KR102412227B1 - Security management system and method, and server for executing the same - Google Patents

Abstract

A security management system and method and a server for performing the same are provided. The server according to an embodiment of the present invention defines one or more security policies according to an input of an administrator, creates a security profile from a combination of one or more security policies, and sets the security profile according to the input of the administrator. a profile manager for mapping to at least one of them; and a first interface for transmitting the information on the security profile to one or more terminals belonging to the mapped group.

Description

SECURITY MANAGEMENT SYSTEM AND METHOD, AND SERVER FOR EXECUTING THE SAME

Embodiments of the present invention relate to security management techniques.

Enterprise Mobility Management (EMM) is one of mobile security solutions for enterprises that include functions of existing Mobile Device Management (MDM) and Mobile Application Management (MAM). Recently, as the use of mobile terminals has become common, BYOD (Bring Your Own Device), which allows employees' personal terminals to be used for work, and COPE (Company, which allows specific terminals provided by the company to be used together for work and personal purposes) Mobile trends such as -issued, Personal Enabled) are spreading.

However, as the personal terminal is used for both work and personal purposes, concerns about the leakage of corporate secrets are also increasing. In addition, there is an increasing demand for a control function of hardware such as a wireless Internet (WiFi) module of a terminal, a camera, a microphone, a GPS module, and the like, and a control function of an enterprise application such as an email, a messenger, and an in-house system required for work.

Conventionally, there has been a hassle in that the administrator has to directly give a security policy to be applied to the terminal or manually replace the security policy applied to the terminal for controlling such hardware and applications. In particular, in the prior art, there is a problem in that the convenience of the administrator is inferior in that the administrator has to define each security policy every time he creates a security profile composed of a plurality of security policies.

Korean Patent Publication No. 10-1731312 (2017.04.24)

SUMMARY Embodiments of the present invention provide a means for efficiently generating a security profile from a combination of predefined security policies.

In addition, embodiments of the present invention are intended to provide a means for providing a customized security policy to a terminal through a group-by-group (or user-by-user) exception policy profile.

According to an exemplary embodiment of the present invention, one or more security policies are defined according to an input of an administrator, a security profile is created from a combination of one or more security policies, and the security profile is set according to the input of the administrator. a profile management unit for mapping to at least one of; and a first interface for transmitting information about the security profile to one or more terminals belonging to the mapped group, the server is provided.

Each defined security policy is stored in a modular form, and the profile manager receives one or more of the defined security policies from the administrator, and generates the security profile including the input one or more security policies. can

The profile management unit selects one or more of the groups according to the input of the administrator, and receives one or more security policies corresponding to the selected group and an application period of the security policy from the administrator to generate an exception policy profile, , the first interface may transmit information about the exception policy profile to one or more terminals belonging to the selected group.

and a second interface for receiving information about the group and the application period from a backbone system, wherein the profile manager generates the exception policy profile from information about the group and the application period input from the backbone system can

The profile manager may receive a priority regarding the plurality of security policies from the manager when there are a plurality of security policies included in the security profile or the exception policy profile.

According to another exemplary embodiment of the present invention, the above-described server; and a terminal that receives priorities regarding a plurality of security policies from the server and executes at least one of the plurality of security policies in consideration of the priorities of the security policies.

According to another exemplary embodiment of the present invention, in the profile manager of the server, defining one or more security policies according to an input of an administrator; generating, in the profile manager, a security profile from a combination of one or more security policies according to an input of the administrator; mapping, in the profile manager, the security profile to at least one of the set groups according to the input of the manager; and transmitting, in the first interface of the server, information about the security profile to one or more terminals belonging to the mapped group, a security management method is provided.

Each defined security policy is stored in a modular form, and the step of generating the security profile includes receiving one or more of the defined security policies from the administrator, and the security including the input one or more security policies. You can create a profile.

