user file are analyzed and hashed. Therefore, you can also search by the contents of user files.

The invention made by the present inventors has been described concretely with reference to the embodiments. However, it is needless to say that the present invention is not limited to the embodiments, and that various changes can be made without departing from the gist of the present invention.

10: computer terminal 11: storage medium
20: network 40: database
30: file security system 31: zone file generation unit
32: area mounting unit 33: area encryption unit
34: secure file storage unit 35: secure file processing unit
36 interface unit 37 monitoring unit
38: index portion
50: operating system 51: system processing module
52: disk drive 60: hardware
61: Hard Disk 62: Zone Files
70: application

Claims (8)

In the drive-based file security system installed in the computer terminal, and stores the user file,
An area file generator for generating a file (hereinafter, referred to as an area file) on a storage medium of the computer terminal;
An area mounting unit which mounts or unmounts the area file as a drive of the computer terminal;
An area encryption unit encrypting and storing the area file or decrypting the stored area file;
A security file storage unit for storing a user file in an area of the mounted drive (hereinafter referred to as a security area) or opening a user file from the security area; And
Receiving a processing command for a user file, decrypts and mounts the area file, performs a processing command for the user file in the secure area, and when the command is completed, the secure file processing unit for unmounting and encrypting the area file Drive-based file security system comprising a.
The system of claim 1,
And providing an hierarchical folder interface having a directory structure for the user file and receiving a processing command for the user file.
3. The method of claim 2,
The interface unit instructs the secure file processing unit to query the directory structure before receiving the processing command for the user file, and displays the inquired directory structure as a hierarchical folder.
The method of claim 1,
And the secure file processing unit does not unmount the area file until the save command is received after receiving the open command for the user file.
The method of claim 1,
The interface unit processes the open command for the user file, executes a program matching the extension of the user file, and drives the user-based file security system, characterized in that for opening the user file to the program.
The method of claim 1,
The interface unit receives and stores the authentication information of the user in advance, and the drive-based file security system, characterized in that only the authenticated user performs a user file processing command.
The method of claim 1,
The area file generation unit hides the area file on a folder of the computer terminal.
The method of claim 1,
And the area mounting unit hides the drive after mounting the area file as a drive.

Images