KR20030093610A - prints a document, it is a water mark indication print output method of by certification information in an Access control function of a security regulation base - Google Patents

Abstract

The present invention relates to a watermark display printout method of authentication information by a security rule access control function promised when outputting all documents for output document security. According to the present invention, when a user executes a document file printer on a client computer, the client secure printer AGENT executes and provides file and printer information through a socket communication to a host (file server) system, and checks whether the authentication is performed. After creating a watermarked image that cannot be transformed into a document on the central background of the file output, the authentication information through socket communication and the watermarked image through the client printer driver are transmitted to the print server. The printer server then automatically executes a secure printer proxy that recognizes the print system call and outputs the watermark display output according to the printer usage permission (whether or not the client AGENT is used). If a print request is received without going through the client secure printer AGENT, the secure printer proxy that recognizes the system call is automatically executed to delete the print image and prevent the print. In addition, regardless of permission, output request information can be stored in the log of host (file server) system for audit trail.

Description

{Prints a document, it is a water mark indication print output method of by certification information in an Access control function of a security regulation base}

The present invention is a method for maintaining security (outflow prevention) of all output documents regardless of the type of OS (Operating System), and authenticates whether or not to output files and printers with an access control function based on a promised security rule (documents without security registration). In the case of a file, it is authenticated with system internal information (login ID), and the authentication information (user ID, time, computer ID) of the output file is difficult to modify the document for security (real name) of the output document. This document relates to a security document leakage prevention method that inserts and prints a document in the form of a blurred background pattern or logo.

According to KISA's data, the number of hacking incidents has increased by about 400% in 2001 compared to the previous year. Also, the problem of information leakage to the outside caused by insider's intention or indifference caused a lot of social controversy.

As a result, many security-related technologies have been developed, and many of them are still being developed. However, most of the security technologies currently being developed are mainly composed of security technology for hacking from the outside to the inside, and recently, a technology for securing the OS itself, called Secure OS, has emerged. The above techniques can cause the following problems.

First, the security technology that enters from the outside can prevent the insider from intentionally or indifferent to prevent and prevent the audit trail if the confidential document is copied or printed out and printed out to users or outsiders who do not have access. do.

Second, the Secure OS technology, which is the security of the OS itself, can also control access to files by insiders, but there is no security function in case of leakage of the output. In addition, even if only the authentication information is output to the header or footer without displaying the watermark on the central background of the printout, the deformation of the printout is simple, so that the subject matter can not be audited and tracked.

50 to 60% of intruders are internally authenticated and authenticate whether or not to print files and printers with the promised security rule-based access control function when all documents are printed to prevent security accidents due to neglect of management, falsification or random leakage. In the case of a document file without registration, authentication is performed using the system internal information (login ID), and the authenticated authentication information (user ID, output time, computer ID) is displayed as a watermark (cloudy background pattern or logo type) that is difficult to modify the document. Document output image By inserting and printing on the center of the original image, all the printed documents are secured (realized) and prevented leakage of documents, so that confidential information is not intentionally or irresponsibly leaked. In addition, authentication information will be recorded in the audit log so that audit trails of non-authorized output requests and accountability for document leakage can be clarified.

Most of the current system configuration uses a Unix server, a Linux server, and a Windows 2000 server for the main server (file server, mail server), and most of the clients consist of a Windows OS and a printer server. Accordingly, another technical problem to be achieved by the present invention is to output the heterogeneous printer output request according to the form of most system configurations, regardless of the type of OS, so that only the printout displayed with the authentication information watermark is output. If the print request without watermark display is rejected by the print server, all output documents will be secured (realized).

1 is a configuration diagram of an authentication information watermark display output whole system of the present invention.

Figure 2 is a block diagram of a client security printer AGENT functional block in Figure 1;

3 is a block diagram of a secure printer proxy function block in FIG. 1; FIG.

Figure 4 is a flow chart of the authentication information watermark display output system of the present invention.

5 is an illustration of a document printed in accordance with the present invention.

<Description of the code | symbol about the principal part of drawing>

100: host (file server) 200: client (user computer)

210: Client Secure Printer AGENT 300: Printer Server

310: secure printer proxy 400: printer

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a system for displaying authentication information watermark output according to the present invention.

This system configuration largely controls the client system 200 requesting document output, the file and the printer according to the security rules promised, and determines whether to output the output and the host system 100 managing the audit record information. It consists of a print server 300 to print. Here, the host system 100 and the print server 300 may be configured in the same system.

