Patent ID: 12204664

DETAILED DESCRIPTION OF THE INVENTION

“One embodiment” or “an embodiment” is described with reference to details to be discussed below in various cases, and the accompanying drawings illustrate various embodiments. The following description and the accompanying drawings should be construed as being illustrative and should not be construed as being limitative. Numerous specific details are set forth in order to provide a thorough understanding of various embodiments of the invention. However, in specific embodiments, well-known or conventional details are not described in order to provide concise descriptions of embodiments of the present invention.

Reference to “one embodiment” or “an embodiment” herein means that a particular feature, structure, or characteristic described in conjunction with the embodiment may be included in at least one embodiment. The appearances of the phrase “in one embodiment” at various locations in the specification are not necessarily all referring to the same embodiment.

The embodiments of the present invention may include a special-purpose or general-purpose computer including various types of computer hardware, as will be described in greater detail below.FIG.1depicts a schematic diagram of an exemplary computing system that may be used to implement the features of the present invention, which is referred to as a “client.” The described client is merely one example of such a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the present invention. The present invention should not be construed as having any dependency or requirement with respect to any one or any combination of components shown inFIG.1.

The terms to be used to describe a “hidden information-based security system for electronic documents” according to the present invention will be defined first. The “hidden information-based security system for electronic documents” according to the present invention refers to software or a device that restricts the content reading, number of readings, editing, decryption, exporting, printing, print marking, expiration date, automatic destruction, authority change, content duplication, etc. of electronic documents according to the user, the executing PC, and/or the like. The “hidden information-based security system for electronic documents” is installed on a client, and operates in conjunction with software that executes electronic documents. Hereinafter, the “hidden information-based security system for electronic documents” is referred to as the “security system.”

An “electronic document” according to the present invention is standardized as data in the form of a document that is created, and transmitted and received, or stored in an electronic form by a device having information processing capability, such as a computer. The data may include content such as text, images, and graphs. As for the supported extensions of electronic document-related software for execution on a computer, versions such as doc, tin, ppt, dock, xlsx, and pptx supported by MS Office and versions such as HWP and PDF may be listed as examples. In addition, various other extensions may be listed as examples. Furthermore, a “word processor unit” refers to office software that can read, edit, or create electronic documents. A “security agent” according to the present invention refers to software that generates and inputs hidden information in an electronic document, searches for and checks the hidden information configured in the electronic document, and reads the security level and log information of the electronic document. In addition, “authority information” refers to the authority granted to a user or an executing PC in connection with the content reading, number of readings, editing, decryption, exporting, printing, print marking, expiration date, automatic destruction, authority change, content duplication, etc. of electronic documents. Accordingly, the range of use for electronic documents varies depending on who a user is and what an executing PC is.

A hidden information-based security system for electronic documents according to the present invention will be described below.

The hidden information-based security system for electronic documents according to the present invention includes: a hidden information module configured to search for custom.xml having fmtID (a format identifier) as the identification value thereof by analyzing the source code of electronic document data executed by an operating system (OS)-based word processor unit, and to check for authority information and log information configured in custom.xml; an information identification module configured to ascertain an execution history of an electronic document from the log information identified by the hidden information module, and to output the execution history; a content execution module configured to control the content execution of the electronic document by the word processor unit according to the control of a security module; and the security module configured to generate custom.xml, containing authority information for the security of an electronic document and log information about an execution history of the electronic document, in the source code of the corresponding electronic document by a steganographic technique and designate a security agent-dedicated fmtID, and to compare the authority information identified by the hidden information module and the execution history identified by the information identification module with reference information and restrict the allowable range of content. In this case, the security module may be configured to generate authorization information corresponding to an input command value.

A security system according to an embodiment of the present invention will be described below in greater detail with reference to the accompanying drawings.

FIG.1is a block diagram illustrating a hidden information-based security system for electronic documents according to an embodiment of the present invention.

Referring toFIG.1, the security system according to the embodiment of the present invention includes a security agent30, including: a hidden information module31configured to search for custom.xml having fmtID (a format identifier) as the identification value thereof by analyzing the source code of electronic document data executed by an OS 10-based word processor unit40, and to check for authority information and log information configured in custom.xml; an information identification module32configured to ascertain an execution history of an electronic document from the log information identified by the hidden information module31, and to output the execution history; a content execution module33configured to control the content execution of the electronic document by the word processor unit40according to a control of the security module34; and the security module34configured to generate custom.xml, containing authority information for the security of an electronic document and log information about an execution history of the electronic document, at a specific location of the source code of the corresponding electronic document by a steganographic technique and designate a security agent30-dedicated fmtID, and to compare the authority information identified by the hidden information module31and the execution history identified by the information identification module32with reference information and restrict the allowable range of content.