The security management method may include, after defining the security policy, selecting, in the profile manager, one or more of the groups according to an input of the administrator; generating an exception policy profile by receiving, in the profile manager, one or more security policies corresponding to the selected group and an application period of the security policy from the administrator; and transmitting, in the first interface, information on the exception policy profile to one or more terminals belonging to the selected group.

The security management method further includes, after the step of defining the security policy, receiving information about the group and the application period from a backbone system in the second interface of the server, and generating the exception policy profile In the doing, the exception policy profile may be generated from information about the group and the application period input from the backbone system.

In the security management method, after the step of defining the security policy, in the profile manager, when there are a plurality of security policies included in the security profile or the exception policy profile, a priority regarding the plurality of security policies from the administrator It may further include the step of receiving an input.

The security management method may include, after receiving the priority input, in the terminal, receiving priorities related to a plurality of security policies from the server; and executing, at the terminal, at least one of the plurality of security policies in consideration of the priority of the security policy.

According to embodiments of the present invention, by creating a security profile by combining one or more predefined security policies in a modular form, there is no need to redefine the security policy every time the security profile is created, and the predefined security policy Can be recycled.

In addition, according to embodiments of the present invention, by creating an exception policy profile that is preferentially applied to a specific group (or user) for a set period, a customized security policy for each group (or user) can be provided to the terminal .

1 is a block diagram showing a detailed configuration of a security management system according to an embodiment of the present invention;
2 is a block diagram showing a detailed configuration of a server according to an embodiment of the present invention;
3 is an example showing a process of defining a security policy in the profile manager according to an embodiment of the present invention;
4 is an example showing a process of defining a security policy in the profile manager according to an embodiment of the present invention;
5 is an example showing a process of defining a security policy in the profile manager according to an embodiment of the present invention;
6 is an example showing a process of creating a security profile in the profile manager according to an embodiment of the present invention;
7 is an example showing a process of mapping a security profile to a group in the profile manager according to an embodiment of the present invention;
8 is an example illustrating a process of generating an exception policy profile in the profile manager according to an embodiment of the present invention;
9 is an example showing a process of generating an exception policy profile in the profile manager according to an embodiment of the present invention;
10 is an example of application of an exception policy profile according to an embodiment of the present invention;
11 is a flowchart illustrating a process of generating a security profile according to an embodiment of the present invention;
12 is a flowchart illustrating a process of generating an exception policy profile according to the first embodiment of the present invention;
13 is a flowchart illustrating a process of generating an exception policy profile according to a second embodiment of the present invention;
14 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments;

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, devices, and/or systems described herein. However, this is merely an example, and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification. The terminology used in the detailed description is for the purpose of describing embodiments of the present invention only, and should in no way be limiting. Unless explicitly used otherwise, expressions in the singular include the meaning of the plural. In this description, expressions such as “comprising” or “comprising” are intended to indicate certain features, numbers, steps, acts, elements, some or a combination thereof, one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, acts, elements, or any part or combination thereof.

1 is a block diagram showing a detailed configuration of a security management system 100 according to an embodiment of the present invention. As shown in FIG. 1 , the security management system 100 according to an embodiment of the present invention includes a backbone system 102 , a server 104 , and a terminal 106 .

The legacy system 102 provides various information to the server 104 in conjunction with the server 104 . The backbone system 102 may be, for example, an access management system, an e-mail management system, an electronic payment system, or the like, but the type of the backbone system 102 is not particularly limited. The backbone system 102 may be connected to the server 104 through a network (not shown). 1 shows only one backbone system 102 for convenience of explanation, a plurality of backbone systems 102 of different types may be connected to the server 104 through a network.

As will be described later, the backbone system 102 may provide information about the group and the application period of the security policy to the server 104, and the server 104 may create an exception policy profile for each group based on this. .

