KR101844534B1 - Method for securing electronic file - Google Patents

Abstract

A security application method for an electronic file is disclosed. A security application method for an electronic file performed in a digital device includes: detecting that an arbitrary electronic file is generated and stored in a general area of the storage area; And designating the electronic file as a protection designation file by moving and saving the electronic file to the protection area of the storage area when the generated electronic file is required for protection designation processing and generating a link file corresponding to the protection designation file, .

Description

Method for securing electronic file}

The present invention relates to a security application method for an electronic file.

Recently, since the storage space of a personal computer apparatus has been increased in capacity and the processing speed has been remarkably improved, a variety of public business data such as technical data, design drawings, and sales data are stored and managed in addition to personal data.

Among the data stored in the computer device, there is data that a third party other than the person in charge should be strictly prohibited from reading or data leakage to the outside.

However, in the conventional file security method, only a file or a folder is set to be hidden so as to confirm whether a third party does not recognize the existence of the file or the folder, or a requestor who has the right to browse when a file requiring security is requested And the like.

However, the existence of malicious code that causes important data stored in the present computer device to leak to the outside has already been confirmed, and various attempts have been made to leak important data by hacking the computer device.

Under such security threat situations, conventional file security methods are not sufficient security measures for important data.

Korean Patent Publication No. 10-2002-0060517 (document file security method using process ID and storage space ID) Korean Registered Patent No. 10-0437225 (Digital Signature Authentication based File System Security Device and Method)

The present invention is intended to provide a security application method for an electronic file, which permits access to a protection designation file only when the protection designation file is a valid access attempt in advance, thereby enabling thorough protection of the protection designation file.

The present invention is to provide a security application method for an electronic file which does not incur inconvenience when a user uses an electronic file because it does not require a password input or an additional authentication confirmation in the case of a valid access attempt to a protection designation file.

This file is moved to the protection zone. Only the link file that mediates access to the stored protection specification file is exposed, and the security state of the protection specification file can be maintained even though the link file is leaked. .

Other objects of the present invention will become readily apparent from the following description.

According to an aspect of the present invention, there is provided a security application method for an electronic file performed in a digital device, comprising: detecting that an arbitrary electronic file is generated and stored in a general area of a storage area; And designating the electronic file as a protection designation file by moving and saving the electronic file to the protection area of the storage area when the generated electronic file is required for protection designation processing and generating a link file corresponding to the protection designation file, The protection designation file stored in the protection area in which arbitrary access by the user or the program is not permitted is an electronic file that is allowed access through the link file only after passing the predefined validity check A security application method for an electronic file is provided.

The link file having information for specifying one protection designation file stored in the protection area may be an electronic file that is generated to have the same extension as the electronic file but is not driven by the connection program corresponding to the extension.

The security application method for an electronic file includes: registering one or more selected programs as an authentication program; Determining whether an executed program attempting to drive corresponds to the authentication program if an attempt to drive the arbitrary link file is detected; And permitting the executed program to access the protection designation file corresponding to the link file and to drive the protection designation file by replacing the link file only when it corresponds to the authentication program.

When the operation of the protection designation file is terminated or the execution program which drives the protection designation file is terminated, the access right to the protection designation file may be set to be terminated.

The authentication program may be selected from a connection program corresponding to an extension of the electronic file.

The security application method for an electronic file includes registering one or more selected programs as an authentication program and registering one or more source devices as an authentication source; Determining whether a running program attempted to run corresponds to the authentication program and the source device corresponds to an authentication source if a drive attempt for an arbitrary link file is detected; And allowing the executed program to access the protection designation file corresponding to the link file and to drive the protection designation file only when the program and the authentication source correspond to the authentication program and the authentication source.

The protection area may be allocated to one of a storage area of the digital device and a storage area including a cloud storage area.

Other aspects, features, and advantages will become apparent from the following drawings, claims, and detailed description of the invention.

According to the embodiment of the present invention, access to the protection designation file is allowed only in the case of a valid access attempt to the protection designation file in advance, so that the protection designation file can be thoroughly protected.

In addition, in the case of a valid access attempt to the protection designation file, there is an effect that it is not inconvenient to use the electronic file because the user does not require a password input or an additional authentication confirmation.

In addition, only the link file that mediates the access to the protection designation file moved to the protection area is exposed, and the security state of the protection designation file is maintained even if the link file is leaked.

1 is a view for explaining a concept of a security application method for an electronic file according to an embodiment of the present invention;
2 is a diagram illustrating a link file generation process and an original file transfer process according to an embodiment of the present invention.
3 is a flowchart illustrating a security applying method for an electronic file according to an embodiment of the present invention;
4 is a diagram illustrating a connection relationship between a digital device and a source device according to another embodiment of the present invention.
5 is a flowchart illustrating a security applying method for an electronic file according to another embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Also, the terms "part," "unit," "module," "unit," and the like described in the specification mean units for processing at least one function or operation, Or a combination of hardware and software.