The hidden information module31searches for custom.xml having fmtID as the identification value thereof by analyzing the source code of the electronic document data executed by the OS-based word processor unit40, and checks for authorization information and log information configured in custom.xml. As described above, since the security module34generates hidden information, containing authority information and log information, in an electronic document, the hidden information module31checks for hidden information in a custom.xml format by searching for fmtID generated as the identification value of the hidden information. Since the hidden information according to the present invention is generated via a steganographic technique, the word processor unit40cannot recognize the hidden information in a custom.xml format, and only the hidden information module31can recognize fmtID by checking for it. Meanwhile, the log information is updated during a storage process through the data duplication and name change of the electronic document. The history configured in the log information may be information such as the opening time, closing time, storage time, and storage location of the electronic document, and the ID of a current version and the ID of a previous version generated during a storage process.

The information identification module32ascertains an execution history of the electronic document from the log information identified by the hidden information module31. In greater detail, as described as an example above, the history of log information configured in the hidden information may include the opening time, closing time, storage time, and storage location of the electronic document, and the ID of a current version and the ID of a previous version generated during a storage process. The information identification module32may determine the execution history and distribution path of the electronic document by ascertaining the history.

The content execution module33controls the content execution of the electronic document by the word processor unit40under the control of the security module34. In greater detail, since the hidden information includes authority information for the electronic document, the range of execution of the electronic document needs to be restricted in the electronic document according to the authority information. Accordingly, when the security module34ascertains the authority information and designates the allowable range, the content execution module33forcibly restricts the execution of the electronic document to the allowable range while operating in conjunction with the word processor unit40. In other words, when the allowable range of the electronic document is restricted only to the reading of content, the content execution module33forcibly stops an attempt to edit the electronic document in case of the attempt to edit the electronic document while checking for the access of the word processor unit40to the electronic document.

The security module34generates hidden information, which cannot be recognized by the word processor unit40, in the electronic document so that only the security agent30can recognize it. For this purpose, the hidden information is generated and inserted at a specific location in the source code of the electronic document by a steganographic technique. The hidden information is configured in an electronic document in a custom.xml format, and fmtID (a format identifier) is set as the identification value of custom.xml. custom.xml contains authority information and log information for the corresponding electronic document, and the hidden information module31may be located independently at a specific location in the source code of the electronic document. As a result, the hidden information is configured in the electronic document as data that cannot be recognized or is ignored by the word processor unit40, such as the steganographic data, and only the hidden information module31may check the hidden information and also read the authority information and the log information by recognizing the designated fmtID. In addition, since the hidden information configured in the electronic document is an object independent of the electronic document, the hidden information may maintain the form thereof even when the content or attributes of the electronic document are changed or the extension of the electronic document is changed, and the hidden information module31may identify the authority information and the log information through searching. For reference, a steganographic technique is one of the data concealment techniques, and refers to a technique for inserting data into other data or research thereinto. Additionally, a cryptographic technique is a means of making the content of a message unreadable, whereas a steganographic technique hides the presence of a message itself.

Thereafter, the security module34compares the authority information identified by the hidden information module31and the execution history identified by the information identification module32with the reference information, and restricts the allowable range of the content. As described above, the authority information relates to the allowable range for the execution of the corresponding electronic document. Accordingly, the allowable range is identified from the authority information configured in the hidden information, and a restriction is imposed through the content execution module33so that the word processor unit40executes the corresponding electronic document only for allowed execution items.

A technique for comparing authority information and an execution history with reference information will be described again below.

Meanwhile, a client C1in which the security agent30is installed may access a communication network using a web browser20and perform data communication with another client C2. When an electronic document for which security is set is received by the web browser20during the data communication, the security agent30searches for hidden information in the corresponding electronic document, and checks for and updates log information from the found hidden information. As described above, since the log information may include the storage time and version of the electronic document, the security module34reinforces the log information with the storage time and version of the corresponding electronic document when the corresponding electronic document is received and stored.

Furthermore, the security agent30according to the present invention further includes an encryption/decryption module35configured to encrypt/decrypt overall electronic document data or content under the control of the security module34, and the security module34controls the encryption/decryption module35while operating in conjunction with the word processor unit40. More specifically, in order to enhance the security of the electronic document, the security agent30may encrypt the data of the electronic document whose execution is terminated and store it in the client C1. To this end, when recognizing the process of terminating the electronic document in the word processor unit40, the security module34performs control so that the encryption/decryption module35encrypts the electronic document data stored by the word processor unit40. The encryption/decryption module35may generate and locate a temporary file whose name and extension match the name and extension of the corresponding electronic document data in the storage path of the encrypted electronic document data so that the word processor unit40can recognize and load the encrypted electronic document data, and the actual electronic document data containing content may be stored in the form of an encrypted file. However, the encryption procedure is only an embodiment of the present invention, and the storage process of the word processor unit40is performed in conjunction with the security module34so that the security module34can encrypt the electronic document data.

Thereafter, when the user attempts to execute the encrypted electronic document data through the word processor unit40, the security module34recognizes the execution process of the word processor unit40and performs control so that the encryption/decryption module35decrypts the encrypted electronic document data. It will be apparent that the encryption/decryption module35decrypts designated data under the control of the security module34, and when recognizing the decryption, the security module34allows the corresponding electronic document data to be executed by the word processor unit40.