The server 104 creates and manages security policies and security profiles. Server 104 may be, for example, an Enterprise Mobility Management (EMM) server. In the present embodiments, the security policy is a policy for protecting corporate assets from major risk factors that threaten an in-house system (not shown), for example, controlling the camera of the terminal 106 (eg, allowing / Prohibition) policy, microphone control (eg, microphone allow/prohibit) policy of terminal 106, recording function control (eg, recording function allow/prohibit) policy of terminal 106, specific of terminal 106 It may be a Wi-Fi SSID (Service Set Identifier) access control (eg, allow/prohibit access to a specific Wi-Fi SSID) policy, a specific application control (eg, allow/prohibit a specific application execution) policy, etc. . Each security policy may exist in the form of one module. In addition, the security profile refers to a set in which one or more security policies are combined in a modular form and applied to the terminal 106 .

The server 104 may define one or more security policies according to an input of an administrator, and create a security profile from a combination of one or more security policies. As an example, the server 104 may configure security policy A (eg, camera control policy), security policy B (eg, microphone control policy), security policy C (eg, application control) according to an input of an administrator. policies) and the like, and according to the input of the administrator, security profile #1 including security policy A and security policy B may be created. In addition, the server 104 may generate a security profile #2 including the security policy A and the security policy C according to the input of the administrator. In this case, each defined security policy may be stored in the server 104 in a modular form, and may be combined with each other according to an administrator's input to form one security profile. That is, since the server 104 can easily create a desired type of security profile by recycling the modularized security policy, there is no need to redefine each security policy included in the security profile every time the security profile is created. there will be no

In addition, the server 104 maps the security profile generated according to the administrator's input to at least one of the set groups. In the present embodiments, a group means one or more users or a set of terminals 106 possessed by the users. The administrator may select a group to which the generated security profile is applied, and accordingly, the server 104 may allocate the selected group to the security profile and map them to each other.

Thereafter, the server 104 transmits the information about the security profile to one or more terminals 106 belonging to the mapped group. As an example, when the group mapped to the security profile includes terminals a, b, and c, the server 104 may transmit information about the security profile to the terminals a, b, and c, respectively. In this case, the terminals a, b, and c may execute a security policy included in the security profile.

Also, the server 104 may create an exception policy profile for each group. In the present embodiments, the exception policy profile is a profile that is preferentially applied to a specific group (or user) for a set period, and one or more security policies, an application period of the security policy, and a group to which the exception policy profile is applied (or user) may be included.

To this end, the server 104 selects one or more of the groups set according to the input of the administrator, and receives one or more security policies corresponding to the selected group and the application period of the security policy from the administrator to generate an exception policy profile. can do.

As an example, the server 104 selects the terminal a according to the input of the administrator, and as the security policy applied to the selected terminal a and the period in which the security policy is applied, the “password control policy” and “May 18, 2017 ~ May 25, 2017” can be input from the above administrator. Accordingly, the server 104 may generate an exception policy profile applied to the terminal a, and transmit information about the generated exception policy profile to the terminal a. In this case, the “password control policy” included in the exception policy profile during the period of “May 18, 2017 to May 25, 2017” may be preferentially applied to terminal a.

In addition, the server 104 may receive information about the period of application of the group and the security policy from the backbone system 102 , and may generate an exception policy profile based thereon.

As an example, the server 104 receives information from the backbone system 102 that the user of “terminal b” has reserved a vehicle for the period of “May 16, 2017 to May 31, 2017” can do. Accordingly, the server 104 receives the security policy “smart car control application permission policy” from the administrator, and sets the security policy “smart car control application permission policy” to “terminal b” and “2017 May 16 ~ 2017” May 31” can be mapped to create an exception policy profile. The server 104 may transmit information about the created exception policy profile to terminal b, and in this case, the “smart car” included in the exception policy profile during the period of “May 16, 2017 to May 31, 2017” Control application permission policy” may be preferentially applied to terminal b.

In addition, when there are a plurality of security policies included in the security profile or the exception policy profile, the server 104 receives the priority of the plurality of security policies from the manager, and transmits the information about the priority to the terminal 106 ) can be transmitted.