It is to be understood that the components of the embodiments described with reference to the drawings are not limited to the embodiments and may be embodied in other embodiments without departing from the spirit of the invention. It is to be understood that although the description is omitted, multiple embodiments may be implemented again in one integrated embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

FIG. 1 is a view for explaining the concept of a security application method for an electronic file according to an embodiment of the present invention. FIG. 2 is a diagram illustrating a link file generation process and an original file transfer process according to an embodiment of the present invention FIG. 3 is a flowchart illustrating a security applying method for an electronic file according to an embodiment of the present invention.

Referring to FIG. 1, the digital device 100 is provided with a storage unit, in which not only a plurality of programs to be executed but also electronic files that can be driven by any program are stored. Here, the digital device 100 is an electronic device having a storage unit such as a personal computer, a smart phone, and a tablet PC, and capable of installing and executing various programs.

Programs installed and executed in the digital device 100 may be classified into a foreground program executed by a user directly driving the program and a background program executed without interference from a user and performing a designated function have.

For example, an MS word, an Excel, a power point, and the like denoted by reference numeral 110 in FIG. 1 may correspond to a foreground program executed by a user's driving operation. In contrast, the security program 120 can be set as a background program to be executed without interference from the user. However, when there is a need for security setting for a specific file, the user can operate the security program 120 like a foreground program . ≪ / RTI >

The digital device 100 is provided with a storage unit for storing various electronic files. The storage unit may be divided into the general area 130 and the protection area 140 by the security program 120 and the size of the protection area 140 may be predetermined And its size may be adjusted by the user.

The general area 130 is an area in which arbitrary access by a user or a program is allowed. The user can operate the electronic file stored in the general area 130 to freely perform work such as correction.

On the other hand, the protection area 140 is a storage area in which arbitrary access by a user or a program is not permitted and is limitedly accessed only by permission of the security program 120. [ The protection area 140 is a storage area that is logically or physically separated from the general area 130. The security program 120 may set the protection area 140 to be recognized as an independent drive, and can be set to an unexposed region that is hidden from the outside and hidden from the outside. The method of configuring one area of the storage area that the digital device 100 can use as the protection area 140 may be variously different.

1 illustrates a case where the protection area 140 is designated as one area of the storage unit of the digital device 100. However, the protection area 140 may be provided in an external device connected to the digital device 100 through a communication network It can also be designated as one area of the repository (for example, cloud storage). Of course, the protection area 140 may be formed in a cloud storage connected to one area of the storage unit provided in the digital device 100 through a communication network.

1, a program installed in the digital device 100 can drive an electronic file stored in the general area 130 without limitation, but in the case of a protection designation file stored in the protection area 140, And has a limitation that it can be driven only by the security processing only when the program 120 is recognized as valid access.

Hereinafter, a security applying method for an electronic file will be described with reference to related drawings.

FIG. 2 shows a process in which an arbitrary electronic file is designated as a protection designation file and protected.

2, a file directory, which is a table of files managed by the digital device 100, may be displayed on the execution screen 210 displayed by execution of the security program 120 2 (a)).

The electronic files corresponding to the respective file names in the illustrated PROJECT folder are assumed to be stored in the general area 130. [ Thus, each of the illustrated electronic files may be identified in a user interface (e.g., a file explorer program, etc.) for file system access.

At this time, each of the electronic files may be set to have a relation between a specific program and a connection program (for example, a power point program in the case of a ppt extension) according to an extension of the electronic file.

When the user selects an arbitrary file name (for example, Briefing.ppt) on the displayed file directory and designates it as a protection target (see FIG. 2B), the security program 120 displays the general area (For example, Briefing.lnk) corresponding to the corresponding electronic file is generated in the general area 130 (FIG. 2 (c)), and the electronic file stored in the general area 130 is moved to the protection area 140, Reference).

The link file includes information set so that the security program 120 can match an electronic file (i.e., a protection designation file) that is moved to the protection area 140. That is, the link file includes redirection information for allowing the security program 120 to replace the link file with the protection designation file stored in the protection area 140 for the electronic file drive attempt of the program, It can be created with a small file size. Therefore, even if a link file is additionally generated for the security application of the electronic file, there is a characteristic that the loss of the storage area is not large.

The security program 120 processes the program so that the program can be connected to the protection designation file stored in the protection area 140 and driven only when the access attempt of the program that tries to drive the link file is valid.

As illustrated in FIG. 2 (c), the link file may be generated so as to have the same file name as Briefing.ppt and Briefing.lnk but differ only in the extension.