Looking at the more specific configuration and action according to such a configuration as follows.

When the client computer 200 selects a printer driver provided by the client secure printer AGENT 210 and requests document output, the client secure printer AGENT 210 in the client system is operated internally to operate the promised client security rule (eg Authentication request information (printer ID, document name, user ID, password) according to the document type, whether the printer has been authenticated, whether the printer has been authenticated, and if the document or printer is not listed in the rule, the initial login information is authenticated with the authentication information. , Computer ID) is transmitted to the host system 100 to authenticate the printer usage and document output. After authentication, the client security printer AGENT 210 prints the authentication information (user ID, print time, computer ID) as a watermark (blurred background pattern or logo) that is difficult to transform the document. It generates an image and transmits the authentication information to the secure printer proxy 310 in the print server, and registers the permission to output the document to the printer driver in the print server. At the same time, the print image with the watermark is connected to the network printer driver for transmission. When the printer output document comes to the printer server 300, the secure printer proxy 310, which recognizes the printer system call, is operated to check whether the printer is registered for permission to use, send a permission message, and send the printout to the printer spool to print the printer 400. To output In addition, the authentication information is sent to the audit log of the host system to be recorded.

If the client system does not execute the client secure printer AGENT 210 (does not select the printer driver of the secure AGENT 210), and requests a document output from the print server, the secure printer proxy 310 is installed in the print server. If it is, the secure printer proxy 310 in the print server recognizes the printer system call (event call) and operates immediately to reject the document output and sends the computer ID, user ID and time to the audit log of the host system for storage. do.

The above was a description of the overall system configuration, and when described in terms of individual systems, first, the client security printer AGENT 210, the user login module (when using the file security level, 211), file access as shown in FIG. The control module 213, the printer server authentication module 214, the authentication information watermark display module 215, and the printer drive connection module 216 are configured.

Referring to the configuration of Figure 2, first select the software printer driver provided by the client security printer AGENT 210 in the client computer, and then request a document output, a screen to select a network printer appears, and when the printer is selected internally The file access control module 213 in the secure printer AGENT 210 is executed to execute the promised client security rules (e.g., whether to obtain authentication according to a document type, whether to authenticate a printer, or a document or a printer not listed in the rule. Authenticate the authentication request information (printer ID, document name, user ID, password, computer ID) to the host system 100 if necessary according to the authentication information, and the host system 100 promises host security rules (e.g., Secure registration of documents on all computers or secure documents only on host computers If the class properties, etc., and a printer according to the US document rules is certified to use the authentication hereinafter). If the authentication is not received, the login module 211 is executed to re-enter the user ID and password to be authenticated again.

For reference, the file access control module 213 may be selected in various forms. First, the first method communicates information such as user ID, password, printer ID, file name, computer ID, etc. with the information of the client computer when logging in to the host system with the file and printer class module for authentication. The second method is to force login etc. whenever the document information such as user ID is printed out so as to communicate with the host system for authentication. In the third method, the file access control module 213 is configured to perform the authentication information watermark display output using only the initial login information, the computer ID, and the file name of the client system without installing the file and printer security module in the host system. It only plays the role of transmitting authentication information to the next module by creating only authentication information with information.

When the file access control module 213 is authenticated, the printer server authentication module 214 is executed to transmit the authentication information to the secure printer proxy 310 in the print server 300 to output the document to the printer driver in the print server. We register permission to have. At the same time, the authentication information watermark display module 215 is executed to insert authentication information (user ID, output time, computer ID) into the watermark display that is difficult to transform the document into the center of the original document output image to generate an output image, and The drive connection module 216 is executed to connect the watermarked output image to a network printer drive and transmit the output image to the printer server.

For reference, when the authentication information watermark display module 215 is described, authentication information (computer ID) is used on the central background prior to the output image type that is previously sent when the Word, PPT, Excel, HWP, Text document, and report are output. , User ID, time) to create a base image in the form of a watermark that is difficult to modify the document, and to overwrite the existing output with the parent image to create a printout displaying the authentication information watermark.

The individual system described below is a secure printer proxy 310 in the print server, which is largely represented by a host communication module 311, a security context processing module 312, a printer access control module 313, as shown in FIG. It consists of a printer drive connection module 314.