The terminal 106 is a device to which the above-described security policy and security profile are applied, and may be, for example, a wearable device such as a smart phone, a tablet PC, a notebook computer, and a smart watch that can be used together for a user's work or personal use. can In the terminal 106, hardware such as a wireless Internet (WiFi) module, a camera, a microphone, a GPS module, and various applications such as e-mail, messenger, and in-house system required for work may be installed.

As described above, the terminal 106 may receive the information about the security profile or the exception policy profile from the server 104 and execute the received security profile or the exception policy profile.

In addition, the terminal 106 may receive information about the priority of the security policy included in the security profile or the exception policy profile from the server 104 . The terminal 106 executes all the security policies included in the security profile or the exception policy profile, but the incompatible security policies among the security policies (for example, the “Camera Prohibited” policy and the “Camera Allowed” policy) are When two or more exist, at least one of the security policies may be executed in consideration of the priority of the security policies. As an example, the terminal 106 may execute a security policy having a higher priority among the security policies.

2 is a block diagram showing a detailed configuration of the server 104 according to an embodiment of the present invention. As shown in FIG. 2 , the server 104 according to an embodiment of the present invention includes a first interface 202 , a profile manager 204 , and a second interface 206 .

The first interface 202 is a module for data transmission/reception with the terminal 106 . The server 104 may transmit/receive various data to and from the terminal 106 through the first interface 202 . For example, the server 104 may transmit the above-described security profile, exception policy profile, priority information, etc. to the terminal 106 through the first interface 202 .

The profile manager 204 manages a security policy and a security profile. The profile manager 204 may define one or more security policies according to an input of an administrator, and create a security profile from a combination of one or more security policies. Also, the profile manager 204 may map the security profile to at least one of set groups according to the manager's input.

In addition, the profile manager 204 selects one or more of the groups set according to the input of the administrator, and receives one or more security policies corresponding to the selected group and the application period of the security policy from the administrator to generate an exception policy profile. can

In addition, the profile manager 204 may generate the exception policy profile based on information about the group and the application period of the security policy received from the backbone system 102 through the second interface 206 to be described later.

The second interface 206 is a module for data transmission/reception with the backbone system 102 . The server 104 may transmit/receive various data to and from the backbone system 102 through the second interface 202 . For example, the server 104 may receive information about the application period of the group and the security policy from the backbone system 102 from the backbone system 102 through the second interface 202 .

3 to 5 are examples illustrating a process of defining a security policy in the profile manager 204 according to an embodiment of the present invention. As described above, the profile manager 204 may define one or more security policies according to an input of an administrator.

3 to 5 , the profile manager 204 may define a “camera control policy” according to an input of an administrator. As shown in FIG. 4 , the “camera control policy” refers to a policy in which the terminal 106 is prohibited from using a camera. The administrator may define the “camera control policy” by changing the setting regarding the camera among the plurality of security items (eg, camera, screen capture, clipboard, sharing list, etc.) to “prohibit all”. The “camera control policy” created in this way may be displayed on the screen in a form that an administrator can check as shown in FIG. 5 .

6 is an example illustrating a process of generating a security profile in the profile manager 204 according to an embodiment of the present invention. As described above, the profile manager 204 may generate a security profile from a combination of one or more predefined security policies according to an input of an administrator.

In the above example, the administrator may create a security profile including the defined “camera control policy”, and the created security profile will be displayed on the screen in a form that the administrator can check as shown in FIG. 6 . can In addition, the administrator may reset the security profile by adding other defined security policies to the security profile in addition to the “camera control policy”.

7 is an example illustrating a process of mapping a security profile to a group in the profile manager 204 according to an embodiment of the present invention. As described above, the profile manager 204 may map the security profile to at least one of the set groups according to an input of the administrator.

Referring to FIG. 7 , the profile manager 204 may map the security profile to user A according to an input of an administrator. Thereafter, the first interface 202 may transmit the information about the security profile to the terminal 106 possessed by the user A, and accordingly, the terminal 106 may execute the security profile.