FIG.2is a flowchart sequentially showing the process of performing the security processing of electronic document data based on a security system, authenticating a user, and outputting the content of the electronic document data according to an embodiment of the present invention, andFIG.3is an image view showing an embodiment of the hidden information of electronic document data whose security processing has been performed.

Referring toFIGS.1to3, a security system-based security method according to the present invention will be described as follows:

S10: Hidden Information Setting Step

When the word processor unit40generates and stores the data file of an electronic document, the security module34of the security agent30allows an author having authored the electronic document or a right holder having the right of the electronic document (hereinafter referred to as a “setter”) to set the authority information of the electronic document. To this end, the security agent30generates a security setting menu key (not shown) in the menu of the word processor unit40in the form of a GUI (Graphical User Interface) or a general UI. When the setter clicks the security setting menu key, the security module34of the security agent30is executed and outputs a setting layer (not shown) in which an allowable execution range can be input.

The setter inputs an allowable execution range in the output setting layer, and the security module34generates authority information for the allowable execution range as hidden information according to an input command value. The hidden information is generated in a custom.xml format according to a steganographic technique, and the security module34is disposed at a specific location in the source code of the electronic document. In addition, in custom.xml, which is hidden information, fmtID that can be recognized by the hidden information module31is designated as an identification value.

The security module34may further include log information, containing information about the execution history of the electronic document, in the hidden information. The history configured in the log information may be information including the opening time, closing time, storage time, and storage location of the electronic document, and the ID of a current version and ID of a previous version newly generated during a storage process.

S20: Hidden Information Search Step

When the word processor unit40attempts to execute a specific electronic document in response to an operation of a user, the hidden information module31of the security agent30searches for the hidden information in the corresponding electronic document and checks the authority information and the log information.

When the hidden information module31identifies the authority information, it invokes the security module34. In contrast, when the log information is identified, the information identification module32is invoked.

S30: Electronic Document Execution History Ascertainment Step

In response to the invocation of the hidden information module31, the information identification module32identifies the log information of the hidden information and ascertains the execution history of the electronic document. As described above, the execution history may be information including the opening time, closing time, storage time, and storage location of the electronic document, and the ID of a current version and ID of a previous version newly generated during a storage process. The information identification module32may determine the execution history and distribution path of the electronic document through the history.

For reference, the execution history of the electronic document identified by the information identification module32may be output through a separate setting window (not shown), and the distribution path of the corresponding electronic document may be tracked through this process.

S40: Electronic Document Execution Determination Step

The security module34compares the authority information for the security of the electronic document and the execution history of the log information with the reference information, and restricts the allowable range of the content. More specifically, the authority information is input in the form of a security level code as the allowable range for the execution of the electronic document. In other words, when the setter sets only content reading for the electronic document as the allowable range upon security setting for the electronic document, only a security level code for content reading is set in the authority information. Meanwhile, the security module34stores an allowable range for each security level code as the reference information. Accordingly, the security module34checks the security level code set in the authority information, and identifies the allowable range set for the electronic document by searching for the allowable range of the corresponding security level code from the reference information. Thereafter, when the allowable range is identified, the security module34transmits related data to the content execution module33.

In addition, the log information relates to the execution history of the electronic document. The execution history of the electronic document is compared with the reference information in which the paths of harmful URLs and harmful users have been registered, and the execution of the corresponding electronic document is restricted when the electronic document in the execution history of the electronic document has passed through a path of the reference information.

S50: Electronic Document Execution Step

The word processor unit40executes the corresponding electronic document in response to an operation of the user, and the content execution module33controlled by the security module34controls the execution of the corresponding electronic document while operating in conjunction with the word processor unit40. In other words, when the allowable range of the electronic document is restricted to content reading due to the authority information, the content execution module33having received a signal regarding content reading from the security module34restricts the execution of a process so that the word processor unit40does not perform any function other than the content reading of the user for the electronic document.

Furthermore, when the security module34ascertains the execution history of the electronic document from the log information and finds a path, identical to a harmful path registered in the reference information, in the execution history, the content execution module33having received an execution restriction signal from the security module34transmits a stop signal so that the word processor unit40does not execute the electronic document.

S60: Electronic Document Storage Step

When recognizing the process of terminating the electronic document in the word processor unit40, the security module34updates one or more selected between the authorization information and the log information configured in the hidden information, and stores them in the storage means of the corresponding client C1.

The above-described present invention provides an effect in that a security level and log-related information can be maintained even when the data of an electronic document is modified and a security process based on policies can be continued. Furthermore, the above-described present invention provides an effect in that since the hidden information of an electronic document is maintained even when the format of a data file is changed, authority information and log information for the electronic document can be continuously identified and then used for security.

As described above, although the security system according to the present invention has been described and illustrated in greater detail, it should be understood that the description and illustration are intended for convenience of description and understanding of the security system according to the present invention. The rights of the present invention should not be restrictively construed as being limited to the configurations and data storage locations of the above-described embodiments, nor should it be interpreted as being limited by using other documents against the description of the present invention. The scope of rights of the security system according to the present invention should be determined based on the attached claims.