3, the printer access control module 313 recognizes the printer system call (event) of the print server when an output request is received from the client computer, and automatically executes the printer access control module 313. It is checked whether it is transmitted via this client secure printer AGENT 210 or an output is requested without authentication (checking the printer permission information stored by the security context processing module 312). ) To print out the printer driver or delete it from the spool. The method of checking whether the user is authenticated is that the client security printer AGENT 210 executes a socket transmission of authentication information (user ID, output time, computer ID), and the security context module 312 is executed to transfer the authentication information to the promised place. The printer access control module 313 determines whether to permit the information with the information of the appointment place.

At the same time, by executing the host communication module 311 transmits the authentication information (user ID, output time, computer ID, printer ID) received from the client security printer AGENT 210 to the printer audit log module 140 of the host system Save to the log. When the output request is received without the client security printer AGENT 210, the computer ID, user ID, time, printer ID, etc. of the client computer are transmitted to the printer audit log module 140 of the host system and stored in a log. Allow for future audit trails. The role of the printer drive connection module 314 is to control the spool (queue) of the printer driver upon request of the printer access control module 313 so as to delete it from the spool if it is not allowed and to force output only when it is allowed. . In addition, the system can be configured and operated so that the printer server system can take on the role of the host system.

FIG. 4 is a flowchart illustrating the authentication information watermark display output method of FIG. 4.

This is described in detail with respect to the flowchart of FIG. There are three types of user approach. The first approach is to allow client users to access document files inside the host system, authenticate them with the file access control provided, and to request the output. The second approach is to output the client internal document files. This method provides authentication request information to the host system when required by the promised client security rule and authenticates the output according to the promised host security rule. The third approach is to request output directly without passing through the client secure printer AGENT 210.

In the third approach, if the client computer requests a printout without authentication to the network printer server, the printer access control module of the server security proxy 310 in the print server 300 is executed (P17), and output request information (computer ID, user ID, File name, time) is stored in the audit log of the host system (P19) and the output request is rejected (P22) to prevent the output.

The first and second approaches are described below on the assumption that the file and printer security modules are installed on the host system. If the file and printer security modules are not installed on the host system, only the security level authentication check will be skipped. .

First, looking at the document output request part of the second approach in detail, it is executed in the following order.

First, users P1 and P2 select an output document file from the client computer to enter the print screen.

Second, the user selects the printer driver P6. When the printer driver selects the software printer driver provided by the client security printer AGENT 210, a screen for selecting the network printer driver is displayed again, and the physical printer is selected. The user then OKs the document file printing (P7).

Third, the file access control module of the client security printer AGENT 210 is executed internally (P8) to promise client security rules (e.g., whether to obtain authentication according to document type, whether to authenticate a printer, a document or a printer not listed in the rule). In case of, the authentication request information (printer ID, document name, user ID, password, computer ID) is transmitted to the host system 100 according to the authentication of the initial login information with authentication information (execution of paragraph 4). Create authentication information with your own login information and go directly to Section 6 (execution of P11).

The fourth, the file of the host system, the printer security module 130 is based on the authentication request information received in claim 3 host security rules (for example, document security registration of all computers or only documents of the host computer security registration, printer security level In the case of a document or a printer that is not described in the rules, such as registration, authentication is used), it is determined whether to authenticate (P10) and sent to the client security printer AGENT 210.

Fifth, if authentication is not allowed, the login input module 211 of the client security printer AGENT 210 is executed (P9) to request re-entry of the user ID and password. If authentication is denied more than once, the printer output screen ends with the rejection message P22.

Sixth, if authentication is permitted, the printer server authentication module of the client secure printer AGENT 210 is executed (P11), and the authentication information is transmitted to the security context processing module 312 in the print server.

The authentication information watermark display module of the client security printer AGENT 210 is executed (P12) at the same time as in claim 7, wherein the authentication information is set on the central background prior to the output image form previously sent when the document or report is output. Create a background image in the form of a watermark of (Computer ID, User ID, Time), and overwrite the existing output with the parent image to create a watermarked output (P13) to run the printer driver connection module (P14) to print the client printer driver (P15). Connect to

The security context processing module 312 in the print server is executed (P16) in accordance with claims 8 and 6 to store the printer permission information in the promised place.

According to claim 9 and 7, the printer access control module 313 in the print server recognizes the print system call and automatically executes it (P17) to perform a printer permission check (P18), and then sends a permission message to the client and print server. Whether the permission is sent to the printer drive connection module (P20).

10. Regardless of permission or permission, the authentication information (computer ID, user ID, file name, time) is transmitted to the audit log module 140 of the host system to be recorded in the audit log (P19) so that it can be audited later. .