8 and 9 are diagrams illustrating a process of generating an exception policy profile in the profile manager 204 according to an embodiment of the present invention. As described above, the profile management unit 204 selects one or more of the groups set according to the input of the administrator, and receives one or more security policies corresponding to the selected group and the application period of the security policy as input from the administrator to profile the exception policy. can create

8 and 9, the profile manager 204 selects “SmartKeyUser” from among the groups set according to the input of the administrator, and the security policy corresponding to the selected “SmartKeyUser”, that is, “password policy” and “app installation” Control policy” and the application period of the security policy, that is, the period of “May 18, 2017 ~ May 25, 2017” can be input from the administrator. The profile manager 204 may create an exception policy profile for “SmartKeyUser” based on the selected group, the security policy, and the application period of the security policy. In this case, the profile manager 204 may create the exception policy profile so that different security policies are applied to each operating system (eg, Android, iOS, etc.) of each terminal included in the selected group.

10 is an example of application of an exception policy profile according to an embodiment of the present invention. As described above, the profile manager 204 may create the exception policy profile based on information about the group and the application period of the security policy input from the backbone system 102 .

As an example, the server 104 receives information from the backbone system 102 that the user of “terminal b” has reserved a vehicle for the period of “May 16, 2017 to May 31, 2017” and, from this, an exception policy profile for “terminal b” can be created.

11 is a flowchart illustrating a process of generating a security profile according to an embodiment of the present invention. In the flowcharts shown in FIGS. 11 to 13, the method has been described by dividing the method into a plurality of steps, but at least some steps are performed in a different order, performed together in combination with other steps, omitted, or divided into detailed steps. Alternatively, one or more steps not shown may be added and performed.

In step S102, the server 104 defines one or more security policies according to the input of the administrator.

In step S104, the server 104 creates a security profile from a combination of one or more of the security policies according to the input of the administrator.

In step S106, the server 104 maps the security profile to at least one of the set groups according to the input of the administrator.

In step S108, the server 104 transmits the information about the security profile to one or more terminals 106 belonging to the mapped group.

In step S110 , the terminal 106 executes the security profile received from the server 104 .

12 is a flowchart illustrating a process of generating an exception policy profile according to the first embodiment of the present invention.

In step S202, the server 104 selects one or more of the groups set according to the input of the administrator.

In step S204, the server 104 receives one or more security policies corresponding to the selected group and an application period of the security policies from the administrator.

In step S206, the server 104 creates an exception policy profile for the selected group based on the input security policy and the application period of the security policy.

In step S208, the server 104 transmits the generated exception policy profile to the terminal 106 belonging to the group.

In step S210 , the terminal 106 executes the exception policy profile received from the server 104 .

13 is a flowchart illustrating a process of generating an exception policy profile according to the second embodiment of the present invention.

In step S302 , the server 104 receives information about the application period of the group and the security policy from the backbone system 102 .

In step S304 , the server 104 receives one or more of the defined one or more security policies from the administrator, and maps the inputted security policies to the group received from the backbone system 102 .

In step S306, the server 104 creates an exception policy profile for the group based on the input security policy and the application period of the security policy.

In step S308, the server 104 transmits the generated exception policy profile to the terminal 106 belonging to the group.

In step S310 , the terminal 106 executes the exception policy profile received from the server 104 .

14 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

The illustrated computing environment 10 includes a computing device 12 . In one embodiment, computing device 12 may be one or more components included in backbone system 102 , server 104 , or terminal 106 .

Computing device 12 includes at least one processor 14 , computer readable storage medium 16 , and communication bus 18 . The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiments discussed above. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16 . The one or more programs may include one or more computer-executable instructions that, when executed by the processor 14, configure the computing device 12 to perform operations in accordance with the exemplary embodiment. can be

Computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14 . In one embodiment, computer-readable storage medium 16 includes memory (volatile memory, such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash It may be memory devices, other forms of storage medium accessed by computing device 12 and capable of storing desired information, or a suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12 , including processor 14 and computer readable storage medium 16 .