In addition, in order to allow the file name of the link file to be normally displayed in the file open menu in the connection program (for example, the power point program), the security program 120 maintains the file name and extension as the same (for example, Briefing.ppt ), But it can be modified to have the information for matching the protection designation file stored in the protection area 140.

Here, although the link file has an extension related to the connection program, the connection program does not drive the link file itself because the security program 120 has suspended the execution of the connection program as will be described later.

That is, when the security program 120 operating as a background program detects an attempt to drive a link file by an arbitrary connection program, the security program 120, in a state of suspending the operation of the link file by the connection program, If the access attempt is a valid access attempt, the connection program accesses the protection specification file matched with the link file and performs a redirect process to drive the protection specification file (refer to FIG. 1).

In this way, although the protection designation file, which is an electronic file, is moved and stored in the protection area 140, the general area 130 includes a link file having the same file name and extension. Therefore, even when an unauthorized third party trusts a file name displayed on the screen and copies or leaves the file unauthorized, only the link file is leaked out, and the electronic file security for the protection specification file can be normally maintained.

Although the security application method for the electronic file described above may be performed on an arbitrary electronic file selected by the user, it may be a basic function to be applied to all the electronic files generated by the digital device 100, Do.

In this case, the designation procedure as shown in FIG. 2B will be omitted. If a new file is newly created as shown in FIG. 2A, it is automatically designated as a protection designation file, Designation processing will be performed. Also, all protected files will be requested to be driven using the link file, and it will be determined whether or not the security program 120 is a valid access attempt.

Hereinafter, a security application method for an electronic file will be described in detail with reference to FIG.

In step 310, the security program 120 registers one or more programs (e.g., MS word, etc.) designated by the user as an authentication program. For example, the security program 120 can recognize the authentication programs by maintaining the identification information of each of the authentication programs (e.g., the signature of the program, the PID, etc.).

In registering one or more programs with the authentication program, one or more programs may be selected and registered regardless of the extension, but it is natural that the corresponding programs may be designated to have the relationship of the connected programs by extension.

In step 320, the security program 120 determines whether a drive attempt for any link file is detected while operating as a background program. The security program 120 can recognize whether the electronic file that is attempted to be driven is a link file, for example, in advance, such as managing information on the link file.

If an attempt to drive the link file is detected, the security program 120 suspends the operation of the execution program (e.g., a connection program) attempting to run the link file and stores the identification information of the program (for example, Signature, PID, etc.).

Here, the method of suspending the operation of the execution program by the security program 120 may be implemented, for example, in a manner similar to a method in which a drive of a specific electronic file is driven after a virus check for a corresponding file. Further, the identification information of the execution program may be confirmed through, for example, a process that is executed when the execution program is executed.

In step 340, the security program 120 refers to the identification information of the execution program to determine whether it corresponds to an authentication program registered in advance.

If the executable program corresponds to the authenticated program, the security program 120 performs redirect processing to allow access of the executable program to the protection specification file corresponding to the link file to be driven in step 350. [ Thereby, the execution program will drive the protection designation file stored in the protection area and display it on the display screen.

The user can perform operations such as modification and addition to the protection designation file driven by the execution program and the protection designation file stored in the protection area 140 by the user's save command can be updated and stored. Thereafter, when the user terminates the execution program or terminates the protection specification file, the access to the protection specification file is terminated and the access authority also expires. Therefore, when the operation of the protection specification file is required, the access to the protection specification file can be resumed only when the above-described process is performed again.

However, if the executable program does not correspond to the authentication program, the security program 120 causes the access denial message to be output on the display screen in step 360.

As described above, the security program 120 permits the operation of the protection designation file in the case of a file access attempt by the previously registered authentication program, but if not, the file access is denied and the file security processing can be performed .

Generally, malicious codes or hacking programs, which are secretly installed in the digital device 100 in order to illegally leak an electronic file such as a public certificate, will not be registered as an authentication program by the user. Therefore, file activation by the illegal programs described above with respect to the protection specification file will be blocked by the security program 120. [

In addition, since the electronic files to which the illegal programs are to be leaked are generally electronic files for which protection is required, only the link file exists in the general area 130 when designating the protection designation file. in this case. Even if the link file is leaked to the outside, it is not worth using because it is not the protection designation file itself, and the link file can be used only by the security program 120 and can not be used for illegal purposes.

FIG. 4 is a diagram illustrating a connection relationship between a digital device and a source device according to another embodiment of the present invention, and FIG. 5 is a flowchart illustrating a security applying method for an electronic file according to another embodiment of the present invention.

4, in order for the digital device 100 to operate, it is necessary to receive a user's driving command through an input device such as a keyboard and / or a mouse, or to receive a driving command of a user via another communication And is operated by receiving a drive command from the device.

That is, the security program 120 may be installed in the digital device 100 operated by receiving the drive command from the input device or the source device 410, which is another communication device, It may be implemented not only as to whether or not the source device 410 is authenticated as a source device, but also to perform file security processing.