The printer driver connection module P20 of the print server according to claim 11 or 9 is executed to be connected to a physical drive to output the printout P21 of the authentication information watermark.

The form of the resultant according to the invention described above is illustrated in FIG. 5.

All the processes described above show a method of displaying the authentication information in a watermark on the central portion of all the document background images as a result illustrated in FIG. 5. The file and print access control function that appears during the printing process is only a function that determines whether or not the output is authenticated according to the user's promised security rules, and the watermark display of authentication information is only authenticated by the promised security rules regardless of user definition. If received, the authentication information is output as a watermark when all documents are output.

In the above, the system configuration diagram, block configuration diagram and flowchart of the present invention have been described in detail with reference to the accompanying drawings.

According to the general results of the present invention, the promised security rules are set at the time of outputting all documents, and the file and printer access control functions, and the authentication information (user ID, output time, computer ID) is automatically modified in all authenticated outputs. As it is displayed in the form of a difficult watermark, audit trails can be traced in the future, and the user of the printout can take the responsibility of responsibility to proactively secure the leak. Therefore, it is possible to prevent the problem of leaking security information irresponsibly and easily, thereby improving the security and managing the responsibility of the security document.

Another effect of the present invention is that most of the current system configuration forms UNIX server, Linux server, Windows 2000 server as main server (file (DB) server, mail server), and most clients use Windows OS, printer server as Windows. It consists of an operating system (OS). Accordingly, the present invention, such as most system configuration is to display the heterogeneous document output irrespective of the type of OS to display the authentication information (user ID, output time, computer ID) in the form of a watermark, so that the document output Without the authentication information (displaying the authentication information watermark), the print server rejects the output when the print request is made, thereby enhancing the security authentication of all prints.

Claims (7)

When printing documents under any OS (Operating System) environment, various authentication information such as user ID is automatically displayed in the form of a watermark in the center of the printed document. (a) When the subject requests the output, the client security printer AGENT is executed to create a background image in the form of a watermark in the center of the output document with various authentication information such as a user ID, and overwrite the existing output with the parent image. A method of making and providing an image to a printer driver; (b) providing authentication information (computer ID, user ID, time, file name) to the secure printer proxy through the socket at the client secure printer AGENT, and storing the printer permission information in the promised place; (c) a security printer proxy automatically detects a print system call (event) for an output request generated at the print server to determine whether to use the printer; And (d) causing the secure printer proxy to control a printer driver and output only the watermarked output. The method according to claim 1, wherein the method of providing a software printer driver to the client secure printer AGEN T in the client computer in step (a) and the promised security rules (e.g., whether to obtain authentication according to document type, whether to authenticate the printer, In case of an undocumented document or a printer, the first login information is authenticated with the authentication information). The method of claim 1, wherein the printout request information or authentication information is recorded in the audit log through step (c). The method according to claim 1, wherein in the step (d), the spool (queue) of the printer driver is controlled to delete from the spool if it is disallowed and to output only when the permission is allowed. The method of claim 2, wherein the access control technology based on the promised security rules is a user-oriented flexible access to use only the host access control function, the client's own access control function, or the existing login information according to the security policy established by the administrator. This is a control technology and a method of making an image in the form of a watermark using output authentication information. The client security printer AGENT, (a) a file access control module for generating output authentication information using a file and a printer access control function according to a promised security rule; (b) a login module for causing a user to input user information by a printer or file authentication failure in accordance with the promised security rules; (c) a printer server authentication module for socket-transmitting authentication information authenticated by the module to a secure printer proxy described below and receiving authorization information; (d) A certification information watermark display module that creates a background image in the form of a watermark in the center of the output document with various authentication information such as computer ID, user ID, and time, and overwrites the existing output with the parent image to create a watermarked document output image. ; And (e) A client secure printer AGENT in a client system, characterized by comprising a module for connecting a watermark display image made by the module to a printer driver. The secure printer proxy, (a) a host communication module for recording output authorized authentication information or output disabled output information (computer ID, user ID, time, etc.) received from a client system in an audit log in the host system or an audit log in its own system; (b) a secure context processing module for receiving authentication information from the client secure printer AGENT via a socket and storing the printer permission information in the promised place; (c) a printer access control module for automatically detecting a printer system call (event) for an output request occurring at a print server and determining whether to use a printer; And (d) Secure printer proxy in a print server system, characterized by controlling the printer driver's spool (queue) to control the spool (queue) of the printer driver and to delete it from the spool and to force output only if it is permitted.