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24 . The input/output interface 22 and the network communication interface 26 are coupled to the communication bus 18 . Input/output device 24 may be coupled to other components of computing device 12 via input/output interface 22 . Exemplary input/output device 24 may include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices, and/or imaging devices. input devices and/or output devices such as display devices, printers, speakers and/or network cards. The exemplary input/output device 24 may be included in the computing device 12 as a component constituting the computing device 12 , and may be connected to the computing device 12 as a separate device distinct from the computing device 12 . may be

Although the present invention has been described in detail through representative embodiments above, those of ordinary skill in the art to which the present invention pertains can make various modifications to the above-described embodiments without departing from the scope of the present invention. will understand Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims described below as well as the claims and equivalents.

10: Computing Environment
12: computing device
14: processor
16: computer-readable storage medium
18: communication bus
20: Program
22: input/output interface
24: input/output device
26: network communication interface
100: security management system
102: backbone system
104 : server
106: terminal
202: first interface
204: profile management unit
206: second interface

Claims (12)

a profile manager for defining one or more security policies according to an input of an administrator, creating a security profile from a combination of one or more of the security policies, and mapping the security profile to at least one of set groups according to an input of the administrator; and
A first interface for transmitting information about the security profile to one or more terminals belonging to the mapped group,
The profile management unit selects one or more of the groups according to the input of the administrator, and receives one or more security policies corresponding to the selected group and an application period of the security policy from the administrator to generate an exception policy profile, ,
The first interface transmits the information on the exception policy profile to one or more terminals belonging to the selected group,
The exception policy profile is preferentially applied to the selected group during the application period.
The method according to claim 1,
Each defined security policy is stored in a modular form,
The profile manager, receiving one or more of the defined security policies from the administrator, and generating the security profile including the input one or more security policies, the server.
delete The method according to claim 1,
Further comprising a second interface for receiving information about the group and the application period from the backbone system,
The profile manager is configured to generate the exception policy profile from information about the group and the application period input from the backbone system.
The method according to claim 1,
The profile manager, when there are a plurality of security policies included in the security profile or the exception policy profile, receives an input of priorities regarding the plurality of security policies from the manager.
The server according to any one of claims 1 to 2 or 4 to 5; and
and a terminal for receiving a priority regarding a plurality of security policies from the server, and executing at least one of the plurality of security policies in consideration of the priority of the security policy.
In the profile manager of the server, defining one or more security policies according to the input of the administrator;
generating, in the profile manager, a security profile from a combination of one or more security policies according to an input of the administrator;
mapping, in the profile manager, the security profile to at least one of the set groups according to the input of the manager; and
In the first interface of the server, comprising the step of transmitting the information about the security profile to one or more terminals belonging to the mapped group,
After the step of defining the security policy,
selecting, in the profile manager, one or more of the groups according to an input of the manager;
generating an exception policy profile by receiving, in the profile manager, one or more security policies corresponding to the selected group and an application period of the security policy from the manager; and
The method further comprises transmitting, in the first interface, information on the exception policy profile to one or more terminals belonging to the selected group,
The exception policy profile is preferentially applied to the selected group during the application period.
8. The method of claim 7,
Each defined security policy is stored in a modular form,
The generating of the security profile includes receiving one or more of the defined security policies from the administrator, and generating the security profile including the input one or more security policies.
delete 8. The method of claim 7,
After the step of defining the security policy,
In the second interface of the server, further comprising the step of receiving information about the group and the application period from a system system,
The generating of the exception policy profile includes generating the exception policy profile from information about the group and the application period input from the backbone system.
8. The method of claim 7,
After the step of defining the security policy,
In the profile manager, when there are a plurality of security policies included in the security profile or the exception policy profile, the method further comprising the step of receiving a priority regarding the plurality of security policies from the manager.
12. The method of claim 11,
After the step of receiving the priority input,
receiving, in the terminal, priorities related to a plurality of security policies from the server; and
The method further comprising, in the terminal, executing at least one of the plurality of security policies in consideration of the priority of the security policy.

Images