5, the security program 120 registers one or more programs (e.g., MS Word or the like) designated by the user as an authentication program and also registers one or more source devices 410 as an authentication source .

For example, the security program 120 can recognize the authentication programs by maintaining the identification information of each of the authentication programs (e.g., the signature of the program, the PID, etc.). The security program 120 may further include identification information (e.g., device information) and / or identification information (e.g., device information, connection IP address information, etc.) of an input device connected to the digital device 100, The authentication source can be recognized by maintaining the identification information of the source device 410. [

In registering one or more programs with the authentication program, one or more programs may be selected and registered regardless of the extension, but it is natural that the corresponding programs may be designated to have the relationship of the connected programs by extension.

Likewise, the extension of an electronic file that can be accessed may be specified to be restricted per authentication source (for example, the doc extension can be read only by keyboard operation, etc.).

In step 520, the security program 120 determines whether a drive attempt for any link file is detected while operating as a background program.

If an attempt to drive the link file is detected, the security program 120 suspends the operation of the execution program (for example, the connection program) that tried to drive the link file, and stores the identification information of the program PID, etc.) of the source device 410 and the identification information of the source device 410 that provided the drive command so that the execution program attempts to drive the link file. A method of recognizing which source device is provided with a drive command for performing an arbitrary operation in the digital device 100 is obvious to those skilled in the art and thus a description thereof will be omitted.

In step 540, the security program 120 refers to the identification information of the execution program and the identification information of the source device 410 to determine whether they correspond to the authentication program and the authentication source registered in advance, respectively.

If the executable program corresponds to the authentication program and the source device 410 corresponds to the authentication source, then in step 550, the security program 120 determines whether access to the execution program for the protection specification file corresponding to the link file Is carried out. Thereby, the execution program will drive the protection designation file stored in the protection area and display it on the display screen.

However, if the executable program does not correspond to the authentication program or the source device 410 does not correspond to the authentication source, the security program 120 causes the access denied message to be output on the display screen in step 560. At this time, information about the access attempt may be stored, and the stored information may be utilized for security enhancement purposes such as firewall design, security policy establishment, and the like.

As described above, the security application method for the electronic file according to the embodiments of the present invention permits access to the protection designation file only in the case of a valid access attempt, thereby enabling thorough protection of the protection designation file, , It does not cause any inconvenience when the user uses the electronic file because it does not require a password input or an additional authentication confirmation and only the link file that mediates the access to the protection designation file stored in the protection area is exposed, The security state of the protection specification file is characterized by being able to be maintained continuously.

In addition, a security application method for an electronic file according to each embodiment of the present invention may be implemented by a software program or the like. The code and code segments that make up the program can be easily deduced by a computer programmer in the field. In addition, the program is stored in a computer readable medium, readable and executed by a computer, and the method is implemented.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the following claims And changes may be made without departing from the spirit and scope of the invention.

100: Digital device 110: Foreground program
120: security program 130: general area
140: Protection area 210: Execution screen
410: source device

Claims (8)

A security application method for an electronic file performed in a digital device,
Detecting that an arbitrary electronic file is generated and stored in the general area of the storage area; And
If the generated electronic file is requested to perform the protection designation process, the electronic file is moved to the protection area of the storage area and designated as a protection designation file, and a link file corresponding to the protection designation file is generated, The method comprising:
The protection designation file stored in the protection area in which arbitrary access by a user or a program is not permitted is an electronic file that is allowed access through the link file only after passing a predetermined validation check,
In order to allow access to the protection designation file via the link file only after passing the validity check,
Registering the selected one or more programs as an authentication program and registering one or more source devices as an authentication source;
Determining whether a running program attempted to run corresponds to the authentication program and the source device corresponds to an authentication source if a drive attempt for an arbitrary link file is detected; And
The step of allowing the executed program to access the protection designation file corresponding to the link file and to drive the protection designation file is executed only when it corresponds to the authentication program and the authentication source. How to apply security.
The method according to claim 1,
The link file having information for specifying any one protection designation file stored in the protection area is an electronic file generated so as to have the same extension as the electronic file but not driven by a connection program corresponding to the extension, How to apply security to electronic files.
delete The method according to claim 1,
Wherein the access right to the protection designation file is terminated when the operation of the protection designation file is terminated or when the execution program that drives the protection designation file is terminated.
The method according to claim 1,
Wherein the authentication program is selected from a connection program corresponding to an extension of the electronic file.
delete The method according to claim 1,
Wherein the protection area is allocated to one of a storage area of the digital device and a storage area of the cloud storage device.
A computer-readable recording medium on which a program for performing the method according to any one of claims 1, 2, 4, 5, and 7 is recorded.

Images